81 lines
2.3 KiB
Go
81 lines
2.3 KiB
Go
// Command images refuses any manifest but build-agent's declaring an artifact of kind `image`, an image built from a
|
|
// Dockerfile (novox/hq ADR 0452 clause 1, ADR 0480 clause 11 as ADR 0487 clause 13 changed it). From R4d a module
|
|
// runs a pinned upstream image with its programs mounted in; build-agent is the one builder that still builds an
|
|
// image until R4g, when the catalogue refuses the kind outright (issue 1619) and this check goes with it.
|
|
//
|
|
// go run . <catalogue root>
|
|
//
|
|
// Exits 1 on a finding.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"sort"
|
|
)
|
|
|
|
// Exempt is the one module still allowed to declare the kind, until R4g.
|
|
var Exempt = map[string]bool{"build-agent": true}
|
|
|
|
// Finding is one refusal: Module's artifact Artifact is an image built from a Dockerfile.
|
|
type Finding struct{ Module, Artifact string }
|
|
|
|
// Check reads every manifest under root/modules and answers what it refuses.
|
|
func Check(root string) ([]Finding, error) {
|
|
manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sort.Strings(manifests)
|
|
var out []Finding
|
|
for _, path := range manifests {
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var m struct {
|
|
Module string `json:"module"`
|
|
Build struct {
|
|
Artifacts []struct {
|
|
Name string `json:"name"`
|
|
Kind string `json:"kind"`
|
|
} `json:"artifacts"`
|
|
} `json:"build"`
|
|
}
|
|
if err := json.Unmarshal(raw, &m); err != nil {
|
|
return nil, fmt.Errorf("%s: %w", path, err)
|
|
}
|
|
if Exempt[m.Module] {
|
|
continue
|
|
}
|
|
for _, a := range m.Build.Artifacts {
|
|
if a.Kind == "image" {
|
|
out = append(out, Finding{Module: m.Module, Artifact: a.Name})
|
|
}
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func main() {
|
|
root := "."
|
|
if len(os.Args) > 1 {
|
|
root = os.Args[1]
|
|
}
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
os.Exit(1)
|
|
}
|
|
for _, f := range found {
|
|
fmt.Printf("%s declares the artifact %s as an image built from a Dockerfile: run a pinned upstream image with the "+
|
|
"module's programs mounted in (novox/hq ADR 0452 clause 1, ADR 0480 clause 11)\n", f.Module, f.Artifact)
|
|
}
|
|
if len(found) > 0 {
|
|
os.Exit(1)
|
|
}
|
|
fmt.Println("images: no module but build-agent builds an image from a Dockerfile")
|
|
}
|