use jonjohnsonjr/tarfs instead of internal/tarfs

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/invopop/jsonschema v0.13.0
+	github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4
 	github.com/klauspost/compress v1.18.0
 	github.com/klauspost/pgzip v1.2.6
 	github.com/package-url/packageurl-go v0.1.3

go.sum

@@ -151,6 +151,8 @@ github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcI
 github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4 h1:yzUKZR6eq4hfKkNLe2KfxOBiVHyjXny7g4bEDuiYCtY=
+github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4/go.mod h1:vFsMbFCBsTclpEtIkbCOBAJj1mBsqoMtm22ibo1cG2o=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=

internal/cli/publish_test.go

@@ -32,10 +32,10 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/google/go-containerregistry/pkg/v1/validate"
+	"github.com/jonjohnsonjr/targz/tarfs"
 	"github.com/stretchr/testify/require"
 
 	"chainguard.dev/apko/internal/cli"
-	"chainguard.dev/apko/internal/tarfs"
 	"chainguard.dev/apko/pkg/build"
 	"chainguard.dev/apko/pkg/build/types"
 	"chainguard.dev/apko/pkg/sbom"

pkg/apk/apk/implementation.go

@@ -41,7 +41,9 @@ import (
 	"sync"
 	"time"
 
+	"github.com/chainguard-dev/clog"
 	"github.com/hashicorp/go-retryablehttp"
+	"github.com/jonjohnsonjr/targz/tarfs"
 	"go.lsp.dev/uri"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
@@ -51,13 +53,10 @@ import (
 	"golang.org/x/sys/unix"
 	"gopkg.in/ini.v1"
 
-	"chainguard.dev/apko/internal/tarfs"
 	"chainguard.dev/apko/pkg/apk/auth"
 	"chainguard.dev/apko/pkg/apk/expandapk"
 	apkfs "chainguard.dev/apko/pkg/apk/fs"
 	"chainguard.dev/apko/pkg/paths"
-
-	"github.com/chainguard-dev/clog"
 )
 
 // This is terrible but simpler than plumbing around a cache for now.
@@ -1099,9 +1098,7 @@ func (a *APK) cachePackage(ctx context.Context, pkg InstallablePackage, exp *exp
 
 	exp.PackageFile = datDst
 
-	if err := exp.TarFS.Close(); err != nil {
-		return nil, fmt.Errorf("closing tarfs: %w", err)
-	}
+	// Note: external tarfs library doesn't require explicit closing
 
 	tarDst := strings.TrimSuffix(exp.PackageFile, ".gz")
 

pkg/apk/apk/install.go

@@ -24,12 +24,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"strings"
 
 	"go.opentelemetry.io/otel"
 
-	"chainguard.dev/apko/internal/tarfs"
+	"github.com/jonjohnsonjr/targz/tarfs"
 )
 
 // writeOneFile writes one file from the APK given the tar header and tar reader.
@@ -310,6 +311,28 @@ func checksumFromHeader(header *tar.Header) ([]byte, error) {
 	return checksum, nil
 }
 
+// getAllEntries walks the tarfs.FS and collects all Entry objects
+func getAllEntries(tf *tarfs.FS) ([]*tarfs.Entry, error) {
+	var entries []*tarfs.Entry
+	err := fs.WalkDir(tf, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		// Skip the root directory "." as it may not have a corresponding Entry
+		if path == "." {
+			return nil
+		}
+		entry, err := tf.Entry(path)
+		if err != nil {
+			// For debugging: we might encounter paths that don't map to entries
+			return fmt.Errorf("failed to get entry for path %q: %w", path, err)
+		}
+		entries = append(entries, entry)
+		return nil
+	})
+	return entries, err
+}
+
 // lazilyInstallAPKFiles avoids actually writing anything to disk, instead relying on a tarfs.FS
 // to provide much cheaper access to the file data when we read it later.
 //
@@ -318,7 +341,10 @@ func (a *APK) lazilyInstallAPKFiles(ctx context.Context, wh WriteHeaderer, tf *t
 	_, span := otel.Tracer("go-apk").Start(ctx, "lazilyInstallAPKFiles")
 	defer span.End()
 
-	entries := tf.Entries()
+	entries, err := getAllEntries(tf)
+	if err != nil {
+		return nil, fmt.Errorf("getting all entries from tarfs: %w", err)
+	}
 	files := make([]tar.Header, 0, len(entries))
 
 	var startedDataSection bool