Confine local file installation paths

internal/manifest/store.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -45,18 +46,35 @@ func (s *LocalStore) Load(ctx context.Context, path string) (*Manifest, error) {
 		return nil, fmt.Errorf("load manifest: path is required")
 	}
 
-	data, err := os.ReadFile(path)
+	file, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("load manifest %q: %w", path, err)
 	}
+	defer file.Close()
+	return s.LoadReader(ctx, file)
+}
+
+// LoadReader reads and validates a manifest from a caller-owned reader.
+func (s *LocalStore) LoadReader(ctx context.Context, source io.Reader) (*Manifest, error) {
+	if err := checkContext(ctx); err != nil {
+		return nil, err
+	}
+	if source == nil {
+		return nil, fmt.Errorf("load manifest: source is required")
+	}
+
+	data, err := io.ReadAll(source)
+	if err != nil {
+		return nil, fmt.Errorf("read manifest: %w", err)
+	}
 
 	var m Manifest
 	if err := json.Unmarshal(data, &m); err != nil {
-		return nil, fmt.Errorf("decode manifest %q: %w", path, err)
+		return nil, fmt.Errorf("decode manifest: %w", err)
 	}
 
 	if err := validateLoadedManifest(&m); err != nil {
-		return nil, fmt.Errorf("manifest %q invalid: %w", path, err)
+		return nil, fmt.Errorf("manifest invalid: %w", err)
 	}
 	normalizeManifest(&m)