Can't download an OCI package twice if package contains symbolic links

[flavioschuindt]

What happened in your environment?

1. Created a package containing a symbolic link:

2. Pushed it to my OCI complaint registry: oras push <MY_REPO>:<MY_TAG> ./src/:<MY_MEDIA_TYPE> where MY_REPO and MY_MEDIA_TYPE are redacted.

3. Pulled it one time and worked fine: oras pull <MY_REPO>:<MY_TAG>

4. Without cleaning anything in the output folder, I tried the same command from (3) again, and then it failed:

Downloading 8b9900e74425 src
Error: failed to extract tar to <MY_OUTPUT_FOLDER>/src: symlink FILE1.md  <MY_OUTPUT_FOLDER>/src:FILE2.md: file exists

Correct me If I am wrong, but I believe what happens here is that internally oras is using tar to extract the compressed layers, but tar is refusing to overwrite a symbolic link.

What did you expect to happen?

The second attempt should be successful and overwrites the files in the target output folder.

How can we reproduce it?

Create an OCI package containing symbolic links and try the steps mentioned above.

What is the version of your ORAS CLI?

Version: 1.1.0+Homebrew
Go version: go1.21.0

What is your OS environment?

Mac OS Sonoma 14.4.1

Are you willing to submit PRs to fix it?

• Yes, I am willing to fix it.

[ArghyaChakraborty]

I faced the exact same issue. Hopefully someone has some idea about how to avoid this ...

[alishah404]

+1
getting the same error, we have node modules in the OCI dir and node modules its failing with same error

Error: failed to extract tar to /tmp/oras-test/pkg: symlink ../acorn/bin/acorn /tmp/oras-test/pkg/node_modules/.bin/acorn: file exists

[Wwwsylvia]

Hi @flavioschuindt @ArghyaChakraborty @alishah404 , thank you for reporting this bug! We have opened an issue on the oras-go library side and will fix it there: oras-project/oras-go#865

[flavioschuindt]

Thanks a lot, @Wwwsylvia. Help me understand one thing though: I see that in the oras-go the issue was labeled with the milestone v2.6.0. What is the usual release cadence, i.e., when should we expect v2.6.0 to be released? I am asking because we need to make an internal decision in our project, i.e., depending on the scheduled time we might need to implement an internal workaround, otherwise, we can wait and use the version with the fix which would be our preferred approach.

[Wwwsylvia]

@flavioschuindt Do you depend on oras-go or ORAS CLI? I suppose it's CLI?

For oras-go, we release new versions on-demand. Currently we don't have a clear target date for v2.6.0 yet. But the hope is to get the items in the milestone done and release the new version ASAP.
For CLI, the next milestone is v1.3.0-beta.2, which is supposed to be released by March. Once the bug is fixed on the oras-go side, CLI can uses the main branch without waiting for oras-go to release a tagged version.

[FeynmanZhou]

Maybe we could consider a patch release oras-go v2.5.1 to fix the symbolic link issue oras-project/oras-go#865 since it impacts a lot of users. Let's discuss the oras-go milestone in the community meeting this Tuesday 4pm pacific time.

@flavioschuindt @alishah404 @ArghyaChakraborty You are welcome to join the ORAS community meeting as well.

[FeynmanZhou]

@Wwwsylvia In addition to oras-project/oras-go#865, is there any addition work to fix the symbolic link issue in ORAS CLI?

[Wwwsylvia]

@FeynmanZhou No, once the fix is merged into oras-go, CLI just needs to upgrade the go dependency.

[flavioschuindt]

@flavioschuindt Do you depend on oras-go or ORAS CLI? I suppose it's CLI?

For oras-go, we release new versions on-demand. Currently we don't have a clear target date for v2.6.0 yet. But the hope is to get the items in the milestone done and release the new version ASAP.
For CLI, the next milestone is v1.3.0-beta.2, which is supposed to be released by March. Once the bug is fixed on the oras-go side, CLI can uses the main branch without waiting for oras-go to release a tagged version.

My dependency is the oras CLI.

Thanks @FeynmanZhou for the patch suggestion. This is impacting not me, but other users as well, so implementing and releasing a patch as soon as possible seems to be a reasonable approach. How can I join the community meeting? The link you shared I only see agenda notes, is there a video call link or something that I can join?

[FeynmanZhou]

Hi @flavioschuindt , you can find the meeting schedule on https://hackmd.io/P-O6n222TcSMoJgHmTTduw?view#Zoom-Call-Info. We meet on Zoom. Feel free to join the meeting and connect with the community maintainers.