xtask: Drain vendor tar stream to avoid zstd SIGPIPE

The tar crate stops reading when it reaches the end-of-archive marker,
before the zero padding that follows it. The pipe was then closed while
zstd was still writing that padding, so zstd was killed by SIGPIPE and
`cargo xtask package` failed. Read the rest of the stream before
returning.

Assisted-by: AI
Signed-off-by: John Eckersberg <dev@eckersberg.com>

Author: jeckersb

crates/xtask/src/xtask.rs

@@ -532,7 +532,8 @@ fn vendor_denied_crate(path: &Utf8Path) -> Option<&'static str> {
 /// [`VENDOR_DENYLIST`].
 fn vendor_denied_entries(archive: impl std::io::Read) -> Result<Vec<String>> {
     let mut denied = Vec::new();
-    for entry in tar::Archive::new(archive).entries()? {
+    let mut archive = tar::Archive::new(archive);
+    for entry in archive.entries()? {
         let entry = entry?;
         let path = entry.path()?;
         let path = path.to_string_lossy();
@@ -542,6 +543,9 @@ fn vendor_denied_entries(archive: impl std::io::Read) -> Result<Vec<String>> {
             denied.push(format!("{path} (from {name})"));
         }
     }
+    // Drain trailing padding after the end-of-archive marker so the
+    // writer (zstd) doesn't get SIGPIPE.
+    std::io::copy(&mut archive.into_inner(), &mut std::io::sink())?;
     Ok(denied)
 }