5.13 Payload Paths
A payload entry's tar path is its install location, resolved against the
installation root (§5.19). A tar entry at usr/bin/nginx installs to
/usr/bin/nginx.
5.13.1 Constraints #
A payload path MUST:
- be relative — it MUST NOT begin with
/ - contain no segment equal to
.or.., or any encoding thereof - be valid UTF-8 (RFC 3629)
- contain no NUL byte (
0x00) and no ASCII control character (0x01–0x1F,0x7F) - contain no backslash (
\) - be in Unicode Normalization Form C, per Unicode 16.0
- have every component at most 255 bytes when encoded as UTF-8
- be at most 4096 bytes in total when encoded as UTF-8
- have at most 256 components
- not begin with
.peipkg/, and not be literally.peipkg(§5.12)
A consumer MUST validate every payload path against these constraints before any further processing of the entry. A package containing a non-conforming payload path MUST be rejected.
5.13.2 No canonicalisation #
Path resolution MUST NOT canonicalise away .. or . segments by
interpretation. Such segments are forbidden above; any appearance is a
format error, not a question of path canonicalisation.
5.13.3 Empty payloads #
A package MAY have zero payload entries. Such a package carries only metadata; installing it records the package and runs any declared side effects (§5.24).