Throw validation error when a template digest is specified

because digest validation is not yet implemented.

Also adds missing unmarshalling for `base: {file: URL}` and related tests.

Signed-off-by: Jan Dubois <[email protected]>

Author: jandubois

pkg/limatmpl/abs.go

@@ -33,7 +33,8 @@ func (tmpl *Template) useAbsLocators() error {
 		if i == 0 {
 			// base can either be a single string, or a list of strings
 			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!str\")) |= %q\n", locator))
-			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\") | .[0]) |= %q\n", locator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\" and (.[0] | type) == \"!!str\") | .[0]) |= %q\n", locator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\" and (.[0] | type) == \"!!seq\") | .[0].url) |= %q\n", locator))
 		} else {
 			tmpl.expr.WriteString(fmt.Sprintf("| $a.base[%d] = %q\n", i, locator))
 		}
@@ -90,6 +91,9 @@ func basePath(locator string) (string, error) {
 
 // absPath either returns the locator directly, or combines it with the basePath if the locator is a relative path.
 func absPath(locator, basePath string) (string, error) {
+	if locator == "" {
+		return "", errors.New("locator is empty")
+	}
 	u, err := url.Parse(locator)
 	if err == nil && len(u.Scheme) > 1 {
 		return locator, nil

pkg/limatmpl/abs_test.go

@@ -203,9 +203,14 @@ func TestAbsPath(t *testing.T) {
 		assert.ErrorContains(t, err, "'../'")
 	})
 
+	t.Run("locator must not be empty", func(t *testing.T) {
+		_, err = absPath("", "foo")
+		assert.ErrorContains(t, err, "locator is empty")
+	})
+
 	t.Run("basePath must not be empty", func(t *testing.T) {
 		_, err = absPath("foo", "")
-		assert.ErrorContains(t, err, "empty")
+		assert.ErrorContains(t, err, "basePath is empty")
 	})
 
 	t.Run("", func(t *testing.T) {

pkg/limatmpl/embed.go

@@ -72,6 +72,10 @@ func (tmpl *Template) embedAllBases(ctx context.Context, embedAll, defaultBase b
 			break
 		}
 		baseLocator := tmpl.Config.Base[0]
+		logrus.Infof("Base[0] is %+v", baseLocator)
+		if baseLocator.Digest != nil {
+			return fmt.Errorf("base %q in %q has specified a digest; digest support is not yet implemented", baseLocator.URL, tmpl.Locator)
+		}
 		isTemplate, _ := SeemsTemplateURL(baseLocator.URL)
 		if isTemplate && !embedAll {
 			// Once we skip a template:// URL we can no longer embed any other base template

pkg/limatmpl/embed_test.go

@@ -359,6 +359,20 @@ provision:
 		"#! my script",
 		`provision: [{script: "#! my script"}]`,
 	},
+	{
+		// This test also verifies that the alternate format for `base` are transformed correctly by useAbsLocators
+		"ERROR base digest is not yet implemented (1)",
+		"",
+		"base: {url: base.yaml, digest: deafbad}",
+		"not yet implemented",
+	},
+	{
+		// This test also verifies that the alternate format for `base` are transformed correctly by useAbsLocators
+		"ERROR base digest is not yet implemented (2)",
+		"",
+		"base: [{url: base.yaml, digest: deafbad}]",
+		"not yet implemented",
+	},
 }
 
 func TestEmbed(t *testing.T) {

pkg/limayaml/marshal.go

@@ -42,6 +42,11 @@ func unmarshalBaseTemplates(dst *BaseTemplates, b []byte) error {
 		*dst = BaseTemplates{LocatorWithDigest{URL: s}}
 		return nil
 	}
+	var locator LocatorWithDigest
+	if err := yaml.Unmarshal(b, &locator); err == nil {
+		*dst = BaseTemplates{locator}
+		return nil
+	}
 	return yaml.UnmarshalWithOptions(b, dst, yaml.CustomUnmarshaler[LocatorWithDigest](unmarshalLocatorWithDigest))
 }
 

pkg/limayaml/validate.go

@@ -206,8 +206,13 @@ func Validate(y *LimaYAML, warn bool) error {
 	// y.Firmware.LegacyBIOS is ignored for aarch64, but not a fatal error.
 
 	for i, p := range y.Provision {
-		if p.File != nil && p.File.URL != "" {
-			return fmt.Errorf("field `provision[%d].file.url` must be empty during validation (script should already be embedded)", i)
+		if p.File != nil {
+			if p.File.URL != "" {
+				return fmt.Errorf("field `provision[%d].file.url` must be empty during validation (script should already be embedded)", i)
+			}
+			if p.File.Digest != nil {
+				return fmt.Errorf("field `provision[%d].file.digest` support is not yet implemented", i)
+			}
 		}
 		switch p.Mode {
 		case ProvisionModeSystem, ProvisionModeUser, ProvisionModeBoot:
@@ -249,8 +254,13 @@ func Validate(y *LimaYAML, warn bool) error {
 		}
 	}
 	for i, p := range y.Probes {
-		if p.File != nil && p.File.URL != "" {
-			return fmt.Errorf("field `probes[%d].file.url` must be empty during validation (script should already be embedded)", i)
+		if p.File != nil {
+			if p.File.URL != "" {
+				return fmt.Errorf("field `probe[%d].file.url` must be empty during validation (script should already be embedded)", i)
+			}
+			if p.File.Digest != nil {
+				return fmt.Errorf("field `probe[%d].file.digest` support is not yet implemented", i)
+			}
 		}
 		if !strings.HasPrefix(p.Script, "#!") {
 			return fmt.Errorf("field `probe[%d].script` must start with a '#!' line", i)

pkg/limayaml/validate_test.go

@@ -46,6 +46,13 @@ func TestValidateProbes(t *testing.T) {
 
 	err = Validate(y, false)
 	assert.Error(t, err, "field `probe[0].script` must start with a '#!' line")
+
+	invalidProbe = `probes: [{file: {digest: decafbad}}]`
+	y, err = Load([]byte(invalidProbe+"\n"+images), "lima.yaml")
+	assert.NilError(t, err)
+
+	err = Validate(y, false)
+	assert.Error(t, err, "field `probe[0].file.digest` support is not yet implemented")
 }
 
 func TestValidateAdditionalDisks(t *testing.T) {