Skip to content

Commit

Permalink
controllers: Verify Digest of Artifact
Browse files Browse the repository at this point in the history 
This commit changes the verification to the `Digest` field of the
Artifact, which was introduced in source-controller v0.35.0. As the
`Checksum` is expected to be removed in the next release of the
source-controller.

Signed-off-by: Hidde Beydals <hidde@hhh.computer>
  • Loading branch information
@hiddeco
hiddeco committed Mar 27, 2023
1 parent 31534d9 commit 9da4652
Show file tree
Hide file tree
Showing 5 changed files with 33 additions and 18 deletions.
2 changes: 1 addition & 1 deletion controllers/kustomization_controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@ func (r *KustomizationReconciler) reconcile(
defer os.RemoveAll(tmpDir)

// Download artifact and extract files to the tmp dir.
err = r.artifactFetcher.Fetch(src.GetArtifact().URL, src.GetArtifact().Checksum, tmpDir)
err = r.artifactFetcher.Fetch(src.GetArtifact().URL, src.GetArtifact().Digest, tmpDir)
if err != nil {
conditions.MarkFalse(obj, meta.ReadyCondition, kustomizev1.ArtifactFailedReason, err.Error())
return err
Expand Down
6 changes: 3 additions & 3 deletions controllers/kustomization_fuzzer_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ import (
"compress/gzip"
"context"
"crypto/sha1"
"crypto/sha256"
"embed"
"errors"
"fmt"
"github.com/opencontainers/go-digest"
"io"
"io/fs"
"math/rand"
Expand Down Expand Up @@ -598,7 +598,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, revision s
}

b, _ := os.ReadFile(filepath.Join(testServer.Root(), artifactName))
checksum := fmt.Sprintf("%x", sha256.Sum256(b))
dig := digest.SHA256.FromBytes(b)

url := fmt.Sprintf("%s/%s", testServer.URL(), artifactName)

Expand All @@ -615,7 +615,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, revision s
Path: url,
URL: url,
Revision: revision,
Checksum: checksum,
Digest: dig.String(),
LastUpdateTime: metav1.Now(),
},
}
Expand Down
6 changes: 3 additions & 3 deletions controllers/suite_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ package controllers

import (
"context"
"crypto/sha256"
"fmt"
"github.com/opencontainers/go-digest"
"math/rand"
"os"
"path/filepath"
Expand Down Expand Up @@ -294,7 +294,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, revision s
}

b, _ := os.ReadFile(filepath.Join(testServer.Root(), artifactName))
checksum := fmt.Sprintf("%x", sha256.Sum256(b))
dig := digest.SHA256.FromBytes(b)

url := fmt.Sprintf("%s/%s", testServer.URL(), artifactName)

Expand All @@ -311,7 +311,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, revision s
Path: url,
URL: url,
Revision: revision,
Checksum: checksum,
Digest: dig.String(),
LastUpdateTime: metav1.Now(),
},
}
Expand Down
12 changes: 9 additions & 3 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ go 1.18

replace github.com/fluxcd/kustomize-controller/api => ./api

// Replace digest lib to master to gather access to BLAKE3.
// xref: https://github.com/opencontainers/go-digest/pull/66
replace github.com/opencontainers/go-digest => github.com/opencontainers/go-digest v1.0.1-0.20220411205349-bde1400a84be

require (
cloud.google.com/go/kms v1.10.0
filippo.io/age v1.1.1
Expand All @@ -24,15 +28,16 @@ require (
github.com/fluxcd/pkg/apis/event v0.4.1
github.com/fluxcd/pkg/apis/kustomize v0.8.1
github.com/fluxcd/pkg/apis/meta v0.19.1
github.com/fluxcd/pkg/http/fetch v0.3.1
github.com/fluxcd/pkg/http/fetch v0.3.2-0.20230324162009-e9a2f7fc205a
github.com/fluxcd/pkg/kustomize v0.13.2
github.com/fluxcd/pkg/runtime v0.32.0
github.com/fluxcd/pkg/ssa v0.25.0
github.com/fluxcd/pkg/tar v0.2.0
github.com/fluxcd/pkg/testserver v0.4.0
github.com/fluxcd/source-controller/api v0.36.0
github.com/hashicorp/vault/api v1.9.0
github.com/onsi/gomega v1.27.4
github.com/onsi/gomega v1.27.5
github.com/opencontainers/go-digest v1.0.0
github.com/ory/dockertest/v3 v3.9.1
github.com/spf13/pflag v1.0.5
go.mozilla.org/sops/v3 v3.7.3
Expand Down Expand Up @@ -161,7 +166,7 @@ require (
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/go-digest/blake3 v0.0.0-20220411205349-bde1400a84be // indirect
github.com/opencontainers/image-spec v1.0.2 // indirect
github.com/opencontainers/runc v1.1.2 // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
Expand All @@ -179,6 +184,7 @@ require (
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
github.com/xlab/treeprint v1.1.0 // indirect
github.com/zeebo/blake3 v0.1.1 // indirect
go.mozilla.org/gopgagent v0.0.0-20170926210634-4d7ea76ff71a // indirect
go.opencensus.io v0.24.0 // indirect
go.starlark.net v0.0.0-20221028183056-acb66ad56dd2 // indirect
Expand Down
25 changes: 17 additions & 8 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -220,8 +220,8 @@ github.com/fluxcd/pkg/apis/kustomize v0.8.1 h1:uRH9xVDJfSBGIiL6PIhkguHvf2Nme6uTW
github.com/fluxcd/pkg/apis/kustomize v0.8.1/go.mod h1:TBem+2mHp6Ib7XD1fmzDkoUnBzx07wSzIYo6BVx3XAc=
github.com/fluxcd/pkg/apis/meta v0.19.1 h1:fCI5CnTXpAqr67UlaI9q0H+OztMKB5kDTr6xV6vlAo0=
github.com/fluxcd/pkg/apis/meta v0.19.1/go.mod h1:ZPPMYrPnWwPQYNEGM/Uc0N4SurUPS3xNI3IIpCQEfuM=
github.com/fluxcd/pkg/http/fetch v0.3.1 h1:GEkPN4Ap9OQzV1vjn3ioom2GFM+TtYWwWrG6pDIbCzg=
github.com/fluxcd/pkg/http/fetch v0.3.1/go.mod h1:8w2CdIPIio8zvM4xZMiHXVS1axUsY1hPWIcqKIXg6JE=
github.com/fluxcd/pkg/http/fetch v0.3.2-0.20230324162009-e9a2f7fc205a h1:aZV76niclY6VKY8VB/PlNg3UsgBBilVJ+IQGqf0HmW0=
github.com/fluxcd/pkg/http/fetch v0.3.2-0.20230324162009-e9a2f7fc205a/go.mod h1:LmdHmevj0wBSQkKMuIObUyK/4akQi4KMhavm3GA0XEc=
github.com/fluxcd/pkg/kustomize v0.13.2 h1:isA9yi+m7sSIxdTrFR1U7+LyS2BraG07ZkKLHw3bnGo=
github.com/fluxcd/pkg/kustomize v0.13.2/go.mod h1:1H9qednPxL/JvZE5at/f6wVHTH4WmxJYqfgVOZJ3uAk=
github.com/fluxcd/pkg/runtime v0.32.0 h1:GwPyl27qs0jg95o8lGQD+FiAAxFPJMKs58L63AQRk50=
Expand Down Expand Up @@ -265,7 +265,7 @@ github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
Expand Down Expand Up @@ -468,11 +468,13 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/onsi/ginkgo/v2 v2.9.1 h1:zie5Ly042PD3bsCvsSOPvRnFwyo3rKe64TJlD6nu0mk=
github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E=
github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/onsi/ginkgo/v2 v2.9.2 h1:BA2GMJOtfGAfagzYtrAlufIP0lq6QERkFmHLMLPwFSU=
github.com/onsi/gomega v1.27.5 h1:T/X6I0RNFw/kTqgfkZPcQ5KU6vCnWNBGdtrIx2dpGeQ=
github.com/onsi/gomega v1.27.5/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
github.com/opencontainers/go-digest v1.0.1-0.20220411205349-bde1400a84be h1:f2PlhC9pm5sqpBZFvnAoKj+KzXRzbjFMA+TqXfJdgho=
github.com/opencontainers/go-digest v1.0.1-0.20220411205349-bde1400a84be/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/go-digest/blake3 v0.0.0-20220411205349-bde1400a84be h1:yJISmqboKE7zWqC2Nlg3pBkelqCblzZBoMHv2nbrUjQ=
github.com/opencontainers/go-digest/blake3 v0.0.0-20220411205349-bde1400a84be/go.mod h1:amaK2C3q0MwQTE9OgeDacYr8Qac7uKwICGry1fn3UrI=
github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
github.com/opencontainers/runc v1.1.2 h1:2VSZwLx5k/BfsBxMMipG/LYUnmqOD/BPkIVgQUcTlLw=
Expand Down Expand Up @@ -577,6 +579,12 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.1.1 h1:Nbsts7DdKThRHHd+YNlqiGlRqGEF2bE2eXN+xQ1hsEs=
github.com/zeebo/blake3 v0.1.1/go.mod h1:G9pM4qQwjRzF1/v7+vabMj/c5mWpGZ2Wzo3Eb4z0pb4=
github.com/zeebo/pcg v1.0.0 h1:dt+dx+HvX8g7Un32rY9XWoYnd0NmKmrIzpHF7qiTDj0=
github.com/zeebo/pcg v1.0.0/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.mozilla.org/gopgagent v0.0.0-20170926210634-4d7ea76ff71a h1:N7VD+PwpJME2ZfQT8+ejxwA4Ow10IkGbU0MGf94ll8k=
go.mozilla.org/gopgagent v0.0.0-20170926210634-4d7ea76ff71a/go.mod h1:YDKUvO0b//78PaaEro6CAPH6NqohCmL2Cwju5XI2HoE=
go.mozilla.org/sops/v3 v3.7.3 h1:CYx02LnWTATWv6NqWJIt4JCKVKSnGV+MsRiDpvwWQhg=
Expand Down Expand Up @@ -743,6 +751,7 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201014080544-cc95f250f6bc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
Expand Down

0 comments on commit 9da4652

Please sign in to comment.