[CI]: Alma extended attributes getting lost (with nydus convert) (help needed)

[apostasie]

Description

TestImageConvertNydusVerify has been failing, for example:
https://github.com/containerd/nerdctl/actions/runs/15784646412/job/44498256000?pr=4327

It seems like converting the image with nydus does shed the extended attributes present in the original image.

This is happening solely on Alma (8&9).

Here is what is going on:

• start registry:2 and cesanta auth token
• image convert --nydus --oci
• image tag
• image push

Then:
nydusify check --source ghcr.io/stargz-containers/alpine:3.13-org --target localhost:5001/nydusd-image:test --source-insecure --target-insecure

Fails with:

validate filesystem failed: file not match in target image:\n\t[source] path: /usr/bin/bunzip2, size: 12, mode: 134218239, rdev: 0, symink: /bin/busybox, uid: 0, gid: 0, xattrs: map[security.selinux:[115 121 115 116 101 109 95 117 58 111 98 10 6 101 99 116 95 114 58 99 111 110 116 97 105 110 101 114 95 114 111 95 102 105 108 101 95 116 58 115 48 0]], hash: \n\t[target] path: /usr/bin/bunzip2, size: 12, mode: 134218239, rdev: 0, symink: /bin/busybox, uid: 0, gid: 0, xattrs: map[], hash: 

Steps to reproduce the issue

CI run TestImageConvertNydusVerify

Describe the results you received and expected

Fail with missing ext attr on certain files.

What version of nerdctl are you using?

main

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response

[apostasie]

Notes:

• the corresponding tests were not running on the CI previously
• they fail only on Alma (8 and 9), so, something there is specific and make it loose extended attributes

[apostasie]

Same thing is happening locally (inside lima), so, this issue is not about how we provision Alma on the CI.