[aviruthen]

Summary

When BedrockModelBuilder.deploy() imports an OSS model whose artifacts are a model.tar.gz, _extract_tar_gz_to_s3 uploads each archive member to a sibling extracted/ prefix. Destination keys were built by appending the raw tar member name. Archives created with tar -C <dir> . therefore produced keys like extracted/./config.json, which don't line up with the config.json / checkpoints/hf*/ lookups done right after extraction.

This change normalizes member names into clean relative keys before upload.

Changes

• sagemaker-serve/src/sagemaker/serve/bedrock_model_builder.py:
  • Add _tar_member_relative_key(), which strips leading ./ and empty segments (for example, ./checkpoints//hf/config.json becomes checkpoints/hf/config.json).
  • Members whose names can't be represented as a relative key under the extraction prefix (absolute paths, drive-letter paths, or .. segments) are skipped with a warning. This matches how custom_extractall_tarfile filters members elsewhere in the SDK.
  • Existing behavior is preserved: non-file members are skipped, the existing-prefix short-circuit still applies, and RuntimeError is still raised if nothing is extracted.

Testing

• Added TestTarMemberRelativeKey and TestExtractTarGzToS3 to sagemaker-serve/tests/unit/test_bedrock_model_builder.py. These use real in-memory .tar.gz archives with a mocked S3 client to check:
  • normalized keys for plain, nested, and ./-prefixed members
  • unsupported member paths are skipped
  • the empty-result error
  • the existing-prefix short-circuit
• tests/unit/test_bedrock_model_builder.py passes (123 tests).
• black and flake8 are clean on the changed files.

[github-actions]

🤖 AI code review

This PR fixes BedrockModelBuilder._extract_tar_gz_to_s3 so tar member names (e.g. from tar -C <dir> . producing ./config.json) are normalized into clean relative S3 keys, and rejects absolute/drive-letter/.. member paths. The new _tar_member_relative_key helper and its behavior are consistent with the SDK's existing tar-safety conventions (PR #6195), and the added unit tests cover normalization, rejection of unsafe paths, the empty-result error, and the existing-prefix short-circuit. The change looks correct and well-tested; I found no blocking issues.

_{Reviewed commit f854161. Automated review; verify before acting.}

[github-actions]

🤖 AI code review

This PR fixes a real bug in BedrockModelBuilder._extract_tar_gz_to_s3 where tar member names like ./config.json produced S3 keys (extracted/./config.json) that didn't match the post-extraction config.json/checkpoints/ lookups. The new _tar_member_relative_key helper normalizes member names and rejects absolute/../drive-letter paths, consistent with the SDK's existing tar-extraction hardening (PR #6195). The change is well-scoped and covered by thorough unit tests using real in-memory archives. No blocking issues found.

_{Reviewed commit 1ad6824. Automated review; verify before acting.}

[github-actions]

🤖 AI code review

This PR fixes _extract_tar_gz_to_s3 in bedrock_model_builder.py so tar member names are normalized into clean relative keys (stripping ./ and empty segments) before upload, fixing a mismatch where archives created with tar -C <dir> . produced keys like extracted/./config.json. It also rejects absolute/drive-letter/.. paths with a warning, consistent with existing tar-extraction safety work in the SDK (Source: #6195). The change is well-scoped, preserves existing behavior, and ships thorough unit tests covering normalization, directory skipping, unsupported-path skipping, the empty-result error, and the existing-prefix short-circuit. I found no issues worth blocking on.

_{Reviewed commit 06e042d. Automated review; verify before acting.}