Skip to content

Commit

Permalink
feat(checksum): support enforcing checksum verification via environme…
Browse files Browse the repository at this point in the history 
…nt variables
  • Loading branch information
@suzuki-shunsuke
suzuki-shunsuke committed Apr 5, 2024
1 parent 0dfa781 commit 9ee1891
Show file tree
Hide file tree
Showing 12 changed files with 99 additions and 68 deletions.
21 changes: 21 additions & 0 deletions pkg/cli/runner.go
View file
Expand Up @@ -110,13 +110,34 @@ func (r *Runner) setParam(c *cli.Context, commandName string, param *config.Para
}
}
}
if a := os.Getenv("AQUA_CHECKSUM"); a != "" {
chksm, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_CHECKSUM as bool: %w", err)
}
param.Checksum = chksm
}
if a := os.Getenv("AQUA_REQUIRE_CHECKSUM"); a != "" {
requireChecksum, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_REQUIRE_CHECKSUM as bool: %w", err)
}
param.RequireChecksum = requireChecksum
}
if a := os.Getenv("AQUA_ENFORCE_CHECKSUM"); a != "" {
chksm, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_ENFORCE_CHECKSUM as bool: %w", err)
}
param.EnforceChecksum = chksm
}
if a := os.Getenv("AQUA_ENFORCE_REQUIRE_CHECKSUM"); a != "" {
requireChecksum, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_ENFORCE_REQUIRE_CHECKSUM as bool: %w", err)
}
param.EnforceRequireChecksum = requireChecksum
}
return nil
}

Expand Down
14 changes: 10 additions & 4 deletions pkg/config/aqua/checksum.go
View file
Expand Up @@ -2,14 +2,20 @@ package aqua

import "github.com/aquaproj/aqua/v2/pkg/config/registry"

func (c *Config) ChecksumEnabled() bool {
if c == nil {
return false
func (c *Config) ChecksumEnabled(enforceValue, defValue bool) bool {
if enforceValue {
return true
}
if c == nil || c.Checksum == nil || c.Checksum.Enabled == nil {
return defValue
}
return c.Checksum.GetEnabled()
}

func (c *Config) RequireChecksum(defValue bool) bool {
func (c *Config) RequireChecksum(enforceValue, defValue bool) bool {
if enforceValue {
return true
}
if c == nil || c.Checksum == nil || c.Checksum.RequireChecksum == nil {
return defValue
}
Expand Down
83 changes: 43 additions & 40 deletions pkg/config/package.go
View file
Expand Up @@ -240,46 +240,49 @@ const (
)

type Param struct {
GlobalConfigFilePaths []string
ConfigFilePath string
LogLevel string
File string
AQUAVersion string
AquaCommitHash string
RootDir string
PWD string
InsertFile string
LogColor string
Dest string
HomeDir string
OutTestData string
Limit int
MaxParallelism int
Args []string
Tags map[string]struct{}
ExcludedTags map[string]struct{}
DisableLazyInstall bool
OnlyLink bool
All bool
Global bool
Insert bool
SelectVersion bool
ShowVersion bool
ProgressBar bool
Deep bool
SkipLink bool
Pin bool
Prune bool
RequireChecksum bool
DisablePolicy bool
Detail bool
OnlyPackage bool
OnlyRegistry bool
CosignDisabled bool
SLSADisabled bool
Installed bool
PolicyConfigFilePaths []string
Commands []string
GlobalConfigFilePaths []string
ConfigFilePath string
LogLevel string
File string
AQUAVersion string
AquaCommitHash string
RootDir string
PWD string
InsertFile string
LogColor string
Dest string
HomeDir string
OutTestData string
Limit int
MaxParallelism int
Args []string
Tags map[string]struct{}
ExcludedTags map[string]struct{}
DisableLazyInstall bool
OnlyLink bool
All bool
Global bool
Insert bool
SelectVersion bool
ShowVersion bool
ProgressBar bool
Deep bool
SkipLink bool
Pin bool
Prune bool
Checksum bool
RequireChecksum bool
EnforceChecksum bool
EnforceRequireChecksum bool
DisablePolicy bool
Detail bool
OnlyPackage bool
OnlyRegistry bool
CosignDisabled bool
SLSADisabled bool
Installed bool
PolicyConfigFilePaths []string
Commands []string
}

func appendExt(s, format string) string {
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/cp/install.go
View file
Expand Up @@ -16,7 +16,7 @@ import (

func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult *which.FindResult, policyConfigs []*policy.Config, param *config.Param) error {
var checksums *checksum.Checksums
if findResult.Config.ChecksumEnabled() {
if findResult.Config.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, findResult.ConfigFilePath)
if err != nil {
Expand All @@ -35,7 +35,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult
if err := c.packageInstaller.InstallPackage(ctx, logE, &installpackage.ParamInstallPackage{
Pkg: findResult.Package,
Checksums: checksums,
RequireChecksum: findResult.Config.RequireChecksum(c.requireChecksum),
RequireChecksum: findResult.Config.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
ConfigFileDir: filepath.Dir(findResult.ConfigFilePath),
PolicyConfigs: policyConfigs,
DisablePolicy: param.DisablePolicy,
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/exec/exec.go
View file
Expand Up @@ -66,7 +66,7 @@ func (c *Controller) Exec(ctx context.Context, logE *logrus.Entry, param *config

func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult *which.FindResult, policies []*policy.Config, param *config.Param) error {
var checksums *checksum.Checksums
if findResult.Config.ChecksumEnabled() {
if findResult.Config.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, findResult.ConfigFilePath)
if err != nil {
Expand All @@ -85,7 +85,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult
if err := c.packageInstaller.InstallPackage(ctx, logE, &installpackage.ParamInstallPackage{
Pkg: findResult.Package,
Checksums: checksums,
RequireChecksum: findResult.Config.RequireChecksum(c.requireChecksum),
RequireChecksum: findResult.Config.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
PolicyConfigs: policies,
DisablePolicy: param.DisablePolicy,
}); err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/generate/generate.go
View file
Expand Up @@ -73,7 +73,7 @@ func (c *Controller) getConfigFile(param *config.Param) (string, error) {

func (c *Controller) listPkgs(ctx context.Context, logE *logrus.Entry, param *config.Param, cfg *aqua.Config, cfgFilePath string, args ...string) ([]*aqua.Package, error) {
var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/install/install.go
View file
Expand Up @@ -95,7 +95,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, cfgFilePat
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/list/list.go
View file
Expand Up @@ -25,7 +25,7 @@ func (c *Controller) List(ctx context.Context, param *config.Param, logE *logrus
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/remove/remove.go
View file
Expand Up @@ -53,7 +53,7 @@ func (c *Controller) Remove(ctx context.Context, logE *logrus.Entry, param *conf
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/update/update.go
View file
Expand Up @@ -80,7 +80,7 @@ func (c *Controller) update(ctx context.Context, logE *logrus.Entry, param *conf
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
8 changes: 4 additions & 4 deletions pkg/controller/which/which.go
View file
Expand Up @@ -23,7 +23,7 @@ type FindResult struct {

func (c *Controller) Which(ctx context.Context, logE *logrus.Entry, param *config.Param, exeName string) (*FindResult, error) {
for _, cfgFilePath := range c.configFinder.Finds(param.PWD, param.ConfigFilePath) {
findResult, err := c.findExecFile(ctx, logE, cfgFilePath, exeName)
findResult, err := c.findExecFile(ctx, logE, param, cfgFilePath, exeName)
if err != nil {
return nil, err
}
Expand All @@ -38,7 +38,7 @@ func (c *Controller) Which(ctx context.Context, logE *logrus.Entry, param *confi
if _, err := c.fs.Stat(cfgFilePath); err != nil {
continue
}
findResult, err := c.findExecFile(ctx, logE, cfgFilePath, exeName)
findResult, err := c.findExecFile(ctx, logE, param, cfgFilePath, exeName)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -67,14 +67,14 @@ func (c *Controller) getExePath(findResult *FindResult) (string, error) {
return pkg.ExePath(c.rootDir, file, c.runtime) //nolint:wrapcheck
}

func (c *Controller) findExecFile(ctx context.Context, logE *logrus.Entry, cfgFilePath, exeName string) (*FindResult, error) {
func (c *Controller) findExecFile(ctx context.Context, logE *logrus.Entry, param *config.Param, cfgFilePath, exeName string) (*FindResult, error) {
cfg := &aqua.Config{}
if err := c.configReader.Read(cfgFilePath, cfg); err != nil {
return nil, err //nolint:wrapcheck
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
23 changes: 12 additions & 11 deletions pkg/installpackage/installer.go
View file
Expand Up @@ -106,16 +106,17 @@ type Unarchiver interface {
}

type ParamInstallPackages struct {
ConfigFilePath string
Config *aqua.Config
Registries map[string]*registry.Config
Tags map[string]struct{}
ExcludedTags map[string]struct{}
PolicyConfigs []*policy.Config
Checksums *checksum.Checksums
SkipLink bool
RequireChecksum bool
DisablePolicy bool
ConfigFilePath string
Config *aqua.Config
Registries map[string]*registry.Config
Tags map[string]struct{}
ExcludedTags map[string]struct{}
PolicyConfigs []*policy.Config
Checksums *checksum.Checksums
SkipLink bool
EnforceRequireChecksum bool
RequireChecksum bool
DisablePolicy bool
}

type ParamInstallPackage struct {
Expand Down Expand Up @@ -205,7 +206,7 @@ func (is *Installer) InstallPackages(ctx context.Context, logE *logrus.Entry, pa
if err := is.InstallPackage(ctx, logE, &ParamInstallPackage{
Pkg: pkg,
Checksums: param.Checksums,
RequireChecksum: param.Config.RequireChecksum(param.RequireChecksum),
RequireChecksum: param.Config.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
PolicyConfigs: param.PolicyConfigs,
DisablePolicy: param.DisablePolicy,
}); err != nil {
Expand Down

0 comments on commit 9ee1891

Please sign in to comment.