Throw validation error when a template digest is specified

because digest validation is not yet implemented.

Also adds missing unmarshalling for `base: {file: URL}` and related tests.

Signed-off-by: Jan Dubois <[email protected]>

Author: jandubois

pkg/limatmpl/abs.go

@@ -26,34 +26,39 @@ func (tmpl *Template) useAbsLocators() error {
 		return err
 	}
 	for i, baseLocator := range tmpl.Config.Base {
-		locator, err := absPath(baseLocator.URL, basePath)
+		absLocator, err := absPath(baseLocator.URL, basePath)
 		if err != nil {
 			return err
 		}
 		if i == 0 {
-			// base can either be a single string, or a list of strings
-			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!str\")) |= %q\n", locator))
-			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\") | .[0]) |= %q\n", locator))
+			// base can be either a single string (URL), or a single locator object, or a list whose first element can be either a string or an object
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!str\")) |= %q\n", absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!map\") | .url) |= %q\n", absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\" and (.[0] | type) == \"!!str\") | .[0]) |= %q\n", absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base | select(type == \"!!seq\" and (.[0] | type) == \"!!map\") | .[0].url) |= %q\n", absLocator))
 		} else {
-			tmpl.expr.WriteString(fmt.Sprintf("| $a.base[%d] = %q\n", i, locator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base[%d] | select(type == \"!!str\")) |= %q\n", i, absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.base[%d] | select(type == \"!!map\") | .url) |= %q\n", i, absLocator))
 		}
 	}
 	for i, p := range tmpl.Config.Probes {
 		if p.File != nil {
-			locator, err := absPath(p.File.URL, basePath)
+			absLocator, err := absPath(p.File.URL, basePath)
 			if err != nil {
 				return err
 			}
-			tmpl.expr.WriteString(fmt.Sprintf("| $a.probes[%d].file = %q\n", i, locator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.probes[%d].file | select(type == \"!!str\")) = %q\n", i, absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.probes[%d].file | select(type == \"!!map\") | .url) = %q\n", i, absLocator))
 		}
 	}
 	for i, p := range tmpl.Config.Provision {
 		if p.File != nil {
-			locator, err := absPath(p.File.URL, basePath)
+			absLocator, err := absPath(p.File.URL, basePath)
 			if err != nil {
 				return err
 			}
-			tmpl.expr.WriteString(fmt.Sprintf("| $a.provision[%d].file = %q\n", i, locator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.provision[%d].file | select(type == \"!!str\")) = %q\n", i, absLocator))
+			tmpl.expr.WriteString(fmt.Sprintf("| ($a.provision[%d].file | select(type == \"!!map\") | .url) = %q\n", i, absLocator))
 		}
 	}
 	return tmpl.evalExpr()
@@ -90,6 +95,9 @@ func basePath(locator string) (string, error) {
 
 // absPath either returns the locator directly, or combines it with the basePath if the locator is a relative path.
 func absPath(locator, basePath string) (string, error) {
+	if locator == "" {
+		return "", errors.New("locator is empty")
+	}
 	u, err := url.Parse(locator)
 	if err == nil && len(u.Scheme) > 1 {
 		return locator, nil

pkg/limatmpl/abs_test.go

@@ -32,8 +32,21 @@ var useAbsLocatorsTestCases = []useAbsLocatorsTestCase{
 	{
 		"Flow style array of one base template",
 		"template://foo",
-		`base: [bar.yaml]`,
-		`base: ['template://bar.yaml']`,
+		`base: {url: bar.yaml, digest: deadbeef}`,
+		// not sure why the quotes around the URL were added; maybe because we don't copy the style from the source
+		`base: {url: 'template://bar.yaml', digest: deadbeef}`,
+	},
+	{
+		"Flow style array of sequence of two base URLs",
+		"template://foo",
+		`base: [bar.yaml, baz.yaml]`,
+		`base: ['template://bar.yaml', 'template://baz.yaml']`,
+	},
+	{
+		"Flow style array of sequence of two base locator objects",
+		"template://foo",
+		`base: [{url: bar.yaml, digest: deadbeef}, {url: baz.yaml, digest: decafbad}]`,
+		`base: [{url: 'template://bar.yaml', digest: deadbeef}, {url: 'template://baz.yaml', digest: decafbad}]`,
 	},
 	{
 		"Block style array of one base template",
@@ -70,16 +83,30 @@ base:
 		`
 provision:
 - mode: user
-  file: script.sh
+  file: userscript.sh
+- mode: system
+  file:
+    url: systemscript.sh
+    digest: abc123
 probes:
 - file: probe.sh
+- file:
+    url: probe.sh
+    digest: digest
 `,
 		`
 provision:
 - mode: user
-  file: template://experimental/script.sh
+  file: template://experimental/userscript.sh
+- mode: system
+  file:
+    url: template://experimental/systemscript.sh
+    digest: abc123
 probes:
 - file: template://experimental/probe.sh
+- file:
+    url: template://experimental/probe.sh
+    digest: digest
 `,
 	},
 }
@@ -203,9 +230,14 @@ func TestAbsPath(t *testing.T) {
 		assert.ErrorContains(t, err, "'../'")
 	})
 
+	t.Run("locator must not be empty", func(t *testing.T) {
+		_, err = absPath("", "foo")
+		assert.ErrorContains(t, err, "locator is empty")
+	})
+
 	t.Run("basePath must not be empty", func(t *testing.T) {
 		_, err = absPath("foo", "")
-		assert.ErrorContains(t, err, "empty")
+		assert.ErrorContains(t, err, "basePath is empty")
 	})
 
 	t.Run("", func(t *testing.T) {

pkg/limatmpl/embed.go

@@ -72,6 +72,9 @@ func (tmpl *Template) embedAllBases(ctx context.Context, embedAll, defaultBase b
 			break
 		}
 		baseLocator := tmpl.Config.Base[0]
+		if baseLocator.Digest != nil {
+			return fmt.Errorf("base %q in %q has specified a digest; digest support is not yet implemented", baseLocator.URL, tmpl.Locator)
+		}
 		isTemplate, _ := SeemsTemplateURL(baseLocator.URL)
 		if isTemplate && !embedAll {
 			// Once we skip a template:// URL we can no longer embed any other base template

pkg/limatmpl/embed_test.go

@@ -359,6 +359,18 @@ provision:
 		"#! my script",
 		`provision: [{script: "#! my script"}]`,
 	},
+	{
+		"ERROR base digest is not yet implemented (1)",
+		"",
+		"base: {url: base.yaml, digest: deafbad}",
+		"not yet implemented",
+	},
+	{
+		"ERROR base digest is not yet implemented (2)",
+		"",
+		"base: [{url: base.yaml, digest: deafbad}]",
+		"not yet implemented",
+	},
 }
 
 func TestEmbed(t *testing.T) {

pkg/limayaml/marshal.go

@@ -42,6 +42,11 @@ func unmarshalBaseTemplates(dst *BaseTemplates, b []byte) error {
 		*dst = BaseTemplates{LocatorWithDigest{URL: s}}
 		return nil
 	}
+	var locator LocatorWithDigest
+	if err := yaml.Unmarshal(b, &locator); err == nil {
+		*dst = BaseTemplates{locator}
+		return nil
+	}
 	return yaml.UnmarshalWithOptions(b, dst, yaml.CustomUnmarshaler[LocatorWithDigest](unmarshalLocatorWithDigest))
 }
 

pkg/limayaml/validate.go

@@ -206,8 +206,13 @@ func Validate(y *LimaYAML, warn bool) error {
 	// y.Firmware.LegacyBIOS is ignored for aarch64, but not a fatal error.
 
 	for i, p := range y.Provision {
-		if p.File != nil && p.File.URL != "" {
-			return fmt.Errorf("field `provision[%d].file.url` must be empty during validation (script should already be embedded)", i)
+		if p.File != nil {
+			if p.File.URL != "" {
+				return fmt.Errorf("field `provision[%d].file.url` must be empty during validation (script should already be embedded)", i)
+			}
+			if p.File.Digest != nil {
+				return fmt.Errorf("field `provision[%d].file.digest` support is not yet implemented", i)
+			}
 		}
 		switch p.Mode {
 		case ProvisionModeSystem, ProvisionModeUser, ProvisionModeBoot:
@@ -249,8 +254,13 @@ func Validate(y *LimaYAML, warn bool) error {
 		}
 	}
 	for i, p := range y.Probes {
-		if p.File != nil && p.File.URL != "" {
-			return fmt.Errorf("field `probes[%d].file.url` must be empty during validation (script should already be embedded)", i)
+		if p.File != nil {
+			if p.File.URL != "" {
+				return fmt.Errorf("field `probe[%d].file.url` must be empty during validation (script should already be embedded)", i)
+			}
+			if p.File.Digest != nil {
+				return fmt.Errorf("field `probe[%d].file.digest` support is not yet implemented", i)
+			}
 		}
 		if !strings.HasPrefix(p.Script, "#!") {
 			return fmt.Errorf("field `probe[%d].script` must start with a '#!' line", i)

pkg/limayaml/validate_test.go

@@ -46,6 +46,13 @@ func TestValidateProbes(t *testing.T) {
 
 	err = Validate(y, false)
 	assert.Error(t, err, "field `probe[0].script` must start with a '#!' line")
+
+	invalidProbe = `probes: [{file: {digest: decafbad}}]`
+	y, err = Load([]byte(invalidProbe+"\n"+images), "lima.yaml")
+	assert.NilError(t, err)
+
+	err = Validate(y, false)
+	assert.Error(t, err, "field `probe[0].file.digest` support is not yet implemented")
 }
 
 func TestValidateAdditionalDisks(t *testing.T) {