Hi Sujal, Thanks for reminding me and apologies for the delay.
There is nothing inherently wrong with the 'evil.cpio' archive: it is a perfectly valid archive, indeed. That being said, I of course agree, that it and similarly constructed archives can be used for malicious purposes. But "can" does not mean "must", so I see no reason why cpio should absolutely refuse to extract it. If additional safety is needed, the --no-absolute-filenames option will provide it. The proposed patch in fact makes it the default *for this particular case*, without addressing another possible use cases, which is, in my opinion, wrong. Best regards, Sergey
