269 lines
8.5 KiB
Go
269 lines
8.5 KiB
Go
package submit
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"syscall"
|
|
"testing"
|
|
)
|
|
|
|
func TestLocalContextStorePutAndExists(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
|
|
if ok, err := s.Exists(ctx, "sub-abc"); err != nil || ok {
|
|
t.Fatalf("Exists before Put = (%v, %v), want (false, nil)", ok, err)
|
|
}
|
|
|
|
payload := "\x1f\x8b\x08\x00the modpack context"
|
|
n, err := s.Put(ctx, "sub-abc", strings.NewReader(payload))
|
|
if err != nil {
|
|
t.Fatalf("Put: %v", err)
|
|
}
|
|
if n != int64(len(payload)) {
|
|
t.Fatalf("Put returned %d bytes, want %d", n, len(payload))
|
|
}
|
|
|
|
// The blob lands at exactly {base}/{id}/context.tar.gz — where deriveContextRef
|
|
// points Kaniko's --context.
|
|
dest := filepath.Join(base, "sub-abc", contextBlobName)
|
|
got, err := os.ReadFile(dest)
|
|
if err != nil {
|
|
t.Fatalf("read stored blob: %v", err)
|
|
}
|
|
if string(got) != payload {
|
|
t.Fatalf("stored %q, want %q", got, payload)
|
|
}
|
|
if ok, err := s.Exists(ctx, "sub-abc"); err != nil || !ok {
|
|
t.Fatalf("Exists after Put = (%v, %v), want (true, nil)", ok, err)
|
|
}
|
|
|
|
// The write is atomic: no leftover temp files beside the committed blob.
|
|
entries, err := os.ReadDir(filepath.Join(base, "sub-abc"))
|
|
if err != nil {
|
|
t.Fatalf("read dir: %v", err)
|
|
}
|
|
if len(entries) != 1 || entries[0].Name() != contextBlobName {
|
|
var names []string
|
|
for _, e := range entries {
|
|
names = append(names, e.Name())
|
|
}
|
|
t.Fatalf("dir entries = %v, want only %q (no temp files)", names, contextBlobName)
|
|
}
|
|
}
|
|
|
|
// Open is the internal context-fetch route's read path: it serves exactly the
|
|
// stored bytes, and a missing blob is ErrBlobNotFound (404), never a bare os error.
|
|
func TestLocalContextStoreOpen(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
|
|
if _, err := s.Open(ctx, "sub-gone"); !errors.Is(err, ErrBlobNotFound) {
|
|
t.Fatalf("Open of a missing blob = %v, want ErrBlobNotFound", err)
|
|
}
|
|
|
|
payload := "\x1f\x8b\x08\x00the modpack context"
|
|
if _, err := s.Put(ctx, "sub-abc", strings.NewReader(payload)); err != nil {
|
|
t.Fatalf("Put: %v", err)
|
|
}
|
|
rc, err := s.Open(ctx, "sub-abc")
|
|
if err != nil {
|
|
t.Fatalf("Open: %v", err)
|
|
}
|
|
defer rc.Close()
|
|
got, err := io.ReadAll(rc)
|
|
if err != nil {
|
|
t.Fatalf("read: %v", err)
|
|
}
|
|
if string(got) != payload {
|
|
t.Fatalf("Open served %q, want %q", got, payload)
|
|
}
|
|
// The same path guard as Put: an id that could escape Base is refused.
|
|
if _, err := s.Open(ctx, "../etc/passwd"); err == nil {
|
|
t.Fatal("Open must reject an unsafe id")
|
|
}
|
|
}
|
|
|
|
func TestLocalContextStorePutOverwrites(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
|
|
if _, err := s.Put(ctx, "sub-1", strings.NewReader("\x1f\x8bfirst")); err != nil {
|
|
t.Fatalf("first Put: %v", err)
|
|
}
|
|
if _, err := s.Put(ctx, "sub-1", strings.NewReader("\x1f\x8bsecond upload")); err != nil {
|
|
t.Fatalf("second Put: %v", err)
|
|
}
|
|
got, err := os.ReadFile(filepath.Join(base, "sub-1", contextBlobName))
|
|
if err != nil {
|
|
t.Fatalf("read: %v", err)
|
|
}
|
|
if string(got) != "\x1f\x8bsecond upload" {
|
|
t.Fatalf("stored %q, want the second upload (a re-upload supersedes)", got)
|
|
}
|
|
}
|
|
|
|
// Put flushes the new bytes to disk before the rename publishes them, then the
|
|
// directory entries the rename and a first upload's mkdir wrote. A crash at any
|
|
// point leaves the previous blob or the whole new one, never an empty file behind
|
|
// a digest the database already recorded.
|
|
func TestLocalContextStorePutFlushesAroundTheRename(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
blob := filepath.Join(base, "sub-abc", contextBlobName)
|
|
var synced []string
|
|
s.sync = func(f *os.File) error {
|
|
name := f.Name()
|
|
if strings.HasSuffix(name, ".tmp") {
|
|
name = "temp"
|
|
}
|
|
published := "none"
|
|
if b, err := os.ReadFile(blob); err == nil {
|
|
published = string(b)
|
|
}
|
|
synced = append(synced, name+" published="+published)
|
|
return f.Sync()
|
|
}
|
|
|
|
if _, err := s.Put(context.Background(), "sub-abc", strings.NewReader("\x1f\x8bbytes")); err != nil {
|
|
t.Fatalf("Put: %v", err)
|
|
}
|
|
want := []string{
|
|
"temp published=none",
|
|
filepath.Join(base, "sub-abc") + " published=\x1f\x8bbytes",
|
|
base + " published=\x1f\x8bbytes",
|
|
}
|
|
if strings.Join(synced, "\n") != strings.Join(want, "\n") {
|
|
t.Fatalf("flushes =\n%q\nwant\n%q", synced, want)
|
|
}
|
|
}
|
|
|
|
// A flush that fails refuses the upload. Before the rename the previous context
|
|
// stays in place and no temp file is left; after it the new bytes are in place
|
|
// but not promised, so the error still reaches the caller. A filesystem that
|
|
// cannot sync a directory at all has no stronger promise to give.
|
|
func TestLocalContextStorePutFlushFailures(t *testing.T) {
|
|
boom := errors.New("disk said no")
|
|
for _, tc := range []struct {
|
|
name string
|
|
fail func(f *os.File) error
|
|
wantErr error
|
|
want string
|
|
}{
|
|
{"file", func(f *os.File) error {
|
|
if strings.HasSuffix(f.Name(), ".tmp") {
|
|
return boom
|
|
}
|
|
return nil
|
|
}, boom, "\x1f\x8bold"},
|
|
{"directory", func(f *os.File) error {
|
|
if strings.HasSuffix(f.Name(), ".tmp") {
|
|
return nil
|
|
}
|
|
return boom
|
|
}, boom, "\x1f\x8bnew"},
|
|
{"directory sync invalid", func(f *os.File) error {
|
|
if strings.HasSuffix(f.Name(), ".tmp") {
|
|
return nil
|
|
}
|
|
return &os.PathError{Op: "sync", Path: f.Name(), Err: syscall.EINVAL}
|
|
}, nil, "\x1f\x8bnew"},
|
|
{"directory sync not supported", func(f *os.File) error {
|
|
if strings.HasSuffix(f.Name(), ".tmp") {
|
|
return nil
|
|
}
|
|
return &os.PathError{Op: "sync", Path: f.Name(), Err: syscall.ENOTSUP}
|
|
}, nil, "\x1f\x8bnew"},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
if _, err := s.Put(ctx, "sub-abc", strings.NewReader("\x1f\x8bold")); err != nil {
|
|
t.Fatalf("first Put: %v", err)
|
|
}
|
|
s.sync = tc.fail
|
|
if _, err := s.Put(ctx, "sub-abc", strings.NewReader("\x1f\x8bnew")); !errors.Is(err, tc.wantErr) {
|
|
t.Fatalf("Put = %v, want %v", err, tc.wantErr)
|
|
}
|
|
got, err := os.ReadFile(filepath.Join(base, "sub-abc", contextBlobName))
|
|
if err != nil || string(got) != tc.want {
|
|
t.Fatalf("stored = %q, %v; want %q", got, err, tc.want)
|
|
}
|
|
entries, _ := os.ReadDir(filepath.Join(base, "sub-abc"))
|
|
if len(entries) != 1 {
|
|
t.Fatalf("dir holds %d entries, want only %s", len(entries), contextBlobName)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// Delete removes the blob and its id-namespaced directory, and is idempotent —
|
|
// the retry-safety the withdraw/delete cleanup depends on.
|
|
func TestLocalContextStoreDelete(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
|
|
if _, err := s.Put(ctx, "sub-abc", strings.NewReader("\x1f\x8bbytes")); err != nil {
|
|
t.Fatalf("Put: %v", err)
|
|
}
|
|
if err := s.Delete(ctx, "sub-abc"); err != nil {
|
|
t.Fatalf("Delete: %v", err)
|
|
}
|
|
if ok, err := s.Exists(ctx, "sub-abc"); err != nil || ok {
|
|
t.Fatalf("Exists after Delete = (%v, %v), want (false, nil)", ok, err)
|
|
}
|
|
if _, err := os.Stat(filepath.Join(base, "sub-abc")); !os.IsNotExist(err) {
|
|
t.Fatalf("per-submission dir still present after Delete (err=%v)", err)
|
|
}
|
|
// Idempotent: deleting nothing is success, so a retried cleanup cannot fail.
|
|
if err := s.Delete(ctx, "sub-abc"); err != nil {
|
|
t.Fatalf("second Delete = %v, want nil (idempotent)", err)
|
|
}
|
|
// The same path guard as Put/Open.
|
|
if err := s.Delete(ctx, "../etc"); err == nil {
|
|
t.Fatal("Delete must reject an unsafe id")
|
|
}
|
|
}
|
|
|
|
func TestLocalContextStoreRejectsUnsafeID(t *testing.T) {
|
|
base := t.TempDir()
|
|
s := &LocalContextStore{Base: base}
|
|
ctx := context.Background()
|
|
|
|
for _, id := range []string{"../evil", "sub/../../etc", "SUB-UPPER", "has space", "", "a/b"} {
|
|
if _, err := s.Put(ctx, id, strings.NewReader("\x1f\x8bx")); err == nil {
|
|
t.Errorf("Put(%q) succeeded, want rejection", id)
|
|
}
|
|
if _, err := s.Exists(ctx, id); err == nil {
|
|
t.Errorf("Exists(%q) succeeded, want rejection", id)
|
|
}
|
|
}
|
|
// Nothing escaped the base directory.
|
|
if _, err := os.Stat(filepath.Join(filepath.Dir(base), "evil")); !os.IsNotExist(err) {
|
|
t.Fatal("an unsafe id wrote outside Base")
|
|
}
|
|
}
|
|
|
|
func TestLocalContextStoreCheckRoom(t *testing.T) {
|
|
s := &LocalContextStore{Base: t.TempDir(), MinFree: 1e-9}
|
|
if err := s.CheckRoom(1); err != nil {
|
|
t.Fatalf("CheckRoom(1 byte) = %v", err)
|
|
}
|
|
if err := s.CheckRoom(1 << 62); !errors.Is(err, ErrUploadsFull) {
|
|
t.Fatalf("CheckRoom(4 EiB) = %v, want ErrUploadsFull", err)
|
|
}
|
|
s.MinFree = 1
|
|
if err := s.CheckRoom(0); !errors.Is(err, ErrUploadsFull) {
|
|
t.Fatalf("CheckRoom with a 100%% floor = %v, want ErrUploadsFull", err)
|
|
}
|
|
}
|