Canonicalize archived absolute symlink targets

Author: mazdak

Sources/Services/ContainerAPIService/Client/Archiver.swift

@@ -353,7 +353,9 @@ public final class Archiver: Sendable {
             return symlinkTarget
         }
 
-        let targetPath = URL(fileURLWithPath: symlinkTarget).standardizedFileURL
+        let targetPath = URL(fileURLWithPath: symlinkTarget)
+            .standardizedFileURL
+            .resolvingSymlinksInPath()
         guard let targetArchivePaths = archivedPathsByHostPath[targetPath], targetArchivePaths.count == 1, let targetArchivePath = targetArchivePaths.first else {
             return symlinkTarget
         }

Tests/ContainerAPIClientTests/ArchiverTests.swift

@@ -139,6 +139,55 @@ struct ArchiverTests {
         #expect(try String(contentsOf: extractedLinkURL, encoding: .utf8) == "hello")
     }
 
+    @Test
+    func testCompressAndUncompressRewritesArchivedAbsoluteSymbolicLinkTargetThroughSymlinkedAncestor() throws {
+        let fileManager = FileManager.default
+        let tempURL = try fileManager.url(
+            for: .itemReplacementDirectory,
+            in: .userDomainMask,
+            appropriateFor: .temporaryDirectory,
+            create: true
+        )
+        defer { try? fileManager.removeItem(at: tempURL) }
+
+        let sourceURL = tempURL.appendingPathComponent("source")
+        let archiveURL = tempURL.appendingPathComponent("archive.tar.gz")
+        let destinationURL = tempURL.appendingPathComponent("destination")
+        try fileManager.createDirectory(at: sourceURL, withIntermediateDirectories: true)
+
+        let realDirectoryURL = sourceURL.appendingPathComponent("real")
+        try fileManager.createDirectory(at: realDirectoryURL, withIntermediateDirectories: true)
+        let targetURL = realDirectoryURL.appendingPathComponent("target.txt")
+        try #require("hello".data(using: .utf8)).write(to: targetURL)
+
+        let aliasURL = sourceURL.appendingPathComponent("alias")
+        try fileManager.createSymbolicLink(atPath: aliasURL.path, withDestinationPath: "real")
+
+        let linkURL = sourceURL.appendingPathComponent("link.txt")
+        try fileManager.createSymbolicLink(
+            atPath: linkURL.path,
+            withDestinationPath: sourceURL.appendingPathComponent("alias/target.txt").path
+        )
+
+        _ = try Archiver.compress(source: sourceURL, destination: archiveURL) { url in
+            let sourcePath = sourceURL.standardizedFileURL.path
+            let path = url.standardizedFileURL.path
+            let relativePath = String(path.dropFirst(sourcePath.count + 1))
+            return Archiver.ArchiveEntryInfo(
+                pathOnHost: url,
+                pathInArchive: URL(fileURLWithPath: relativePath)
+            )
+        }
+
+        try Archiver.uncompress(source: archiveURL, destination: destinationURL)
+
+        let extractedLinkURL = destinationURL.appendingPathComponent("link.txt")
+        let values = try extractedLinkURL.resourceValues(forKeys: [.isSymbolicLinkKey])
+        #expect(values.isSymbolicLink == true)
+        #expect(try fileManager.destinationOfSymbolicLink(atPath: extractedLinkURL.path) == "real/target.txt")
+        #expect(try String(contentsOf: extractedLinkURL, encoding: .utf8) == "hello")
+    }
+
     @Test
     func testCompressDigestChangesWhenSymlinkTargetChanges() throws {
         let fileManager = FileManager.default