From 392462ec101c61fed006014f646a53cb391d0cbd Mon Sep 17 00:00:00 2001
From: Ben Boeckel <ben.boeckel@kitware.com>
Date: Tue, 7 Jul 2026 12:38:30 -0400
Subject: [PATCH] fix(save): lock staging directory against concurrent gc

---
 Sources/tart/OCI/OCIArchiveWriter.swift | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Sources/tart/OCI/OCIArchiveWriter.swift b/Sources/tart/OCI/OCIArchiveWriter.swift
index b573866..c66833d 100644
--- a/Sources/tart/OCI/OCIArchiveWriter.swift
+++ b/Sources/tart/OCI/OCIArchiveWriter.swift
@@ -3,6 +3,7 @@ import Foundation
 class OCIArchiveWriter {
   private let tmpDir: URL
   private let blobsDir: URL
+  private let lock: FileLock
   private var manifestDigest: String?
   private var manifestSize: Int?
   private var manifestReferences: [String] = []
@@ -12,9 +13,14 @@ class OCIArchiveWriter {
     tmpDir = try Config().tartTmpDir.appendingPathComponent(UUID().uuidString)
     blobsDir = tmpDir.appendingPathComponent("blobs/sha256")
     try FileManager.default.createDirectory(at: blobsDir, withIntermediateDirectories: true)
+    lock = try FileLock(lockURL: tmpDir)
+    if try !lock.trylock() {
+      throw RuntimeError.Generic("failed to lock archive staging directory")
+    }
   }
 
   deinit {
+    try? lock.unlock()
     try? FileManager.default.removeItem(at: tmpDir)
   }
 }