Take a module in from the builder's done key of its trunk fingerprint: one record of the key's artifacts, its manifest judged against the catalogue trunk's predefined keys (issue 1851, A3, A4b, A4c)

2026-10-22 19:05:04 +02:00
parent f00b6aff8b
commit d984f0a55d
19 changed files with 1907 additions and 27 deletions
@@ -0,0 +1,57 @@
+package artifacts
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+// blobBound is the most GetBlob reads: a templates archive is a few kilobytes; anything near this is no archive a
+// take-in reads text from.
+const blobBound = 64 << 20
+
+// GetBlob is the archive a recorded reference names (`artifact-store://<repository>/blobs/sha256:<hex>`), read whole
+// and checked against the digest it names: bytes that hash to another digest are refused, never read (R4e: the
+// controller reads a templates archive by the reference of a builder's done key). Gone when the store does not hold
+// it; ErrNotOurs for a reference outside the store or one that is not an archive.
+func (s Store) GetBlob(ctx context.Context, reference string) ([]byte, error) {
+	repository, digest, archive, err := s.archive(reference)
+	if err != nil {
+		return nil, err
+	}
+	if !archive {
+		return nil, fmt.Errorf("%w: %s is not an archive", ErrNotOurs, reference)
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, s.url(repository, "blobs", digest), nil)
+	if err != nil {
+		return nil, err
+	}
+	response, err := s.client().Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
+	}
+	defer response.Body.Close()
+	switch response.StatusCode {
+	case http.StatusOK:
+	case http.StatusNotFound:
+		return nil, Gone
+	default:
+		return nil, fmt.Errorf("the artifact store answered %s for %s/blobs/%s", response.Status, repository, digest)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, blobBound+1))
+	if err != nil {
+		return nil, fmt.Errorf("reading %s/blobs/%s: %w", repository, digest, err)
+	}
+	if len(body) > blobBound {
+		return nil, fmt.Errorf("%s/blobs/%s is larger than %d bytes, which no archive read here is", repository, digest, blobBound)
+	}
+	sum := sha256.Sum256(body)
+	if got := "sha256:" + hex.EncodeToString(sum[:]); got != digest {
+		return nil, fmt.Errorf("the artifact store answered %s/blobs/%s with bytes of the digest %s: refused", repository,
+			digest, got)
+	}
+	return body, nil
+}
@@ -0,0 +1,44 @@
+package artifacts
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// A take-in reads a templates archive by its reference, and only bytes of the digest the reference names.
+func TestGetBlobReadsOnlyTheBytesOfItsDigest(t *testing.T) {
+	good := []byte("the archive")
+	sum := sha256.Sum256(good)
+	digest := "sha256:" + hex.EncodeToString(sum[:])
+	liar := "sha256:" + strings.Repeat("0", 64)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/x/files/blobs/"+digest), strings.HasSuffix(r.URL.Path, "/x/files/blobs/"+liar):
+			_, _ = w.Write(good)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+	s := Store{Address: strings.TrimPrefix(server.URL, "http://")}
+	ctx := context.Background()
+	body, err := s.GetBlob(ctx, "artifact-store://x/files/blobs/"+digest)
+	if err != nil || string(body) != string(good) {
+		t.Fatalf("the archive: %q %v", body, err)
+	}
+	if _, err := s.GetBlob(ctx, "artifact-store://x/files/blobs/"+liar); err == nil || !strings.Contains(err.Error(), "refused") {
+		t.Fatalf("bytes of another digest are read: %v", err)
+	}
+	if _, err := s.GetBlob(ctx, "artifact-store://x/other/blobs/"+digest); !errors.Is(err, Gone) {
+		t.Fatalf("a blob the store does not hold: %v", err)
+	}
+	if _, err := s.GetBlob(ctx, "registry.example/x@"+digest); !errors.Is(err, ErrNotOurs) {
+		t.Fatalf("a reference outside the store: %v", err)
+	}
+}
@@ -23,6 +23,7 @@ import (

 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-controller/internal/buildreads"
 )

 // Turning a repository into artifacts the mesh can pin.
@@ -2001,33 +2002,9 @@ func instructions(recipe string) []string {
 	return out
 }

-// readBy is every repository other than the module's own that this build's recipes read source from,
-// each once and in a fixed order, so two builds of one commit report the same thing the same way.
-func readBy(manifest catalogue.Manifest) []catalogue.ArtifactContext {
-	if manifest.Build == nil {
-		return nil
-	}
-	seen := map[string]bool{}
-	var out []catalogue.ArtifactContext
-	for _, a := range manifest.Build.Artifacts {
-		if a.Context == nil || a.Context.Repository == "" {
-			continue
-		}
-		key := a.Context.Repository + "#" + a.Context.Ref
-		if seen[key] {
-			continue
-		}
-		seen[key] = true
-		out = append(out, *a.Context)
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Repository != out[j].Repository {
-			return out[i].Repository < out[j].Repository
-		}
-		return out[i].Ref < out[j].Ref
-	})
-	return out
-}
+// readBy is every repository other than the module's own that this build's recipes read source from: the rule
+// build-agent and the controller share (internal/buildreads).
+func readBy(manifest catalogue.Manifest) []catalogue.ArtifactContext { return buildreads.Of(manifest) }

 // binaryName is what a compiled bundle's executable is called: what the artifact says, or the name of
 // the package it is built from, which is what a compiler would have chosen anyway.
@@ -0,0 +1,39 @@
+// Package buildreads is which repositories other than a module's own its build reads source from, as its manifest
+// names them (novox/hq 04-ISSUES/131): the artifacts' `context` repositories. One rule for build-agent, which says it
+// in a build's outcome, and for the controller, which reads it from a done key's manifest (R4e, issue 1851): it lives
+// here, not in internal/builder, so it outlasts build-agent (R4g).
+package buildreads
+
+import (
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Of is every repository other than the module's own that this build's recipes read source from, each once and in a
+// fixed order, so two builds of one commit report the same thing the same way.
+func Of(manifest catalogue.Manifest) []catalogue.ArtifactContext {
+	if manifest.Build == nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	var out []catalogue.ArtifactContext
+	for _, a := range manifest.Build.Artifacts {
+		if a.Context == nil || a.Context.Repository == "" {
+			continue
+		}
+		key := a.Context.Repository + "#" + a.Context.Ref
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, *a.Context)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Repository != out[j].Repository {
+			return out[i].Repository < out[j].Repository
+		}
+		return out[i].Ref < out[j].Ref
+	})
+	return out
+}