vendor: github.com/moby/go-archive v0.3.2

[thaJeztah]

full diff: moby/go-archive@v0.3.1...v0.3.2

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[docker-agent]

Assessment: 🟢 APPROVE

The bump from v0.3.1 to v0.3.2 introduces a resolveArchivePath compatibility workaround and associated helpers (resolveHardlinkTarget, resolveFSRootPath, walkLink) to handle intermediate symlinks during tar extraction with os.Root confinement. The logic is sound: the final write always goes through os.Root, which hard-bounds all operations within the extraction root regardless of path computation.

Dismissed security findings (review manually)

• vendor/github.com/moby/go-archive/archive.go:481 — resolveFSRootPath uses raw os.Lstat/os.Readlink (not openat-chain–protected) for path computation in the symlink-fallback path (verifier mitigation: the final os.Root write re-confines the result; filepath.Rel + filepath.IsLocal checks catch escapes before the write; worst-case is writing to a different path within root, not an escape — same accepted TOCTOU limitation documented in the code comments).