Add unsquashfs and stop SquashFS tools failing on xattrs

Install Ubuntu's squashfs-tools so the stock unsquashfs/mksquashfs exist
next to sasquatch. As the non-root container user, unsquashfs and
sasquatch can't restore security.* xattrs and exit 2 although every file
was extracted; wrap them to pass -no-xattrs unless an xattr option is
given.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -256,8 +256,11 @@ RUN set -e \
 # binwalk and unblob (built above) with the extraction tools their install
 # scripts (binwalk's Dockerfile, unblob's install-deps.sh) put in place.
 # sasquatch (SquashFS variants) comes as a .deb from onekey-sec, at the
-# release unblob 26.6.4 uses. unblob's ext2/3/4 extraction needs the rdump
-# options from onekey-sec's e2fsprogs fork, so its .debs replace Ubuntu's
+# release unblob 26.6.4 uses. squashfs-tools adds the stock unsquashfs/
+# mksquashfs next to it (sasquatch only installs sasquatch*), since that's
+# the command people and Claude reach for first.
+# unblob's ext2/3/4 extraction needs the rdump options from onekey-sec's
+# e2fsprogs fork, so its .debs replace Ubuntu's
 # e2fsprogs (same upstream 1.47.0). These releases publish no checksums;
 # the SHA-256s were taken when pinned.
 # The Python tools' entry points are linked into /usr/local/bin; the venvs'
@@ -309,7 +312,7 @@ RUN set -e \
         lz4 lzop unrar unyaffs cpio device-tree-compiler \
         liblzo2-2 libucl1 libfontconfig1 \
         android-sdk-libsparse-utils erofs-utils lziprecover partclone unar \
-        upx-ucl libmagic1t64 xz-utils \
+        upx-ucl libmagic1t64 xz-utils squashfs-tools \
  && rm -rf /var/lib/apt/lists/* /tmp/sasquatch.deb /tmp/e2fsprogs-ok \
  && for f in /opt/binwalk-py/bin/* /opt/esptool/bin/*; do \
         case "$(basename "$f")" in python*|pip*|activate*|Activate*) continue ;; esac; \
@@ -321,6 +324,12 @@ RUN set -e \
  && binwalk --version && esptool version && unblob --version \
  && debugfs -V 2>&1 | grep -q 1.47.0 \
  && unblob --show-external-dependencies
+# unsquashfs/sasquatch exit 2 as non-root on images with security.* xattrs
+# although every file was extracted; the wrapper adds -no-xattrs by default.
+COPY --chmod=755 scripts/squashfs-no-xattrs.sh /usr/local/libexec/squashfs-no-xattrs
+RUN for t in unsquashfs sasquatch sasquatch-v4be; do \
+        ln -s /usr/local/libexec/squashfs-no-xattrs "/usr/local/bin/$t"; \
+    done
 # Binwalk leaves a symlink to the input file in its extraction directory. The
 # target is a container path, which is dangling when viewed from the host.
 ENV BINWALK_RM_EXTRACTION_SYMLINK=1 \