bboltcachestorage: only delete link after releasing result

[fanjiyun]

If the result exists but the link has been deleted, it will cause the result to never be released, ultimately leading to data leakage.

[tonistiigi]

Do you have an example testcase that reproduces this scenario?

[fanjiyun]

1. init：

buildctl du
ID	RECLAIMABLE	SIZE	LAST ACCESSED
Reclaimable:	0B
Total:		0B

2. buildctl build with Dockerfile:

FROM huaixi/busybox
RUN echo "hello world"

3. buildctl build again with the same basic image, and the Dockerfile is：

FROM busybox
RUN echo "hello hello"

4. buildctl du

ID									RECLAIMABLE	SIZE	LAST ACCESSED
4nk2b8x63h9jxcxkffdnrjuc6                                              	true       	2.11MB
lh6l9v9gq6c65ttetl92pxqcl*                                             	true       	16.38kB
8rmrvscrhx0zecj19wgb7qh8n*                                             	true       	16.38kB
3d0mik02mdf70wewf3x85wpxj*                                             	true       	8.19kB
ts1az0q1defw1b5vjfyd84a0x*                                             	true       	4.10kB
Reclaimable:	2.16MB
Total:		2.16MB

5. execute buildctl prune --keep-storage 2.12 to delete child results

#buildctl du
ID									RECLAIMABLE	SIZE	LAST ACCESSED
4nk2b8x63h9jxcxkffdnrjuc6                                              	true       	2.11MB
ts1az0q1defw1b5vjfyd84a0x*                                             	true       	4.10kB
Reclaimable:	2.12MB
Total:		2.12MB

now, we can found this two child results have been deleted:

lh6l9v9gq6c65ttetl92pxqcl （Description: /bin/sh -c echo "hello hello"）
8rmrvscrhx0zecj19wgb7qh8n （Description: /bin/sh -c echo "hello world"）

and parent result 4nk2b8x63h9jxcxkffdnrjuc6 （Description: pulled from buysbox...）exists

6. view cache.db, we can found result 93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6 exists, but link id is deleted

>>> cd _byresult
/ -> _byresult
>>> ls
[Bucket]    93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6
[Bucket]    93bzqojj02l3lq3ckohg44brf::siz3zw0bdqms3oulcg646rtij

  Total 2 buckets and 0 keys
  
>>> cd 93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6
/ -> _byresult -> 93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6
>>> ls
[Key]       sha256:4aa8794b66b4325e7210a7c4a6fe388cbb27f3929612d3d32169ea035c995c6d=
[Key]       sha256:809a9a7b9cc934b989047bfdfc9dd6f981a87339186f3c6de68ee36467365373=

  Total 0 buckets and 2 keys

/ -> _result
>>> ls
[Bucket]    random:498ca481485074b2c396b191e645df9f19916aae853f1296c94c214557b5cc70
[Bucket]    sha256:4aa8794b66b4325e7210a7c4a6fe388cbb27f3929612d3d32169ea035c995c6d
[Bucket]    sha256:809a9a7b9cc934b989047bfdfc9dd6f981a87339186f3c6de68ee36467365373

  Total 3 buckets and 0 keys


  >>> cd _links
/ -> _links
>>> ls
[Bucket]    random:498ca481485074b2c396b191e645df9f19916aae853f1296c94c214557b5cc70

  Total 1 buckets and 0 keys

7. now, execute buildctl prune --all to delete all results

#buildctl du
ID	RECLAIMABLE	SIZE	LAST ACCESSED
Reclaimable:	0B
Total:		0B

8. at last, we expect cache.db to be empty，but in reality, result 93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6 remains

cache.db:

>>> cd _byresult
/ -> _byresult
>>> ls
[Bucket]    93bzqojj02l3lq3ckohg44brf::4nk2b8x63h9jxcxkffdnrjuc6

  Total 1 buckets and 0 keys

/ -> _result
>>> ls
[Bucket]    sha256:4aa8794b66b4325e7210a7c4a6fe388cbb27f3929612d3d32169ea035c995c6d
[Bucket]    sha256:809a9a7b9cc934b989047bfdfc9dd6f981a87339186f3c6de68ee36467365373

  Total 2 buckets and 0 keys

>>> cd _links
/ -> _links
>>> ls

  Total 0 buckets and 0 keys
>>>