Re: [meta-virtualization][wrynose][PATCH 3/5] docker-moby: Fix CVE-2026-17106

[Bruce Ashfield <bruce.ashfield@gmail.com>]

I'm holding off on this one. The partial go-archive backport stops the
escape, but it also fails on valid archives:

 - a file written through an absolute symlink (var/run -> /run, then
   var/run/foo) fails with "path escapes from parent"
 - a directory entry with no entry for its parent (opt/x/ without opt/)
   fails with "mkdirat opt/x: no such file or directory"

Both work with go-archive v0.3.3. The series skips v0.3.1 and v0.3.2,
which looks to be where that handling went in.

Could you respin this as a vendor of go-archive v0.3.3 as a whole,
rather than selected hunks ? In a quick test, replacing the vendored
directory and updating go.mod and modules.txt built at our SRCREV and
those cases worked. It would also need go.sum and the
daemon/archive_unix.go change from 2a3ab8fcc0.

Bruce