oci: Skip symlinks found in upstream artifacts

[stefanprodan]

Do not error out when upstream artifacts contain symlinks in the contents of the tar+gzip layer, instead skip all symlinks during decompression.

This allows Flux users to make use of OCI artifacts that may have symlinks in their contents which is the case when artifacts are created by other means than flux push artifact.

Ref: fluxcd/pkg#655
Fix: fluxcd/pkg#538
Fix: fluxcd/flux2#4209

[rashedkvm]

@stefanprodan thank you and appreciate you picking it up. With a great intention to contribute this fix, I got occupied with few other commitments. This change make sense and aligns with fluxcd/pkg#655 nicely. Thank you!

[stefanprodan]

@rashedkvm if you have time, could you please test this with a container image that was failing before?

[rashedkvm]

@rashedkvm if you have time, could you please test this with a container image that was failing before?

Yep, I will test it and share my finding.

[rashedkvm]

@rashedkvm if you have time, could you please test this with a container image that was failing before?

Yep, I will test it and share my finding.

Validated fix using image with sym-link. Validation passed. Thanks @stefanprodan

k get ocirepositories.source.toolkit.fluxcd.io -n no-auth
NAME                    URL                                   READY   STATUS                                                                                                 AGE
ocirepository-no-auth   oci://ghcr.io/carto-run/hello-world   True    stored artifact for digest 'sha256:15bbfc70e91bd7daf4047a8a1244ac2b8c32e47f6d1c6b5795c3d043f5becf7f'   12s

[fluxcdbot]

Successfully created backport PR for release/v1.1.x:

• [release/v1.1.x] oci: Skip symlinks found in upstream artifacts  #1255

[tmayweather]

I'm currently having this same issue on v2.12.

terraform-oci oci://ghcr.io/tmayweather/manifests/terraform False failed to extract layer contents from artifact: tar file entry bin/arch contained unsupported file type Lrwxrwxrwx 15m