[jadhavgaurav]

What

A tar hard link's Linkname is a path from the archive root, the same convention as the entry Name (GNU tar and bsdtar both write it that way, and tar tvf reports data/a/OWNERS link to data/b/OWNERS). extractTarDirectory resolved it against the directory of the link instead. A hard link whose target is in a different directory therefore looked for data/b/data/a/file and the whole unpack failed with no such file or directory.

The relative join came from the fix for GHSA-fxhp-mv3v-67qp. That fix was right to stop handing the raw relative path to os.Link, which resolves against the process CWD, but it reused the symlink base. For hard links the base is the extraction root.

Fixes #1499

Change

extractHardLink resolves Linkname with resolveRelToBase(dirPath, dirName, linkname), the same call used for entry names, and joins the result onto dirPath. Symlink handling is unchanged.

The containment checks are kept and one is added:

• resolveRelToBase rejects a target outside the root (.. components, a root-relative path that leaves dirName, an absolute path outside dirPath) and a target reached through a symlinked directory.
• checkSymlinkEscape runs on the resolved target, as it does for entry paths.
• The target must exist and must not itself be a symlink. Both checks above only look at the ancestors of the target, and link(2) may follow a symlink target on some platforms, so a pre-existing symlink in the extraction directory could otherwise be used to hard link a file from outside. A missing target now returns an error naming the Linkname.

An absolute Linkname inside dirPath is still accepted, as before.

Behavior note

A hard link Linkname written relative to the link's own directory (for example test.txt for a link in the same directory) was accepted before and is now read as an archive root path, so it is rejected unless it names a file at that root path. That form is not what tar tools produce, and it was the bug.

Tests

utils_test.go:

• cross-directory hard link using the archive root path (the reporter's case)
• same directory, nested directories in both directions, .. components that stay inside the root, absolute path inside the root
• missing target fails and creates no link
• rejected, with no link created: .. out of the root (also from a nested directory), ../outside.txt, absolute path outside the root, through a symlinked directory (relative and absolute symlink target), and a final component that is a symlink to a file outside the root (relative and absolute)

file_test.go: TestStore_Dir_Push_HardLinkAcrossDirectories pushes the layer from the issue through Store.Push and checks data/b/file is a hard link to data/a/file.

Reverting only the body of extractHardLink to the old resolution makes the four positive unit tests and the store test fail, with the error from the issue. Removing the symlink-target check makes the two symlink-target escape cases fail.

Checks

make test equivalent (go test ./... -race with coverage, plus the encoding check) passes. go build ./..., go vet ./... and gofmt -l are clean. extractHardLink is at 91.7% coverage. golangci-lint is not installed locally.

The issue says v2.6.2 is affected too. I can send a backport to v2 if you want one.

[codecov]

Codecov Report

❌ Patch coverage is 92.85714% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 91.57%. Comparing base (81fcfca) to head (2d61d93).

Files with missing lines	Patch %	Lines
content/file/utils.go	92.85%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1510      +/-   ##
==========================================
+ Coverage   91.50%   91.57%   +0.07%     
==========================================
  Files         102      102              
  Lines        8099     8108       +9     
==========================================
+ Hits         7411     7425      +14     
+ Misses        677      672       -5     
  Partials       11       11              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TerryHowe]

/lgtm

[TerryHowe]

Thanks!