fsatomic

Overview ¶

Package fsatomic performs symlink-safe atomic file replacement for the installer's preference and confirmed-state files.

A write uses one same-directory create-exclusive temp, flushes the bytes, atomically renames over the destination, and flushes the parent directory. The live process best-effort removes only the exact temp it created. A crash orphan is never scanned, deleted, reused, or treated as recovery input; a later save allocates a fresh random temp and the committed file remains authoritative.

The destination must be a regular file or absent. A symlink or other unsafe destination type fails before any write, so a hostile link can never redirect a Pasture write outside the intended path.