test(mutate): add Extract round-trip test for filesystem object preservation#2283
Merged
Merged
Conversation
Subserial
approved these changes
Apr 30, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2283 +/- ##
=======================================
Coverage 56.85% 56.85%
=======================================
Files 166 166
Lines 11279 11279
=======================================
Hits 6413 6413
Misses 4100 4100
Partials 766 766 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
|
Thanks for the test! Looks like the tar opener function is deprecated. Once that is fixed, I'd be happy to merge this PR. |
…rvation Adds TestExtractRoundTrip which builds a single-layer image containing every common filesystem object type and verifies that mutate.Extract preserves all entries: - Regular files with various permission modes (0644, 0755, 0600) - Directories with different modes - Relative symlinks (e.g. node_modules/.bin/acorn -> ../acorn/bin/acorn) - Absolute symlinks (pointing within the image) - Directory symlinks - Hard links For each entry, the test verifies the type flag, link target, permission mode, and file contents survive the round trip. This would have caught google#2244, where a security fix (google#2227) inadvertently dropped all symlinks during extraction. Addresses google#2252 Signed-off-by: Dayna Blackwell <dayna@blackwell-systems.com>
df5157a to
0ccfcd3
Compare
Subserial
pushed a commit
to Subserial/go-containerregistry
that referenced
this pull request
May 15, 2026
…rvation (google#2283) Adds TestExtractRoundTrip which builds a single-layer image containing every common filesystem object type and verifies that mutate.Extract preserves all entries: - Regular files with various permission modes (0644, 0755, 0600) - Directories with different modes - Relative symlinks (e.g. node_modules/.bin/acorn -> ../acorn/bin/acorn) - Absolute symlinks (pointing within the image) - Directory symlinks - Hard links For each entry, the test verifies the type flag, link target, permission mode, and file contents survive the round trip. This would have caught google#2244, where a security fix (google#2227) inadvertently dropped all symlinks during extraction. Addresses google#2252
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
TestExtractRoundTrip, a comprehensive round-trip test formutate.Extractthat verifies all common filesystem object types survive extraction.The test programmatically builds a single-layer image containing:
node_modules/.bin/acorn -> ../acorn/bin/acorn/app/link-to-main -> /app/main.jsapp/modules -> node_modulesapp/main-hardlink.js -> app/main.jsFor each entry, the test verifies: type flag, link target, permission mode, and file contents.
Motivation
Addresses #2252. The regression in #2244 (where #2227 inadvertently dropped all symlinks during extraction) would have been caught by this test. The existing Extract tests cover whiteouts and overwritten files but don't verify that symlinks, hard links, and permission modes are preserved.
Testing
Full
pkg/v1/mutate/test suite passes.