From 00652683729bba4ab0742c27db25d32904ed6ac6 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 22:56:49 +1000 Subject: [PATCH] Unexport the unguarded seed write --- internal/bind/seed.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/internal/bind/seed.go b/internal/bind/seed.go index b59bf89..353e97a 100644 --- a/internal/bind/seed.go +++ b/internal/bind/seed.go @@ -54,7 +54,8 @@ ns1 IN A %s // EnsureSeedZone makes path loadable without discarding live data: it probes // the zone file and journal, moves aside whatever cannot load, and writes a // skeleton only when there is nothing to preserve. Every caller that needs a -// zone database file on disk goes through here, never WriteSeedZone directly. +// zone database file on disk goes through here: writeSeedZone is unexported so +// the destructive write cannot be reached without a plan. func (e *Executor) EnsureSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string) error { state, err := e.ZoneDiskState(ctx, namespace, pod, path) if err != nil { @@ -70,13 +71,12 @@ func (e *Executor) EnsureSeedZone(ctx context.Context, namespace, pod, zone, pat if !plan.WriteSeed { return nil } - return e.WriteSeedZone(ctx, namespace, pod, zone, path, primaryIP, plan.Serial) + return e.writeSeedZone(ctx, namespace, pod, zone, path, primaryIP, plan.Serial) } -// WriteSeedZone writes a seed zone file to path, creating parent directories. -// It overwrites any existing file unconditionally: use EnsureSeedZone unless -// the caller has already run PlanSeed and acted on it. -func (e *Executor) WriteSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error { +// writeSeedZone writes a seed zone file to path, creating parent directories. +// It overwrites any existing file unconditionally. +func (e *Executor) writeSeedZone(ctx context.Context, namespace, pod, zone, path, primaryIP string, serial int64) error { content := renderSeedZone(zone, primaryIP, serial) q := shellQuote(path) cmd := []string{"sh", "-c", fmt.Sprintf("mkdir -p \"$(dirname %s)\" && cat > %s", q, q)}