Assessment: 🟡 NEEDS ATTENTION

This vendor update of github.com/moby/go-archive introduces significant security hardening — os.Root-based filesystem operations with openat(2) semantics, filepath.IsLocal path validation, and improved AUFS whiteout handling. The overall direction is a clear improvement.

Two security findings in the new code warrant attention before merging:

1. TOCTOU in opaque-whiteout walk (diff.go:151): os.RemoveAll(p) uses an absolute path outside the os.Root containment boundary, unlike every other removal in the same function.
2. Empty tar entry name (diff.go:62): A tar entry with an empty name normalizes to "." (the extraction root), passes filepath.IsLocal, and can overwrite root directory metadata.

Assessment: 🟢 APPROVE

This vendor update introduces -based containment for tar extraction (using semantics), replaces manual path-traversal checks with , hardens device-number overflow detection, and updates the implementation to use a parent-directory file descriptor. The security model is sound and the hardening changes are a clear improvement over the previous string-prefix checks.

Assessment: 🟢 APPROVE

This PR vendors github.com/moby/go-archive from v0.2.0 to a pre-release dev version (v0.2.1-0.20260716170833 via a replace directive pointing to ctalledo's fork). The core changes are security hardening of the tar extraction path: Unpack and createTarFile now use Go's os.Root API (openat-backed bounded filesystem operations) instead of raw os.* calls with manual prefix checks, and path traversal validation is strengthened with filepath.IsLocal after path.Clean.

The hardening changes are well-structured. The os.Root API provides the primary containment guarantee for all path operations. All drafter findings were low-severity and, on deeper analysis, confirmed to be either correct behavior or no-bug outcomes. No high or medium severity issues were identified.

Note: vendor.mod contains a // FIXME comment indicating this uses a personal fork (ctalledo/go-archive) for testing moby/go-archive#45. This is explicitly called out in the PR description and is expected for a dev-version vendor bump.

Assessment: 🔴 CRITICAL

This PR vendors an updated github.com/moby/go-archive (v0.3.0-dev) with security hardening, but the vendor.mod includes a replace directive that substitutes the canonical module with a personal testing fork (ctalledo/go-archive). This was intentionally marked FIXME and must be removed before merging.

Lower-confidence findings (not posted inline)

None

Assessment: 🟢 APPROVE

This PR vendors github.com/moby/go-archive at a dev pre-release (v0.3.0-dev / main) and applies a security-hardening layer from ctalledo/go-archive. The changes are well-structured and represent a clear improvement over the previous extraction logic.

Hardening changes reviewed:

• Unpack/UnpackLayer now use os.Root (openat(2)-based) for all extraction operations, preventing symlink-escape attacks at the OS level.
• Path validation replaces the old filepath.Clean + filepath.Rel breakout check with filepath.IsLocal + path.Clean, which is more robust.
• chmodNoSymlink uses fchmodat(2) with AT_SYMLINK_NOFOLLOW (with documented fallback for older kernels that matches or improves on previous os.Chmod behavior).
• lchtimes is now fd-based (unix.UtimesNanoAt via parent directory FD), correctly scoped within the extraction root.
• fsRootPath/walkLinks provide correct symlink bounding for operations os.Root cannot handle (mknod, xattrs) — absolute symlink targets are correctly re-bounded to root on the subsequent iteration.
• The unpackedPaths key change (absolute → POSIX-relative) is consistent: path.Clean removes trailing slashes before storage, and the opaque-whiteout lookup uses matching normalization.
• Error-handling cleanups (_ = writer.Close(), combined defers) are all correct.

No bugs were found in the introduced + lines.