vendor: github.com/moby/go-archive v0.3.0

[thaJeztah]

full diff: moby/go-archive@v0.2.1...v0.3.0

v0.3.0

This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory.

The issue affected Unpack, UnpackLayer, Untar, UntarUncompressed, and the ApplyLayer helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions.

What's Changed

• archive: harden tar extraction against path traversal
• archive: do not follow reparse points in chtimes
• archive: fix creation time updates on Windows
• archive: minor cleanups and godoc touch-up
• archive: RebaseArchiveEntries: fix archive path rebasing

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

Update github.com/moby/go-archive to v0.3.0 to fix [CVE-2026-17106](https://www.cve.org/CVERecord?id=CVE-2026-17106) / [GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)

- A picture of a cute animal (not mandatory but encouraged)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[docker-agent]

Assessment: 🟢 APPROVE

This PR bumps github.com/moby/go-archive from a pre-release dev snapshot to the stable v0.3.0 release, which hardens tar extraction against the path traversal vulnerability CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h.

The changes are correct and well-structured:

• chtimes refactor (archive.go, diff.go, time_nonwindows.go, time_windows.go): All root.Chtimes(...) calls are replaced with a new chtimes(root, ...) wrapper. On non-Windows this delegates to root.Chtimes, preserving behavior. On Windows, the new implementation uses NtCreateFile with OBJ_DONT_REPARSE to open the file without following reparse points, preventing symlink/junction-based traversal attacks during timestamp updates.
• Windows reparse-point detection (time_windows.go): chtimesAt with noFollow=true now explicitly wraps STATUS_REPARSE_POINT_ENCOUNTERED as a breakoutError, correctly aborting extraction when an unexpected reparse point is encountered.
• RebaseArchiveEntries fix (copy.go): The naive strings.Replace(hdr.Name, oldBase, newBase, 1) — which would incorrectly rebase "foo/bar" when oldBase="foo" and "foobar" is present — is replaced with newNameRebaser, a proper prefix-aware rebaser that requires the matched prefix to be followed by / or be the full name.
• breakoutErr.Unwrap() (archive.go): Adds errors.Is/errors.As chain support. Since breakoutErr is unexported, this does not change the public API surface.
• Vendor bookkeeping (vendor.mod, vendor.sum, vendor/modules.txt): Version strings updated correctly.

No bugs introduced. The security hardening is complete and correct for the stated CVE scope.

[docker-agent]

Assessment: 🟢 APPROVE

This PR vendors github.com/moby/go-archive v0.3.0, which fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h (path traversal in tar extraction). The security hardening was reviewed and appears sound:

• Path traversal prevention: The new extraction logic correctly uses filepath.IsLocal() after cleaning and stripping leading slashes, preventing directory traversal via crafted archive entries.
• Hardlink validation: path.Clean(hdr.Linkname) + filepath.IsLocal(linkname) correctly rejects hardlinks pointing outside the extraction root.
• Windows reparse point guard: The new chtimes() wrapper correctly returns breakoutError if a reparse point is encountered during timestamp updates, preventing symlink-based TOCTOU attacks.
• RebaseArchiveEntries fix: The newNameRebaser now uses strings.CutPrefix instead of strings.Replace, correctly ensuring prefix-only substitution and fixing the path rebasing bug from v0.2.x.
• Error chain: breakoutErr now implements Unwrap() for correct error chain traversal with errors.Is.

No bugs were found in the introduced changes. The vendor update is a straightforward and correct security fix.