Fetch a declaration's files given by digest from the bus's object bucket, verify them and report file-references (issue 1695, ADR 0486)

mesh-sdk is pinned to fix/1694-file-references 6c857e1c025f until it merges.

cmd/mesh-host/file_references_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+	"github.com/novox/mesh-host/internal/link"
+)
+
+// aFilesLink is a link that serves objects by name.
+type aFilesLink struct{ objects map[string][]byte }
+
+func (a aFilesLink) FileObject(_ context.Context, name string, _ int64) ([]byte, error) {
+	if b, ok := a.objects[name]; ok {
+		return b, nil
+	}
+	return nil, os.ErrNotExist
+}
+
+func referenceDeclaration(path string, body []byte) []byte {
+	return []byte(`{"declaration":1,"resources":[{"id":"m.big","type":"file","path":"` + path + `","digest":"` +
+		declaration.DigestOf(body) + `","size":` + strconv.Itoa(len(body)) + `}]}`)
+}
+
+// 1695/AC1 and AC2, through the whole apply: a reference is fetched, verified and written; a differing object
+// refuses the declaration whole and writes nothing.
+func TestADeclarationWithAFileByDigestAppliesFromTheObject(t *testing.T) {
+	unansweringPacman(t)
+	body := []byte(strings.Repeat("a line of a big file\n", 4000))
+	name, _ := declaration.ObjectName(declaration.DigestOf(body))
+	dir := t.TempDir()
+	target := filepath.Join(dir, "big")
+	opts := options{state: filepath.Join(dir, "state.json"), out: &strings.Builder{}}
+	raw := referenceDeclaration(target, body)
+
+	bad := append([]byte(nil), body...)
+	bad[10] ^= 1
+	ctx := link.WithFiles(context.Background(), aFilesLink{map[string][]byte{name: bad}})
+	report := applyAndKeep(ctx, opts, raw, nil, nil, nil)
+	if report.Refused == "" || !strings.Contains(report.Refused, "m.big") {
+		t.Errorf("1695/AC2: a differing object did not refuse the declaration: %+v", report)
+	}
+	if _, err := os.Stat(target); err == nil {
+		t.Error("1695/AC2: a file was written from an object that differs")
+	}
+
+	ctx = link.WithFiles(context.Background(), aFilesLink{map[string][]byte{name: body}})
+	report = applyAndKeep(ctx, opts, raw, nil, nil, nil)
+	if report.Refused != "" {
+		t.Fatalf("1695/AC1: refused: %s", report.Refused)
+	}
+	got, err := os.ReadFile(target)
+	if err != nil || string(got) != string(body) {
+		t.Errorf("1695/AC1: the file holds %d bytes (%v), want %d", len(got), err, len(body))
+	}
+}

cmd/mesh-host/main.go

@@ -2070,6 +2070,13 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 		return link.Report{Refused: err.Error()}
 	}
 	order := link.Order{Epoch: declared.Epoch, Sequence: declared.Sequence}
+	// **A file given by digest is fetched and verified before anything of the declaration is applied** (novox/hq ADR
+	// 0486 §1, issue 1695): one object missing or differing refuses the declaration whole. The signed bytes are what is
+	// kept; only what is applied has the content in place of the reference.
+	if err := apply.ResolveFileReferences(ctx, declared, link.FilesFrom(ctx)); err != nil {
+		return link.Report{Declared: digestOf(raw), Order: order,
+			Refused: "a file of this declaration could not be had by its digest: " + err.Error()}
+	}
 
 	// **Older than what this node applied is refused, before anything is read from the machine**
 	// (novox/hq to-be 45 §6, ADR 0227 rule 2): a controller that lost its lease and goes on sending.