postal.service.Deliver missing files while extracting dependency

[arjun024]

When using Deliver() to extract dependencies, some files are missing in the
extracted output. These files seem to have identical content but with different
names.

This issue is causing php-dist to form a malformed layer thereby failing tests
in downstream buildpack like php-composer (link) and php-web (link).

What happened

• Consider the php 8.0.12 dependency "https://deps.paketo.io/php/php_8.0.12_linux_x64_bionic_930d7a94.tgz"
• The dependency tgz a lib directory which has contents that includes the following:

ls -al php_8.0.12/lib | grep zip
-rw-r--r--  3 ubuntu ubuntu    80328 Oct 21 10:49 libzip.so
-rw-r--r--  3 ubuntu ubuntu    80328 Oct 21 10:49 libzip.so.4
-rw-r--r--  3 ubuntu ubuntu    80328 Oct 21 10:49 libzip.so.4.0.0

• When extracted by Deliver(), we would expect all these files to be exactly in place.
• However, after running Deliver(), the output is as follows

ls -al deliveroutput/lib | grep zip
-rw-r--r--  1 ubuntu ubuntu    80328 Nov 10 22:24 libzip.so

• Notice the 2 files missing.
• This also happens for other similar files (shared objects in this case). We have noticed that
  the file contained in the output (e.g. libizip.so) is the first file that appear in the tar archive. Other files with
  the same content are ignored (e.g. libizip.so.4).

How to reproduce

package main

import (
        "log"

        "github.com/paketo-buildpacks/packit/cargo"
        "github.com/paketo-buildpacks/packit/postal"
)

func main() {
        dep := postal.Dependency{
                URI:    "https://deps.paketo.io/php/php_8.0.12_linux_x64_bionic_930d7a94.tgz",
                SHA256: "930d7a9401adef080bd18d3d2a0838be3b8437560ff3e6d2917aeb30566580a9",
        }
        s := postal.NewService(cargo.NewTransport())
        err := s.Deliver(dep, "./cnbpath", "./deliveroutput", "./platpath")
        if err != nil {
                log.Fatal(err)
        }
}

• Run go mod init main && go mod tidy && go run main.go
• You'll see directory named deliveroutput created which you'll notice is missing
  files as explained above.

Build Configuration

 ‣ go version
go version go1.16.2 linux/amd64

 ‣ cat go.mod
module main

go 1.16

require github.com/paketo-buildpacks/packit v1.3.0

Notes

This was found as a result of paketo-buildpacks/php-dist#253
where we are no longer packaging up a tarball that has symlink references to external file
locations and instead using --dereference when archiving.

Checklist

• I have included log output.
• The log output includes an error message.
• I have included steps for reproduction.

cc @thitch97

[ryanmoran]

Looks like these are hardlinks and we aren't handling that case in the TarArchive.Decompress code:

packit/vacation/tar_archive.go

Lines 92 to 115 in 41a40d9

	switch hdr.Typeflag {
	case tar.TypeReg:
	file, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, hdr.FileInfo().Mode())
	if err != nil {
	return fmt.Errorf("failed to create archived file: %s", err)
	}
	_, err = io.Copy(file, tarReader)
	if err != nil {
	return err
	}
	err = file.Close()
	if err != nil {
	return err
	}
	case tar.TypeSymlink:
	// Collect all of the headers for symlinks so that they can be verified
	// after all other files are written
	symlinks = append(symlinks, symlink{
	name: hdr.Linkname,
	path: path,
	})