Function install_bytes 

fn install_bytes(
    data: &[u8],
    dst: &Path,
    mode: u32,
    within: Option<&Path>,
) -> Result<()>

Writes a fresh temporary file beside the target and renames it over the target. The temporary is created with create_new, so it never opens an existing file or follows a symlink, under a name unique to this process and call, so two installs do not share it; it starts at 0600 whatever the umask and gets its mode before the rename, so there is no moment at which another user can write what root will install. A failed write removes the temporary and leaves the old file whole.

With within (DESTDIR), the directory the file lands in must resolve to somewhere under it. The settable directories cannot climb out by their spelling, but a symlink already in the staging tree can point anywhere, and the rename would follow it: pkg/usr/share/scx -> /usr/share/scx would install the catalog on the build host. The check runs before any directory is created (see ensure_dir) and again on the directory the file lands in. A symlink that stays inside the staging tree is the package build’s own and is followed. The target itself may be a symlink; the rename replaces the link rather than following it.