In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but withing the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but withing the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but withing the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but withing the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607

In a build stage, a valid relative symlink can be created that points to a
location in the rootfs that is above the location of the symlink. E.g.:

  /usr/mydir/mysubdir/true -> ../../../bin/true

This symlink is valid in the rootfs. It resolves to `/bin/true`.

If we attempt to copy `/usr/mydir` into a new build stage, then prior to
this PR the symlink would cause the copy to fail.

We have been using `CopyFromTar` to copy from src `<stage1>/usr/mydir`,
to `<stage2>/usr/mydir`. The `CopyFromTar` routines enforce that the
target of a hard link or symlink must be under dst, or a fatal error is
raised to avoid a breakout attack.

When copying between stages our boundary is not dst, but the top level
of the destination stage's rootfs. We must allow links to be created
that are above dst, but within the stage rootfs.

To resolve the issue, bring over enough code from
`docker/docker/pkg/archive` that we can implement a
`CopyFromTarWithRoot`, that performs the same as `CopyFromTar`, except
that we can specify a destination root directory. Any hard links and
symlink targets under this destination root directory are valid.

Fixes sylabs#2607