From e72e6a0b3b8c19c80447d179612a1b78365e46ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Cluseau?= <mikael.cluseau@gmail.com>
Date: Tue, 2 Jun 2026 06:36:45 +0200
Subject: [PATCH] seed: more atomic

---
 Cargo.lock                |  4 ++--
 src/cmd/init/bootstrap.rs | 13 ++++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 32598c1..d10964d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1379,9 +1379,9 @@ dependencies = [
 
 [[package]]
 name = "rpassword"
-version = "7.5.3"
+version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "835a57a69104632d64deb0df2e09a69945cd7a6eab4070fc9b1d7e50cf6c3edc"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
  "libc",
  "rtoolbox",
diff --git a/src/cmd/init/bootstrap.rs b/src/cmd/init/bootstrap.rs
index 125c7e8..ff5dba1 100644
--- a/src/cmd/init/bootstrap.rs
+++ b/src/cmd/init/bootstrap.rs
@@ -159,7 +159,7 @@ async fn seed_config(
     let cfg_path = &format!("{base_dir}/config.yaml");
 
     if fs::try_exists(cfg_path).await? {
-        return Ok(fs::read(cfg_path).await?);
+        return verifier.verify_path(&cfg_path).await;
     }
 
     let bs_tar = "/bootstrap.tar";
@@ -172,13 +172,20 @@ async fn seed_config(
         fetch_bootstrap(bs, bs_tar).await?;
     }
 
-    try_exec("tar", &["xf", bs_tar, "-C", base_dir]).await?;
+    let tmp_dir = &format!("{base_dir}.new");
+    fs::create_dir_all(tmp_dir).await?;
 
+    try_exec("tar", &["xf", bs_tar, "-C", tmp_dir]).await?;
+
+    let cfg_path = &format!("{tmp_dir}/config.yaml");
     if !fs::try_exists(cfg_path).await? {
         return Err(format_err!("{cfg_path} does not exist after seeding"));
     }
 
-    verifier.verify_path(&cfg_path).await
+    let cfg_bytes = verifier.verify_path(&cfg_path).await?;
+
+    fs::rename(tmp_dir, base_dir).await?;
+    Ok(cfg_bytes)
 }
 
 async fn fetch_bootstrap(bs: &dkl::bootstrap::Bootstrap, output_file: &str) -> Result<()> {