Description

Since v0.21.3, crane flatten silently drops all symlinks that have absolute targets (e.g., /lib64 → /usr/lib64). This makes the resulting flattened image unusable for most Linux-based container images.

Root Cause

PR #2227 ("mutate: reject path traversal and symlink escape in Extract") introduced logic that skips symlink/hardlink entries with absolute Linkname:

if header.Typeflag == tar.TypeSymlink || header.Typeflag == tar.TypeLink {
    linkTarget := filepath.Clean(header.Linkname)
    if strings.HasPrefix(linkTarget, "..") || filepath.IsAbs(linkTarget) {
        continue  // entry is silently dropped
    }
}

While rejecting path traversal (..) makes sense, rejecting absolute symlink targets is too aggressive. Absolute symlinks like /lib64 → /usr/lib64 are standard in virtually all Linux container images (Debian, Ubuntu, Bitnami, etc.).

Steps to Reproduce

# Using crane v0.21.3
crane flatten <any-debian-based-image>:tag -t <registry>/test:flattened

# Check the result
docker run --rm --platform linux/amd64 <registry>/test:flattened ls /lib64/ld-linux-x86-64.so.2
# Output: qemu-x86_64: Could not open '/lib64/ld-linux-x86-64.so.2': No such file or directory

Expected Behavior

Symlinks with absolute targets should be preserved during flatten, as they were in v0.21.1 and earlier.

Actual Behavior

All symlinks with absolute targets are silently dropped from the flattened output, breaking the dynamic linker and rendering the image non-functional.

Environment

• crane version: v0.21.3
• Works correctly on: v0.21.1
• Tested with: Bitnami Airflow (debian-12 based) multi-arch image (amd64 + arm64)

Suggested Fix

For symlink targets, normalize absolute paths instead of skipping them — similar to how header.Name absolute paths are already handled (stripped of leading /):

if header.Typeflag == tar.TypeSymlink || header.Typeflag == tar.TypeLink {
    linkTarget := filepath.Clean(header.Linkname)
    if strings.HasPrefix(linkTarget, "..") {
        continue  // only reject path traversal
    }
    // Absolute symlink targets are valid and should be preserved
}