Fix path traversal vulnerability in cache.go

[antitree]

Summary

• Fixed path traversal vulnerability in pkg/apk/apk/cache.go
• Replaced unsafe filepath.Clean + strings.HasPrefix validation with Go 1.24's os.Root
• Added protection against both directory traversal and symlink attacks

Security Issue

The previous validation in cachePathFromURL() could be bypassed:

// Vulnerable code
cacheFile = filepath.Clean(cacheFile)
cleanroot := filepath.Clean(root)
if \!strings.HasPrefix(cacheFile, cleanroot) {
    return "", fmt.Errorf("cache file %s is not within root %s", cacheFile, cleanroot)
}

Attack example: With root="/cache", a malicious path like "/cache-evil/file" would pass the prefix check.

Solution

Implemented Go 1.24's os.Root which provides:

• Traversal-resistant path validation
• Protection against symlink attacks
• Platform-specific security optimizations
• Proper containment within the specified root directory

Test Plan

• All existing tests pass
• Code builds successfully
• go vet passes
• Proper code formatting applied

🤖 Generated with Claude Code

[antitree]

Aims to address https://github.com/chainguard-dev/internal-dev/issues/1593

[tstromberg]

To prevent a future regression, this should get a test.

[tstromberg]

"root" isn't necessarily an absolute path; if this comment is to be accurate, you should use filepath.Abs.

[tstromberg]

Look out for other calls to filepath.Join here to see whether or not they are similarly vulnerable - https://github.com/chainguard-dev/apko/pull/1795/files#diff-085f287e1519fcab77329f1fededeae7b771c1e18f0522e4c4f1fdbe3c202d3bR376 looks suspicious.