Function cbm_mkdtemp

src/foundation/compat.c:116–175

}

char *cbm_mkdtemp(char *tmpl) {
    /* Build path in static buffer, then copy back to caller.
     * Callers must provide buffers >= CBM_SZ_256 bytes (all test code does). */
    static char buf[CBM_SZ_512];
    if (strncmp(tmpl, "/tmp/", 5) == 0) {
        const char *tmp = getenv("TEMP");
        if (!tmp)
            tmp = getenv("TMP");
        if (!tmp)
            tmp = ".";
        snprintf(buf, sizeof(buf), "%s\\%s", tmp, tmpl + 5);
    } else {
        snprintf(buf, sizeof(buf), "%s", tmpl);
    }
    /* Wide-API template expansion: the ANSI CRT interprets the UTF-8 bytes of
     * non-ASCII cache/temp components in the local codepage and fails. */
    wchar_t *wide_template = cbm_utf8_to_wide(buf);
    if (!wide_template || !_wmktemp(wide_template)) {
        free(wide_template);
        return NULL;
    }
    char *expanded = cbm_wide_to_utf8(wide_template);
    free(wide_template);
    if (!expanded || strlen(expanded) >= sizeof(buf)) {
        free(expanded);
        return NULL;
    }
    strcpy(buf, expanded);
    free(expanded);
    if (!win_mkdtemp_private_create(buf)) {
        /* One-time note: every private-namespace validation downstream
         * depends on the explicit descriptor, so a silent fallback turns
         * into unexplained owner/DACL refusals far from this call site. */
        static bool fallback_reported;
        DWORD create_error = GetLastError();
        wchar_t *wide_directory = cbm_utf8_to_wide(buf);
        int mkdir_result = wide_directory ? _wmkdir(wide_directory) : -1;
        free(wide_directory);
        if (mkdir_result != 0)
            return NULL;
        if (!fallback_reported) {
            fallback_reported = true;
            (void)fprintf(stderr,
                          "warning: private temp-directory descriptor unavailable "
                          "(os %lu); using default directory security\n",
                          (unsigned long)create_error);
        }
    }
    /* Normalize to forward slashes. Callers embed this path in JSON repo_path
     * (where "\t"/"\a" are invalid escapes → index fails) and pass it to git -C.
     * Windows file APIs accept forward slashes, so the created dir is unaffected. */
    for (char *p = buf; *p; p++) {
        if (*p == '\\') {
            *p = '/';
        }
    }
    /* Copy result back — callers now use char[CBM_SZ_256]+ buffers */
    strcpy(tmpl, buf);