Keep package targets explicit and reject existing archive symlinks

scripts/check-release.sh

@@ -29,4 +29,11 @@ if "$repo_root/scripts/release.sh" --output-dir "$check_root/bundle" > "$check_r
     exit 1
 fi
 grep -q 'Refusing to replace' "$check_root/repeat.log"
+ln -s "$check_root/untouched" "$check_root/linked.tar.gz"
+if "$repo_root/scripts/release.sh" --output-dir "$check_root/linked" > "$check_root/linked.log" 2>&1; then
+    printf 'Packaging unexpectedly followed an existing archive symlink.\n' >&2
+    exit 1
+fi
+grep -q 'Refusing to replace' "$check_root/linked.log"
+test ! -e "$check_root/untouched"
 printf 'Archive contents, checksum, extracted CLI and overwrite guard passed.\n'

scripts/release.sh

@@ -16,12 +16,12 @@ elif [[ $# != 0 ]]; then
 fi
 [[ $destination == /* ]] || { printf 'Output directory must be absolute.\n' >&2; exit 2; }
 for output in "$destination" "$destination.tar.gz" "$destination.tar.gz.sha256"; do
-    [[ ! -e $output ]] || { printf 'Refusing to replace %s\n' "$output" >&2; exit 1; }
+    [[ ! -e $output && ! -L $output ]] || { printf 'Refusing to replace %s\n' "$output" >&2; exit 1; }
 done
 
 target_dir=${CARGO_TARGET_DIR:-"$repo_root/target"}
 [[ $target_dir == /* ]] || target_dir="$repo_root/$target_dir"
-cargo build --locked --release --target "$target"
+cargo build --locked --release --target "$target" --target-dir "$target_dir"
 binary="$target_dir/$target/release/sized"
 mkdir -p "$destination"
 install -m 755 "$binary" "$destination/sized"