build: allow kodata symlinks within the source tree

[evilgensec]

Summary

Follow-up to #1619. That change rejected any kodata/ symlink whose target resolved outside the kodata directory. As @evankanderson noted on #1619, this also breaks the legitimate and common case of symlinking a file that lives inside the project repository but outside the command root (a top-level LICENSE, shared config, etc.).

This PR keeps the security property (a symlink to ~/.ssh/id_rsa or /etc/passwd still cannot be packed into the image) while removing the false positive, by widening the allowed boundary from the kodata root to the enclosing source tree.

Changes

pkg/build/gobuild.go

• walkRecursive's boundary parameter is renamed absKodataRoot -> absAllowedRoot; the EvalSymlinks + Abs + HasPrefix containment check now runs against this wider root. The recursion for directory symlinks passes it through unchanged, so the check holds at every nesting level.
• New resolveKodataAllowedRoot computes the allowed root:
  • KO_DATA_PATH_ALLOWED_ROOT when set (for monorepos / non-git builds),
  • otherwise the enclosing git worktree via git rev-parse --show-toplevel,
  • falling back to the kodata root when neither is available.
  • The candidate is only used when it is an ancestor of (or equal to) the kodata root, so the boundary can never be narrowed below kodata and normal kodata contents are never affected.
• tarKoData computes absAllowedRoot and passes it to walkRecursive.

pkg/build/gobuild_test.go

• TestWalkRecursiveSymlinkWithinAllowedRoot: a symlink in kodata pointing to an in-repo, out-of-kodata LICENSE is followed and packed (the case from build: prevent kodata symlinks from escaping the kodata root #1619).
• TestResolveKodataAllowedRoot: ancestor override widens the boundary; a non-ancestor override and a non-git tree both fall back to the kodata root.
• Existing TestWalkRecursiveSymlinkTraversal / TestWalkRecursiveSymlinkWithinKodata still pass (error message updated to "outside the allowed root").

Test

go test ./pkg/build/ -run 'TestWalkRecursiveSymlink|TestResolveKodataAllowedRoot' -v
=== RUN   TestWalkRecursiveSymlinkTraversal
--- PASS
=== RUN   TestWalkRecursiveSymlinkWithinKodata
--- PASS
=== RUN   TestWalkRecursiveSymlinkWithinAllowedRoot
--- PASS
=== RUN   TestResolveKodataAllowedRoot
--- PASS

Full go test ./pkg/build/ passes.

Closes the compatibility regression raised in #1619 without reverting the symlink-escape fix.

[Copilot]

Pull request overview

This PR adjusts ko’s kodata/ symlink dereference security boundary to allow symlinks that point elsewhere within the same source tree (e.g., top-level LICENSE), while still preventing symlinks from escaping the project and accidentally packaging arbitrary host files into container images.

Changes:

• Widened the symlink containment boundary from “kodata root only” to an “allowed root” that can be the enclosing source tree.
• Added resolveKodataAllowedRoot to derive the allowed root from KO_DATA_PATH_ALLOWED_ROOT, git worktree top-level, or fallback to kodata root.
• Added tests for “in-repo but out-of-kodata” symlinks and for allowed-root resolution behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/build/gobuild.go	Widen symlink resolution boundary and add helper to compute the allowed root (env/git/fallback).
pkg/build/gobuild_test.go	Add coverage for allowed-root symlink behavior and allowed-root resolution logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[imjasonh]

I had Copilot throw #1698 together -- I haven't reviewed it yet myself but I will probably later today.

[evankanderson]

A couple comments, but for me it's faster to review a solution than to decide which solution to suggest, so thanks for the PR!

[evilgensec]

Thanks for the review @evankanderson! Pushed d455fba addressing all of it:

• withinRoot now uses filepath.Rel
• replaced the git shell-out with a filesystem .git walk-up (enclosingGitRoot), no subprocess
• fixed the ineffassign lint failure
• added a test for the git-worktree detection

Let me know if you'd prefer to drop the git auto-detection entirely and lean on KO_DATA_PATH_ALLOWED_ROOT only.