Don't expose local account details in oci-archive tar files

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

oci/archive/oci_dest.go

@@ -13,6 +13,7 @@ import (
 	"github.com/containers/image/v5/internal/signature"
 	"github.com/containers/image/v5/types"
 	"github.com/containers/storage/pkg/archive"
+	"github.com/containers/storage/pkg/idtools"
 	digest "github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
 )
@@ -169,7 +170,11 @@ func (d *ociArchiveImageDestination) Commit(ctx context.Context, unparsedTopleve
 // tar converts the directory at src and saves it to dst
 func tarDirectory(src, dst string) error {
 	// input is a stream of bytes from the archive of the directory at path
-	input, err := archive.Tar(src, archive.Uncompressed)
+	input, err := archive.TarWithOptions(src, &archive.TarOptions{
+		Compression: archive.Uncompressed,
+		// Don’t include the data about the user account this code is running under.
+		ChownOpts: &idtools.IDPair{UID: 0, GID: 0},
+	})
 	if err != nil {
 		return fmt.Errorf("retrieving stream of bytes from %q: %w", src, err)
 	}

oci/archive/oci_dest_test.go

@@ -1,5 +1,45 @@
 package archive
 
-import "github.com/containers/image/v5/internal/private"
+import (
+	"archive/tar"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/containers/image/v5/internal/private"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
 
 var _ private.ImageDestination = (*ociArchiveImageDestination)(nil)
+
+func TestTarDirectory(t *testing.T) {
+	srcDir := t.TempDir()
+	err := os.WriteFile(filepath.Join(srcDir, "regular"), []byte("contents"), 0o600)
+	require.NoError(t, err)
+
+	dest := filepath.Join(t.TempDir(), "file.tar")
+	err = tarDirectory(srcDir, dest)
+	require.NoError(t, err)
+
+	f, err := os.Open(dest)
+	require.NoError(t, err)
+	defer f.Close()
+	reader := tar.NewReader(f)
+	numItems := 0
+	for {
+		hdr, err := reader.Next()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		// Test that the header does not expose data about the local account
+		assert.Equal(t, 0, hdr.Uid)
+		assert.Equal(t, 0, hdr.Gid)
+		assert.Equal(t, "", hdr.Uname)
+		assert.Equal(t, "", hdr.Gname)
+		numItems++
+	}
+	assert.Equal(t, 1, numItems)
+}