importer: Canonicalize symlink targets

[cgwalters]

This is a build-side fix for systemd shipping a non-canonical symlink;
see:
ostreedev/ostree-rs-ext#182

I'll copy/paste that commit message:

In https://github.com/ostreedev/ostree we generate a cryptographic
checksum over files and symlinks, and directories.

ostree does not currently perform any canonicalization on symlinks;
we'll respect and honor whatever bytes we're provided as input,
and replicate that on the target.

We're using the Rust tar crate to do tar serialization,
which has so far worked fine...except, I hit this corner case:

[root@cosa-devsh ~]# rpm -qf /usr/lib/systemd/systemd-sysv-install
chkconfig-1.13-2.el8.x86_64
[root@cosa-devsh ~]# ll /usr/lib/systemd/systemd-sysv-install
lrwxrwxrwx. 2 root root 24 Nov 29 18:08 /usr/lib/systemd/systemd-sysv-install -> ../../..//sbin/chkconfig
[root@cosa-devsh ~]#

But, using set_link_name to write the tarball, we end up with
the canonicalized path ../../../sbin/chkconfig - i.e. without the
double //. This breaks the checksum.

Now, I am a bit tempted to change ostree to do canonicalization. But
even if we did, I'd need to exactly match what tar-rs is doing.

(I may of course also try to change the rhel8 systemd package, but
that's going to take a while to propagate and this corner case isn't
the only one I'm sure)

I verified that this fixes rpm-ostree ex-container encapsulate
for RHCOS.

In fact, it is just that one systemd symlink which is non-canonical.

[lucab]

Now, I am a bit tempted to change ostree to do canonicalization. But
even if we did, I'd need to exactly match what tar-rs is doing.

Generally speaking, I'd prefer sticking to a default where we treat symlink contents as opaque blobs.
Instead of re-canonicalizing everything, how would you feel about overriding only specific things based on an allowlist (similar to botched scriptlets and such)?

[jmarrero]

change makes sense to me.

[cgwalters]

I thought about that. The tradeoff is basically: "potential blast radius" versus "things fixed".

For example, I only analyzed symlinks in FCOS/RHCOS. OK well I just checked FSB35, and it's still only chkconfig.

Incidentally, I could find no occurrences of the pattern ././ in anything.

OTOH, I'm not checking "all RPMs in fedora" e.g. either right now.

Hmm OK actually though, I think the clearest and best fix is on the ostree side in ostreedev/ostree-rs-ext#182 - it just requires a new tar-rs release...or...I guess we could use a temporary fork.

So, OK maybe it is better to constrain this for now.

[cgwalters]

OK, I kept the general internal function, but we only use it if the target ends in //sbin/chkconfig.

[cgwalters]

Side note, one downside of this patch is that because we only perform imported package cache by name, you'll need to clear out the pkgcache in order for this to work. For example with coreos-assembler, sudo rm cache/* -rf.

[lucab]

What I had in mind was a filter matching on the exact source path (i.e. not the target content), but it should be an irrelevant difference. This works for me too.

[lucab]

I agree the longer term fix is ostreedev/ostree-rs-ext#182 when all the pre-requirements are in place. Until then, this workaround LGTM.

[cgwalters]

Rebased to pick up CI fixes