93 lines
2.3 KiB
Go
93 lines
2.3 KiB
Go
// Command imagebuild refuses any manifest but modules/buildah providing the rootless-image-build provision
|
|
// (novox/hq ADR 0487 §3, issue 1704): the image builder's tool is buildah alone, and docker, whose daemon holds
|
|
// the machine's root, never stands in for it. A second provider would let a node compose mesh-build-image over
|
|
// something that is not the rootless builder it was designed against.
|
|
//
|
|
// go run . <catalogue root>
|
|
//
|
|
// Exits 1 on a finding.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"sort"
|
|
)
|
|
|
|
// Provision is the provision only Provider may provide.
|
|
const Provision = "rootless-image-build"
|
|
|
|
// Provider is the one module allowed to provide it.
|
|
const Provider = "buildah"
|
|
|
|
// Finding is one manifest refused: a module other than buildah providing the provision.
|
|
type Finding struct {
|
|
Module string
|
|
}
|
|
|
|
// Check reads every manifest under root/modules and answers which ones it refuses, and whether buildah provides.
|
|
func Check(root string) ([]Finding, error) {
|
|
manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sort.Strings(manifests)
|
|
var out []Finding
|
|
provided := false
|
|
for _, path := range manifests {
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var m struct {
|
|
Module string `json:"module"`
|
|
Provides []struct {
|
|
Name string `json:"name"`
|
|
} `json:"provides"`
|
|
}
|
|
if err := json.Unmarshal(raw, &m); err != nil {
|
|
return nil, fmt.Errorf("%s: %w", path, err)
|
|
}
|
|
for _, p := range m.Provides {
|
|
if p.Name != Provision {
|
|
continue
|
|
}
|
|
if m.Module == Provider {
|
|
provided = true
|
|
} else {
|
|
out = append(out, Finding{Module: m.Module})
|
|
}
|
|
break
|
|
}
|
|
}
|
|
if !provided {
|
|
out = append(out, Finding{Module: Provider})
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func main() {
|
|
root := "."
|
|
if len(os.Args) > 1 {
|
|
root = os.Args[1]
|
|
}
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
os.Exit(1)
|
|
}
|
|
for _, f := range found {
|
|
if f.Module == Provider {
|
|
fmt.Printf("%s does not provide %s (novox/hq ADR 0487 §3)\n", Provider, Provision)
|
|
continue
|
|
}
|
|
fmt.Printf("%s provides %s: only %s may, and docker never (novox/hq ADR 0487 §3)\n", f.Module, Provision, Provider)
|
|
}
|
|
if len(found) > 0 {
|
|
os.Exit(1)
|
|
}
|
|
fmt.Println("imagebuild: rootless-image-build is provided only by buildah")
|
|
}
|