[Bug]: oci image using js_image_layer with remote exec fails to run

[Olsworn]

What happened?

Hello!

First of all, thank you for the amazing work maintaining this repo :)

We tried to upgrade our repo to v2.3.3, but when we did so we noticed that our tests on our js images using rules_oci started breaking, but only when remote execution was used.

Version

Development (host) and target OS/architectures: linux arm64

Output of bazel --version: 8.1.1

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file:

bazel_dep(name = "aspect_rules_js", version = "2.3.3")
bazel_dep(name = "rules_oci", version = "2.2.5")

Language(s) and/or frameworks involved: javascript / oci

How to reproduce

With remote execution: build an image using js_image_layer as one of its tars.

Perhaps removing the "no-remote-exec" tag from https://github.com/aspect-build/rules_js/blob/main/e2e/js_image_oci/src/BUILD.bazel#L57 would highlight the error.

Any other information?

When inspecting the image, the package.json situated in our image would contain the content of the {js_image_layer_target_name}_launcher instead of its original content.
Leading to the following error SyntaxError: Error parsing /path/to/dir/etc/package.json Unexpected token '#', "#!/usr/bin"... is not valid JSON.

After some investigation we narrowed it down to the js_image_layer rule. It would only start working again when setting the no-remote-exec tag.

We tracked down the last working commit to fff00b6

So we believe the bug was introduced in #2130, this PR also adds a no-remote-exec to the js_image_layer of the test.

[Olsworn]

After investigating a bit more, the problem seems to arise when the JsImageLayer actions are called.
The resulting .tar.gz archives contain wrong information, of which the logic escape me. When explored with an archive manager, some files have 0 bytes and when extracted contain content from other files from the same archive at random?
When I download the inputs sent to our remote exec agent and run the same commands, I am still unable to reproduce the error.

I suspect some issue in the @aspect_bazel_lib//lib:tar_toolchain_type toolchain, which was not used in previous versions.

[Olsworn]

The issue seems to arise from a bug in bsdtar, which should be fixed with libarchive/libarchive#2587.

For now I changed the following line https://github.com/aspect-build/rules_js/blob/v2.3.7/js/private/js_image_layer.mjs#L190

From:

    return `${dest} uid={{UID}} gid={{GID}} time=0 mode=0555 type=file content=${vis(

To:

    return `${dest} uid={{UID}} gid={{GID}} time=0 mode=0555 nlink=1 type=file content=${vis(

Allowing the archive to be created from our remote agents.