Can't download an OCI package twice if package contains symbolic links

[flavioschuindt]

What happened in your environment?

1. Created a package containing a symbolic link:

2. Pushed it to my OCI complaint registry: oras push <MY_REPO>:<MY_TAG> ./src/:<MY_MEDIA_TYPE> where MY_REPO and MY_MEDIA_TYPE are redacted.

3. Pulled it one time and worked fine: oras pull <MY_REPO>:<MY_TAG>

4. Without cleaning anything in the output folder, I tried the same command from (3) again, and then it failed:

Downloading 8b9900e74425 src
Error: failed to extract tar to <MY_OUTPUT_FOLDER>/src: symlink FILE1.md  <MY_OUTPUT_FOLDER>/src:FILE2.md: file exists

Correct me If I am wrong, but I believe what happens here is that internally oras is using tar to extract the compressed layers, but tar is refusing to overwrite a symbolic link.

What did you expect to happen?

The second attempt should be successful and overwrites the files in the target output folder.

How can we reproduce it?

Create an OCI package containing symbolic links and try the steps mentioned above.

What is the version of your ORAS CLI?

Version: 1.1.0+Homebrew
Go version: go1.21.0

What is your OS environment?

Mac OS Sonoma 14.4.1

Are you willing to submit PRs to fix it?

• Yes, I am willing to fix it.

[ArghyaChakraborty]

I faced the exact same issue. Hopefully someone has some idea about how to avoid this ...

[alishah404]

+1
getting the same error, we have node modules in the OCI dir and node modules its failing with same error

Error: failed to extract tar to /tmp/oras-test/pkg: symlink ../acorn/bin/acorn /tmp/oras-test/pkg/node_modules/.bin/acorn: file exists