Confine local file installation paths

internal/fileops/fileops.go

@@ -32,7 +32,7 @@ type ReplaceFileOptions struct {
 // existing destination or directory syncing is unavailable, it returns an
 // error rather than claiming an equivalent durability guarantee.
 func ReplaceFileAtomic(dst string, data []byte, options ReplaceFileOptions) error {
-	return replaceFileAtomicWithOperations(dst, data, options, systemAtomicReplacementOperations)
+	return replaceFileFromReaderConfined(dst, bytes.NewReader(data), options)
 }
 
 // WriteFileAtomic creates the destination parent with workspace permissions
@@ -72,11 +72,10 @@ func CopyFileAtomicWithChecksum(src, dst string, perm os.FileMode) (string, erro
 	}
 
 	digest := sha256.New()
-	err = replaceFileFromReaderWithOperations(
+	err = replaceFileFromReaderConfined(
 		dst,
 		io.TeeReader(in, digest),
 		ReplaceFileOptions{Mode: perm},
-		systemAtomicReplacementOperations,
 	)
 	if err != nil {
 		return "", err
@@ -94,7 +93,7 @@ func InstallDownloadedTempFile(tmpPath, dst string, perm os.FileMode) error {
 	if err := EnsureWorkspaceDirectory(filepath.Dir(dst)); err != nil {
 		return fmt.Errorf("create destination directory: %w", err)
 	}
-	return installDownloadedTempFileWithOperations(tmpPath, dst, perm, systemAtomicReplacementOperations)
+	return installDownloadedTempFileConfined(tmpPath, dst, perm)
 }
 
 type temporaryFile interface {