BUG #19888: pg_verifybackup accepts ustar member under the wrong manifest path

The following bug has been logged on the website:

Bug reference: 19888
Logged by: Qifan Liu
Email address: imchifan(at)163(dot)com
PostgreSQL version: 18.6
Operating system: Linux/amd64
Description:

PostgreSQL 18.6 (Debian 18.6-1.pgdg13+2) on Linux/amd64 reports successful
verification after a tar backup member's ustar prefix is changed. GNU tar
identifies the member as archive_member_directory_name/backup_label, but
pg_verifybackup matches it to the manifest entry backup_label.

The replacement prefix is 29 bytes long, preserving the recorded field
mutation. Archive verification should construct the pathname from both the
ustar prefix and name fields and reject the member because the resulting
path is absent from the backup manifest.

How to repeat:

#!/bin/sh
set -eu
: "${PG_BASEBACKUP:=pg_basebackup}"
: "${PG_VERIFYBACKUP:=pg_verifybackup}"
work=$(mktemp -d "${TMPDIR:-/tmp}/verify-prefix.XXXXXX")
backup="$work/backup"
mkdir "$backup"
"$PG_BASEBACKUP" -D "$backup" -F tar -X stream
"$PG_VERIFYBACKUP" --no-parse-wal "$backup"
printf archive_member_directory_name | dd of="$backup/base.tar" bs=1
seek=345 conv=notrunc status=none
printf ' ' | dd of="$backup/base.tar" bs=1 seek=148 conv=notrunc
status=none
checksum=$(dd if="$backup/base.tar" bs=512 count=1 status=none | od -An -tu1
| awk '{for(i=1;i<=NF;i++)s+=$i} END {print s}')
printf '%06o\0 ' "$checksum" | dd of="$backup/base.tar" bs=1 seek=148
conv=notrunc status=none
tar -tf "$backup/base.tar" | grep
'^archive_member_directory_name/backup_label$'
"$PG_VERIFYBACKUP" --no-parse-wal "$backup"
echo "BUG REPRODUCED: pg_verifybackup accepted an archive member whose ustar
prefix changes its manifest identity"

Set PGHOST and any other required libpq variables for a server that permits
replication connections. PG_BASEBACKUP and PG_VERIFYBACKUP may be set to
select the tested binaries. Save the script as run.sh and run:

chmod +x run.sh
./run.sh

With the incidental prefix renamed as above, a successful reproduction is
expected to end with:

backup successfully verified
archive_member_directory_name/backup_label
backup successfully verified
BUG REPRODUCED: pg_verifybackup accepted an archive member whose ustar
prefix changes its manifest identity

In the recorded execution, the baseline and mutated pg_verifybackup commands
both exited with status 0. GNU tar also exited with status 0 after
displaying the prefixed pathname.

The tar parser copies the header's name field into the member pathname but
does not incorporate the ustar prefix field. pg_verifybackup consequently
verifies the member's contents against the unprefixed manifest entry.

The issue was reproduced on PostgreSQL 18.6 using GNU tar and ordinary
command-line backup tools. This occurs when pg_verifybackup checks a
tar-format base backup containing a regular ustar member with a nonempty
prefix and a valid recomputed header checksum.