diff --git a/compos/src/artifact_signer.rs b/compos/src/artifact_signer.rs
index ce32d6b..a4b47d6 100644
--- a/compos/src/artifact_signer.rs
+++ b/compos/src/artifact_signer.rs
@@ -70,13 +70,15 @@
 
         let signature = signer.sign(&bytes)?;
 
-        let mut file = File::create(info_path)?;
+        let mut file =
+            File::create(info_path).with_context(|| format!("Creating {}", info_path.display()))?;
         file.write_all(&bytes)?;
 
         let mut signature_name = info_path.file_name().unwrap().to_owned();
         signature_name.push(SIGNATURE_EXTENSION);
         let signature_path = info_path.with_file_name(&signature_name);
-        let mut signature_file = File::create(&signature_path)?;
+        let mut signature_file = File::create(&signature_path)
+            .with_context(|| format!("Creating {}", signature_path.display()))?;
         signature_file.write_all(&signature)?;
 
         Ok(())
diff --git a/compos/src/compilation.rs b/compos/src/compilation.rs
index cf6f30a..7eaae5d 100644
--- a/compos/src/compilation.rs
+++ b/compos/src/compilation.rs
@@ -20,7 +20,7 @@
 use std::env;
 use std::fs::{read_dir, File};
 use std::os::unix::io::{AsRawFd, RawFd};
-use std::path::{Path, PathBuf};
+use std::path::{self, Path, PathBuf};
 
 use crate::artifact_signer::ArtifactSigner;
 use crate::compos_key_service::Signer;
@@ -83,6 +83,11 @@
         if zygote_arch != "zygote64" && zygote_arch != "zygote64_32" {
             bail!("Invalid zygote arch");
         }
+        // Disallow any sort of path traversal
+        if target_dir_name.contains(path::MAIN_SEPARATOR) {
+            bail!("Invalid target directory {}", target_dir_name);
+        }
+
         Ok(Self { system_dir_fd, output_dir_fd, staging_dir_fd, target_dir_name, zygote_arch })
     }
 }