Resolve filepaths before scanning for changes

integration/dockerfiles/Dockerfile_test_issue_1039

@@ -0,0 +1,10 @@
+FROM registry.access.redhat.com/ubi7/ubi:7.7-214
+
+# Install GCC, GCC-C++ and make libraries for build environment
+# Then clean caches
+RUN yum --disableplugin=subscription-manager update -y \
+    && yum --disableplugin=subscription-manager install -y \
+        gcc-4.8.5-39.el7 \
+        gcc-c++-4.8.5-39.el7 \
+        make-3.82-24.el7 \
+    && yum --disableplugin=subscription-manager clean all

pkg/filesystem/resolve.go

@@ -0,0 +1,164 @@
+/*
+Copyright 2020 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package filesystem
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/GoogleContainerTools/kaniko/pkg/util"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+// ResolvePaths takes a slice of file paths and a slice of whitelist entries. It resolve each
+// file path according to a set of rules and then returns a slice of resolved paths or error.
+// File paths are resolved according to the following rules:
+// * If path is whitelisted, skip it.
+// * If path is a symlink, resolve it's ancestor link and add it to the output set.
+// * If path is a symlink, resolve it's target. If the target is not whitelisted add it to the
+// output set.
+// * Add all ancestors of each path to the output set.
+func ResolvePaths(paths []string, wl []util.WhitelistEntry) (pathsToAdd []string, err error) {
+	logrus.Info("Resolving paths")
+
+	fileSet := make(map[string]bool)
+
+	for _, f := range paths {
+		// If the given path is part of the whitelist ignore it
+		if util.IsInProvidedWhitelist(f, wl) {
+			logrus.Debugf("path %s is whitelisted, ignoring it", f)
+			continue
+		}
+
+		link, e := resolveSymlinkAncestor(f)
+		if e != nil {
+			err = e
+			return
+		}
+
+		if f != link {
+			logrus.Tracef("updated link %s to %s", f, link)
+		}
+
+		if !fileSet[link] {
+			pathsToAdd = append(pathsToAdd, link)
+		}
+		fileSet[link] = true
+
+		var evaled string
+
+		// If the path is a symlink we need to also consider the target of that
+		// link
+		evaled, err = filepath.EvalSymlinks(f)
+		if err != nil {
+			if !os.IsNotExist(err) {
+				logrus.Errorf("couldn't eval %s with link %s", f, link)
+				return
+			}
+
+			logrus.Debugf("symlink path %s, target does not exist", f)
+		}
+
+		// If the given path is a symlink and the target is part of the whitelist
+		// ignore the target
+		if util.IsInProvidedWhitelist(evaled, wl) {
+			logrus.Debugf("path %s is whitelisted, ignoring it", evaled)
+			continue
+		}
+
+		if !fileSet[evaled] {
+			pathsToAdd = append(pathsToAdd, evaled)
+		}
+		fileSet[evaled] = true
+	}
+
+	// Also add parent directories to keep the permission of them correctly.
+	pathsToAdd = filesWithParentDirs(pathsToAdd)
+
+	return
+}
+
+// filesWithParentDirs returns every ancestor path for each provided file path.
+// I.E. /foo/bar/baz/boom.txt => [/, /foo, /foo/bar, /foo/bar/baz, /foo/bar/baz/boom.txt]
+func filesWithParentDirs(files []string) []string {
+	filesSet := map[string]bool{}
+
+	for _, file := range files {
+		file = filepath.Clean(file)
+		filesSet[file] = true
+
+		for _, dir := range util.ParentDirectories(file) {
+			dir = filepath.Clean(dir)
+			filesSet[dir] = true
+		}
+	}
+
+	newFiles := []string{}
+	for file := range filesSet {
+		newFiles = append(newFiles, file)
+	}
+
+	return newFiles
+}
+
+// resolveSymlinkAncestor returns the ancestor link of the provided symlink path or returns the
+// the path if it is not a link. The ancestor link is the filenode whose type is a Symlink.
+// E.G /baz/boom/bar.txt links to /usr/bin/bar.txt but /baz/boom/bar.txt itself is not a link.
+// Instead /bar/boom is actually a link to /usr/bin. In this case resolveSymlinkAncestor would
+// return /bar/boom.
+func resolveSymlinkAncestor(path string) (string, error) {
+	if !filepath.IsAbs(path) {
+		return "", errors.New("dest path must be abs")
+	}
+
+	last := ""
+	newPath := path
+
+loop:
+	for newPath != "/" {
+		fi, err := os.Lstat(newPath)
+		if err != nil {
+			return "", errors.Wrap(err, "failed to lstat")
+		}
+
+		if util.IsSymlink(fi) {
+			last = filepath.Base(newPath)
+			newPath = filepath.Dir(newPath)
+		} else {
+			// Even if the filenode pointed to by newPath is a regular file,
+			// one of its ancestors could be a symlink. We call filepath.EvalSymlinks
+			// to test whether there are any links in the path. If the output of
+			// EvalSymlinks is different than the input we know one of the nodes in the
+			// the path is a link.
+			target, err := filepath.EvalSymlinks(newPath)
+			if err != nil {
+				return "", err
+			}
+
+			if target != newPath {
+				last = filepath.Base(newPath)
+				newPath = filepath.Dir(newPath)
+			} else {
+				break loop
+			}
+		}
+	}
+
+	newPath = filepath.Join(newPath, last)
+	return filepath.Clean(newPath), nil
+}