The installer previously ran `tar -xzf` on the downloaded archive with no
pre-extraction verification. A malicious mirror could ship a tarball with
`../` components or absolute paths and write files anywhere on the user's
filesystem (CWE-22).
Add a pre-extraction check that lists archive contents with `tar -tzf`
and rejects any entry whose name starts with `/` or contains a `..` path
component. The check is POSIX-compliant and adds negligible overhead for
the single-binary RTK release tarball.
Covered by scripts/test-install.sh, which exercises one safe archive
and four crafted malicious archives (leading `..`, absolute path,
mid-path `..`, trailing `..`) plus a regression guard that ensures the
check remains in install.sh.
Co-Authored-By: Claude <noreply@anthropic.com>
Ousama Ben Younes