Latest release of vbatts/tar-split pulls archive/tar into an internal unimportable module

[wspurgin]

https://github.com/vbatts/tar-split/releases/tag/v0.12.0

Ran into this issue installing some other package (buf) that relies on this project just a few moments ago during a routine dependency (direct / indirect) bump.

estargz uses this (now internal) package here:

stargz-snapshotter/estargz/estargz.go

Line 43 in 1281fc2

"github.com/vbatts/tar-split/archive/tar"

stargz-snapshotter/estargz/estargz.go

Lines 872 to 895 in 1281fc2

	var tw *tar.Writer
	if !lossless {
	tw = tar.NewWriter(dst) // use tar writer only when this isn't lossless mode.
	}
	tr := tar.NewReader(src)
	if lossless {
	tr.RawAccounting = true
	}
	prevOffset := w.cw.n
	var prevOffsetUncompressed int64
	for {
	h, err := tr.Next()
	if err == io.EOF {
	if lossless {
	if remain := tr.RawBytes(); len(remain) > 0 {
	// Collect the remaining null bytes.
	// https://github.com/vbatts/tar-split/blob/80a436fd6164c557b131f7c59ed69bd81af69761/concept/main.go#L49-L53
	if _, err := dst.Write(remain); err != nil {
	return err
	}
	}
	}
	break
	}

I'm hopeful, that the upstream archive/tar is a drop in replacement if the use case can be covered by some of the discussion around TeeWriter or other workarounds for low-level byte access.

[ktock]

Cloud you elaborate this issue a bit? Did you get error or warning messages during compilation?

[wspurgin]

Error: ../go/pkg/mod/github.com/containerd/stargz-snapshotter/estargz@v0.16.3/estargz.go:43:2: no required module provides package github.com/vbatts/tar-split/archive/tar; to add it:
	go get github.com/vbatts/tar-split/archive/tar

@ktock during go install of a separate package that pulls stargz-snapshotter as a dependency. This project has vbatts/tar-split as its own dependency. Therefore vbatts/tar-split is an "indirect" dependency

During a routine dependency update go get -u, the indirect dependency (vbatts/tar-split) got updated in my project to v0.12.

That version moved a forked version of the standard lib archive/tar this project uses to internal - which caused that error above.

[ktock]

Could you try tar-split v0.12.1 which reverted that change? https://github.com/vbatts/tar-split/releases/tag/v0.12.1

[wspurgin]

@ktock I saw it got reverted, I raised this issue more so to be aligned to what was raised in that repo:
vbatts/tar-split#81 (comment)

Namely, this repo shouldn't rely on that forked version if there are ways (the discussions I linked in my original post) to leverage the standard archive/tar. That way you aren't open to CVEs that take longer to patch (and eventually won't be patched whenever a breaking release is published).

[wspurgin]

I think it looks feasible for this repo (at least) to move off of the forked tar-archive based on what that issue's author has seen (perhaps by using the TeeReader approach outlined here).