vendor: github.com/moby/go-archive v0.3.0

[thaJeztah]

• relates to archive: harden tar extraction against path traversal go-archive#45
• relates to (not yet included); archive: cache parent directory fd during tar extraction go-archive#49

vendor: github.com/moby/go-archive v0.3.0

full diff: moby/go-archive@v0.2.1...v0.3.0

v0.3.0

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted
tar archive could use links to cause extraction operations to create or
overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the
ApplyLayer helpers. Users should upgrade and avoid extracting untrusted
archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal
• archive: do not follow reparse points in chtimes
• archive: fix creation time updates on Windows
• archive: minor cleanups and godoc touch-up
• archive: RebaseArchiveEntries: fix archive path rebasing

Update  github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h

[crazy-max]

Looking at the BuildKit call path, go-archive is used for Dockerfile/LLB archive unpack in

buildkit/solver/llbsolver/file/unpack.go

Lines 16 to 52 in df07618

	func unpack(srcRoot string, src string, destRoot string, dest string, ch copy.Chowner, u *copy.User, tm *time.Time, idmap *user.IdentityMapping) (bool, error) {
	src, err := fs.RootPath(srcRoot, src)
	if err != nil {
	return false, err
	}
	if !isArchivePath(src) {
	return false, nil
	}
	dest, err = fs.RootPath(destRoot, dest)
	if err != nil {
	return false, err
	}
	if _, err := copy.MkdirAll(dest, 0755, ch, tm); err != nil {
	return false, err
	}
	file, err := os.Open(src)
	if err != nil {
	return false, err
	}
	defer file.Close()
	opts := &archive.TarOptions{
	BestEffortXattrs: true,
	}
	if idmap != nil {
	opts.IDMap = *idmap
	}
	if u != nil {
	opts.ChownOpts = &archive.ChownOpts{
	UID: u.UID,
	GID: u.GID,
	}
	}
	return true, chrootarchive.Untar(file, dest, opts)
	}

BuildKit first uses fs.RootPath to map the source and destination into the mounted snapshot, then calls chrootarchive.Untar.

The duplicate containment concern is later on Linux: chrootarchive.Untar switches root before calling archive.Unpack, and go-archive v0.3.0 then wraps extraction in os.Root too. So Linux BuildKit ADD unpack pays the repeated os.Root path-walk cost even though extraction is already running inside the chrooted root. 🙈

I would not remove fs.RootPath here though, that is still needed to resolve the Dockerfile/LLB path into the snapshot mount iiuc. I also would not add a broad BuildKit opt-out, because Windows and non-chroot callers still need the hardening. I think the fix should be in go-archive, either the dirCache mitigation from moby/go-archive#49 or a chroot-aware fast path. 🤔

[crazy-max]

The duplicate containment concern is later on Linux: chrootarchive.Untar switches root before calling archive.Unpack

Hum maybe we could call archive.Untar directly. It would remove the double containment but not the expensive repeated os.Root path-walk per extracted entry. The chroot was already there before v0.3.0, so this is mostly os.Root, not the one-time chroot setup.

[crazy-max]

Bench results: https://moby.github.io/buildkit-bench/#/result/20260730-204319

With moby/go-archive#49