package builds could use directory traversal to write outside of target area

A flaw in the build package allowed untrusted builds to write files outside their intended directory during extraction, potentially compromising the entire system. This happened because the package didn't validate directory names properly.

The build package prior to version 20171128 failed to sanitize directory names during extraction of build artifacts, enabling a directory traversal attack (CWE-22). An untrusted build could exploit this to write files outside the buildroot, escaping containment and potentially achieving arbitrary file write on the host system.