A builder: a repository becomes artifacts the mesh can pin
It runs on a node, not in the control plane. Building needs a container runtime and a working tree, and the control plane deliberately cannot run commands on a machine — what it may send is bounded by the declaration language, and "run this build" is not in it. So the builder is something a node runs as a module, given work over the broker like anything else. The alternative, the control plane holding a docker socket, would make it the one component that can do anything anywhere, which is the property the whole design is arranged to avoid. A module repository has one file at its root, module.json, saying what it is and what it builds. A convention somebody can look for beats a setting somebody has to find. Properties that are decisions rather than details: - a fresh clone every time. A build reusing a working tree can succeed because of something a previous build left behind, and that is a build nobody can reproduce. - archives are packed deterministically — sorted, and carrying no timestamps, uid, gid or original names. Two builds of one commit must produce one digest, or nothing downstream can tell "this changed" from "this was built again", and every rebuild looks like a change to every machine holding it. - nothing is published until everything is built. Half a module in the store under a digest the mesh never records is reachable, unreferenced, and indistinguishable from something in use. The reproducibility test was passing for the wrong reason: both builds landed in the same second, so a packer carrying timestamps would still have agreed. It now stamps the two trees a year apart, and a timestamp in the header breaks it. One line is honest about not being independently tested: the sort before packing is belt and braces over filepath.Walk's documented lexical order, and no injection can distinguish it.
This commit is contained in:
@@ -0,0 +1,228 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-control/internal/catalogue"
|
||||
)
|
||||
|
||||
// A repository becoming artifacts the mesh can pin.
|
||||
//
|
||||
// git and docker are injected rather than run, because what is under test is the ORDER and the
|
||||
// refusals — that nothing is published until everything is built, that a build reads only its own
|
||||
// tree, that two builds of one commit produce one digest. Running docker here would test docker.
|
||||
|
||||
type recorded struct {
|
||||
ran []string
|
||||
images map[string]string
|
||||
archives map[string]string
|
||||
failPush bool
|
||||
// contents is what a clone of this repository lands, so the fake clone can restore the tree
|
||||
// Build deliberately removes first.
|
||||
contents map[string]string
|
||||
// stamped is the modification time the clone gives every file. Set differently between two
|
||||
// builds of one commit, because otherwise both land in the same second and a packer that
|
||||
// carried timestamps would still produce one digest — which is a test that passes for a
|
||||
// reason that has nothing to do with what it claims.
|
||||
stamped time.Time
|
||||
}
|
||||
|
||||
func (r *recorded) run(_ context.Context, dir, name string, args ...string) (string, error) {
|
||||
line := name + " " + strings.Join(args, " ")
|
||||
r.ran = append(r.ran, line)
|
||||
switch {
|
||||
case name == "git" && len(args) > 0 && args[0] == "clone":
|
||||
tree := args[len(args)-1]
|
||||
if err := os.MkdirAll(tree, 0o755); err != nil {
|
||||
return "", err
|
||||
}
|
||||
for path, body := range r.contents {
|
||||
full := filepath.Join(tree, path)
|
||||
if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.WriteFile(full, []byte(body), 0o644); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if !r.stamped.IsZero() {
|
||||
if err := os.Chtimes(full, r.stamped, r.stamped); err != nil {
|
||||
return "", err
|
||||
}
|
||||
}
|
||||
}
|
||||
return "", nil
|
||||
case name == "git" && len(args) > 0 && args[0] == "rev-parse":
|
||||
return "c0ffeec0ffeec0ffeec0ffeec0ffeec0ffeec0ff\n", nil
|
||||
}
|
||||
_ = dir
|
||||
return "", nil
|
||||
}
|
||||
|
||||
func (r *recorded) PublishImage(_ context.Context, localTag, repository string) (string, error) {
|
||||
if r.failPush {
|
||||
return "", os.ErrPermission
|
||||
}
|
||||
if r.images == nil {
|
||||
r.images = map[string]string{}
|
||||
}
|
||||
r.images[repository] = localTag
|
||||
return "registry.invalid/" + repository + "@sha256:" + strings.Repeat("a", 64), nil
|
||||
}
|
||||
|
||||
func (r *recorded) PublishArchive(_ context.Context, repository string, body []byte, digest string) (string, error) {
|
||||
if r.failPush {
|
||||
return "", os.ErrPermission
|
||||
}
|
||||
if r.archives == nil {
|
||||
r.archives = map[string]string{}
|
||||
}
|
||||
r.archives[repository] = digest
|
||||
_ = body
|
||||
return "https://store.invalid/" + repository, nil
|
||||
}
|
||||
|
||||
// aRepository is a workspace whose clone lands a manifest and some files.
|
||||
func aRepository(t *testing.T, manifest string, files map[string]string) (*recorded, string) {
|
||||
t.Helper()
|
||||
contents := map[string]string{ManifestName: manifest}
|
||||
for name, body := range files {
|
||||
contents[name] = body
|
||||
}
|
||||
return &recorded{contents: contents}, t.TempDir()
|
||||
}
|
||||
|
||||
const withBoth = `{"module":"meshboard","version":"1",
|
||||
"build":{"artifacts":[
|
||||
{"name":"server","kind":"image","from":"Dockerfile"},
|
||||
{"name":"look","kind":"archive","from":"files"}]},
|
||||
"resources":[
|
||||
{"id":"svc","type":"container","name":"meshboard","artifact":"server"},
|
||||
{"id":"theme","type":"archive","path":"/opt/meshboard","artifact":"look"}]}`
|
||||
|
||||
func TestABuildProducesAManifestThePinsAreIn(t *testing.T) {
|
||||
r, workspace := aRepository(t, withBoth, map[string]string{
|
||||
"Dockerfile": "FROM scratch", "files/theme.conf": "dark",
|
||||
})
|
||||
got, err := Build(context.Background(), r.run, r, "https://forge.invalid/meshboard.git", "", workspace)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got.Commit != "c0ffeec0ffeec0ffeec0ffeec0ffeec0ffeec0ff" {
|
||||
t.Fatalf("the commit was not recorded: %q", got.Commit)
|
||||
}
|
||||
if got.Manifest.Resources[0]["image"] == nil {
|
||||
t.Fatalf("the image was not pinned: %v", got.Manifest.Resources[0])
|
||||
}
|
||||
digest, _ := got.Manifest.Resources[1]["digest"].(string)
|
||||
if !strings.HasPrefix(digest, "sha256:") {
|
||||
t.Fatalf("the archive was not pinned: %v", got.Manifest.Resources[1])
|
||||
}
|
||||
}
|
||||
|
||||
func TestTwoBuildsOfOneCommitProduceOneDigest(t *testing.T) {
|
||||
// Or nothing downstream can tell "this changed" from "this was built again", and every
|
||||
// rebuild looks like a change to every machine holding it.
|
||||
var digests []string
|
||||
for i := 0; i < 2; i++ {
|
||||
r, workspace := aRepository(t, withBoth, map[string]string{
|
||||
"Dockerfile": "FROM scratch", "files/a.conf": "one", "files/b.conf": "two",
|
||||
})
|
||||
// A year apart, so a packer carrying timestamps cannot accidentally agree.
|
||||
r.stamped = time.Date(2020+i, time.March, 3, 4, 5, 6, 0, time.UTC)
|
||||
got, err := Build(context.Background(), r.run, r, "https://forge.invalid/x.git", "", workspace)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, b := range got.Built {
|
||||
if b.Kind == catalogue.ArtifactArchive {
|
||||
digests = append(digests, b.Digest)
|
||||
}
|
||||
}
|
||||
}
|
||||
if digests[0] != digests[1] {
|
||||
t.Fatalf("two builds of one commit produced %s and %s", digests[0], digests[1])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNothingIsPublishedUntilEverythingIsBuilt(t *testing.T) {
|
||||
// Half a module in the store under a digest the mesh never records is reachable,
|
||||
// unreferenced, and indistinguishable from something in use.
|
||||
r, workspace := aRepository(t, withBoth, map[string]string{"Dockerfile": "FROM scratch"})
|
||||
// `files` is missing, so packing the archive fails — after the image would have been pushed.
|
||||
_, err := Build(context.Background(), r.run, r, "https://forge.invalid/x.git", "", workspace)
|
||||
if err == nil {
|
||||
t.Fatal("a build with a missing input succeeded")
|
||||
}
|
||||
if len(r.archives) != 0 {
|
||||
t.Fatalf("an archive was published by a failed build: %v", r.archives)
|
||||
}
|
||||
}
|
||||
|
||||
func TestARepositoryWithNoManifestSaysSo(t *testing.T) {
|
||||
workspace := t.TempDir()
|
||||
r := &recorded{contents: map[string]string{"README.md": "nothing to see"}}
|
||||
_, err := Build(context.Background(), r.run, r, "https://forge.invalid/x.git", "", workspace)
|
||||
if err == nil {
|
||||
t.Fatal("a repository with nothing saying what it is was built")
|
||||
}
|
||||
if !strings.Contains(err.Error(), ManifestName) {
|
||||
t.Fatalf("the failure does not name what is missing: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAModuleThatBuildsNothingStillProducesAManifest(t *testing.T) {
|
||||
// Most of what a person installs is configuration.
|
||||
r, workspace := aRepository(t, `{"module":"shell","version":"1","resources":[
|
||||
{"id":"rc","type":"file","path":"/etc/zsh/zshrc","content":"setopt"}]}`, nil)
|
||||
got, err := Build(context.Background(), r.run, r, "https://forge.invalid/shell.git", "", workspace)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(got.Built) != 0 {
|
||||
t.Fatalf("something was built: %v", got.Built)
|
||||
}
|
||||
if got.Manifest.Module != "shell" || len(got.Manifest.Resources) != 1 {
|
||||
t.Fatalf("got %+v", got.Manifest)
|
||||
}
|
||||
for _, line := range r.ran {
|
||||
if strings.HasPrefix(line, "docker") {
|
||||
t.Fatalf("docker was run for a module that builds nothing: %q", line)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheTreeIsFreshEveryTime(t *testing.T) {
|
||||
// A build that reuses a working tree can succeed because of something a previous build left
|
||||
// behind, and that is a build nobody can reproduce.
|
||||
r, workspace := aRepository(t, withBoth, map[string]string{
|
||||
"Dockerfile": "FROM scratch", "files/a": "b",
|
||||
})
|
||||
leftover := filepath.Join(workspace, "source", "files", "from-last-time")
|
||||
if err := os.MkdirAll(filepath.Dir(leftover), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(leftover, []byte("stale"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := Build(context.Background(), r.run, r, "https://forge.invalid/x.git", "", workspace); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := os.Stat(leftover); err == nil {
|
||||
t.Fatal("a previous build's file survived into this one")
|
||||
}
|
||||
}
|
||||
|
||||
func TestABuildThatCannotPushFails(t *testing.T) {
|
||||
r, workspace := aRepository(t, withBoth, map[string]string{
|
||||
"Dockerfile": "FROM scratch", "files/a": "b",
|
||||
})
|
||||
r.failPush = true
|
||||
if _, err := Build(context.Background(), r.run, r, "https://forge.invalid/x.git", "", workspace); err == nil {
|
||||
t.Fatal("a build that could publish nothing reported success")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user