From b6f47938e683cda6d2a697182a93344b324e8389 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 19:53:53 +0000
Subject: [PATCH] Handle pathRel errors properly in GetAllDedupeReposCandidates

Instead of silently ignoring errors from pathRel, log a warning and skip invalid paths. Also add bounds checking for blob path format to prevent panics.

Addresses code review feedback about error handling.

Co-authored-by: rchincha <45800463+rchincha@users.noreply.github.com>
---
 pkg/storage/imagestore/imagestore.go | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkg/storage/imagestore/imagestore.go b/pkg/storage/imagestore/imagestore.go
index c94f0129..3746fdc8 100644
--- a/pkg/storage/imagestore/imagestore.go
+++ b/pkg/storage/imagestore/imagestore.go
@@ -1343,10 +1343,23 @@ func (is *ImageStore) GetAllDedupeReposCandidates(digest godigest.Digest) ([]str
 	for _, blobPath := range blobsPaths {
 		// these can be both full paths or relative paths depending on the cache options
 		if !is.cache.UsesRelativePaths() && path.IsAbs(blobPath) {
-			blobPath, _ = is.pathRel(is.rootDir, blobPath)
+			relPath, err := is.pathRel(is.rootDir, blobPath)
+			if err != nil {
+				// Skip paths that are not under rootDir - this shouldn't happen but handle it gracefully
+				is.log.Warn().Err(err).Str("blobPath", blobPath).Str("rootDir", is.rootDir).
+					Msg("failed to compute relative path for cached blob, skipping")
+
+				continue
+			}
+
+			blobPath = relPath
 		}
 
 		blobsDirIndex := strings.LastIndex(blobPath, "/blobs/")
+		if blobsDirIndex == -1 {
+			// Skip invalid blob paths
+			continue
+		}
 
 		repos = append(repos, blobPath[:blobsDirIndex])
 	}