[Bug]: package tar extraction fails with unicode characters in paths

[jbedard]

What happened?

Packages may contain files or directories containing interesting characters, for example the snowman in @fastify/send tests

Failure when extracting the package:

rules_js/BUILD.bazel:14:22: Extracting npm package @fastify/send@3.3.0 failed: (Exit 1): tar failed: error executing NpmPackageExtract command (from target //:.aspect_rules_js/node_modules/@fastify+send@3.3.0/pkg) external/aspect_bazel_lib~~toolchains~bsd_tar_darwin_arm64/tar --extract --no-same-owner --no-same-permissions --strip-components 1 --file external/_main~npm~npm__at_fastify_send__3.3.0/package.tgz ... (remaining 2 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
tar: Pathname can't be converted from UTF-8 to current locale.
tar: Error exit delayed from previous errors.

Version

bazel 7.4
rules_js 2.1.2

How to reproduce

https://github.com/aspect-build/rules_js/commit/580086b75c825dbc9cbcefe9ebd2f6f531c064ae

Any other information?

No response

[alexeagle]

I think this is related to the locale. bsdtar is sensitive to LC_ALL (https://github.com/libarchive/libarchive/blob/819a50a0436531276e388fc97eb0b1b61d2134a3/tar/bsdtar.c#L191)

I was able to reproduce the same failure message, so long as use_default_shell_env is enabled for the action.

% bazel build --action_env=LC_ALL=C :thing
ERROR: /home/alex/Projects/rules_js/e2e/npm_translate_lock/BUILD.bazel:6:22: Extracting npm package @fastify/send@3.3.0 failed: (Exit 1): tar failed: error executing NpmPackageExtract command (from target //:.aspect_rules_js/node_modules/@fastify+send@3.3.0/pkg) external/aspect_bazel_lib~~toolchains~bsd_tar_linux_amd64/tar --extract --no-same-owner --no-same-permissions --strip-components 1 --file ... (remaining 3 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
tar: Pathname can't be converted from UTF-8 to current locale.
tar: Error exit delayed from previous errors.

Now there's the question about using --exclude to avoid these bad pathnames, but I did that experiment as well and it still fails:

ERROR: /home/alex/Projects/rules_js/e2e/npm_translate_lock/BUILD.bazel:6:22: Extracting npm package @fastify/send@3.3.0 failed: (Exit 1): tar failed: error executing NpmPackageExtract command (from target //:.aspect_rules_js/node_modules/@fastify+send@3.3.0/pkg) external/aspect_bazel_lib~~toolchains~bsd_tar_linux_amd64/tar --extract --no-same-owner --no-same-permissions --strip-components 1 --exclude 'test/**' --file ... (remaining 3 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
tar: Pathname can't be converted from UTF-8 to current locale.

experiment is just using this patch:

--- a/npm/private/npm_package_store.bzl
+++ b/npm/private/npm_package_store.bzl
@@ -233,11 +233,14 @@ def _npm_package_store_impl(ctx):
                         "--no-same-permissions",
                         "--strip-components",
                         "1",
+                        "--exclude",
+                        "test/**",
                         "--file",
                         src.path,
                         "--directory",
                         package_store_directory.path,
                     ],
+                    use_default_shell_env = True,
                     mnemonic = "NpmPackageExtract",
                     progress_message = "Extracting npm package {}@{}".format(package, version),
                 )