Validate index architectures match children (#1776)

Now crane validate will validate the entire remote index, including that there are not any mismatched architectures. If you pass a --platform flag, it will behave how it previously behaved.
google · Aug 22, 2023 · 190ad0e · 190ad0e
1 parent a54d642
commit 190ad0e
Show file tree

Hide file tree

Showing 2 changed files with 94 additions and 17 deletions.
diff --git a/cmd/crane/cmd/validate.go b/cmd/crane/cmd/validate.go
@@ -18,7 +18,6 @@ import (
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/crane"
-	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/tarball"
 	"github.com/google/go-containerregistry/pkg/v1/validate"
 	"github.com/spf13/cobra"
@@ -36,28 +35,56 @@ func NewCmdValidate(options *[]crane.Option) *cobra.Command {
 		Short: "Validate that an image is well-formed",
 		Args:  cobra.ExactArgs(0),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			for flag, maker := range map[string]func(string, ...crane.Option) (v1.Image, error){
-				tarballPath: makeTarball,
-				remoteRef:   crane.Pull,
-			} {
-				if flag == "" {
-					continue
-				}
-				img, err := maker(flag, *options...)
+			if tarballPath != "" {
+				img, err := tarball.ImageFromPath(tarballPath, nil)
 				if err != nil {
-					return fmt.Errorf("failed to read image %s: %w", flag, err)
+					return fmt.Errorf("failed to read image %s: %w", tarballPath, err)
 				}
-
 				opt := []validate.Option{}
 				if fast {
 					opt = append(opt, validate.Fast)
 				}
 				if err := validate.Image(img, opt...); err != nil {
-					fmt.Fprintf(cmd.OutOrStdout(), "FAIL: %s: %v\n", flag, err)
+					fmt.Fprintf(cmd.OutOrStdout(), "FAIL: %s: %v\n", tarballPath, err)
 					return err
 				}
-				fmt.Fprintf(cmd.OutOrStdout(), "PASS: %s\n", flag)
+				fmt.Fprintf(cmd.OutOrStdout(), "PASS: %s\n", tarballPath)
+			}
+
+			if remoteRef != "" {
+				rmt, err := crane.Get(remoteRef, *options...)
+				if err != nil {
+					return fmt.Errorf("failed to read image %s: %w", remoteRef, err)
+				}
+
+				o := crane.GetOptions(*options...)
+
+				opt := []validate.Option{}
+				if fast {
+					opt = append(opt, validate.Fast)
+				}
+				if rmt.MediaType.IsIndex() && o.Platform == nil {
+					idx, err := rmt.ImageIndex()
+					if err != nil {
+						return fmt.Errorf("reading index: %w", err)
+					}
+					if err := validate.Index(idx, opt...); err != nil {
+						fmt.Fprintf(cmd.OutOrStdout(), "FAIL: %s: %v\n", remoteRef, err)
+						return err
+					}
+				} else {
+					img, err := rmt.Image()
+					if err != nil {
+						return fmt.Errorf("reading image: %w", err)
+					}
+					if err := validate.Image(img, opt...); err != nil {
+						fmt.Fprintf(cmd.OutOrStdout(), "FAIL: %s: %v\n", remoteRef, err)
+						return err
+					}
+				}
+				fmt.Fprintf(cmd.OutOrStdout(), "PASS: %s\n", remoteRef)
 			}
+
 			return nil
 		},
 	}
@@ -67,7 +94,3 @@ func NewCmdValidate(options *[]crane.Option) *cobra.Command {
 
 	return validateCmd
 }
-
-func makeTarball(path string, _ ...crane.Option) (v1.Image, error) {
-	return tarball.ImageFromPath(path, nil)
-}
diff --git a/pkg/v1/validate/index.go b/pkg/v1/validate/index.go
@@ -79,6 +79,9 @@ func validateChildren(idx v1.ImageIndex, opt ...Option) error {
 			if err := validateMediaType(img, desc.MediaType); err != nil {
 				errs = append(errs, fmt.Sprintf("failed to validate image MediaType[%d](%s): %v", i, desc.Digest, err))
 			}
+			if err := validatePlatform(img, desc.Platform); err != nil {
+				errs = append(errs, fmt.Sprintf("failed to validate image platform[%d](%s): %v", i, desc.Digest, err))
+			}
 		default:
 			// Workaround for #819.
 			if wl, ok := idx.(withLayer); ok {
@@ -173,3 +176,54 @@ func validateIndexManifest(idx v1.ImageIndex) error {
 
 	return nil
 }
+
+func validatePlatform(img v1.Image, want *v1.Platform) error {
+	if want == nil {
+		return nil
+	}
+
+	cf, err := img.ConfigFile()
+	if err != nil {
+		return err
+	}
+
+	got := cf.Platform()
+
+	if got == nil {
+		return fmt.Errorf("config file missing platform fields")
+	}
+
+	if got.Equals(*want) {
+		return nil
+	}
+
+	errs := []string{}
+
+	if got.OS != want.OS {
+		errs = append(errs, fmt.Sprintf("mismatched OS: %s != %s", got.OS, want.OS))
+	}
+
+	if got.Architecture != want.Architecture {
+		errs = append(errs, fmt.Sprintf("mismatched Architecture: %s != %s", got.Architecture, want.Architecture))
+	}
+
+	if got.OSVersion != want.OSVersion {
+		errs = append(errs, fmt.Sprintf("mismatched OSVersion: %s != %s", got.OSVersion, want.OSVersion))
+	}
+
+	if got.OSVersion != want.OSVersion {
+		errs = append(errs, fmt.Sprintf("mismatched OSVersion: %s != %s", got.OSVersion, want.OSVersion))
+	}
+
+	if len(errs) == 0 {
+		// If we got here, some features might be mismatched. Just add those...
+		if len(got.Features) != 0 || len(want.Features) != 0 {
+			errs = append(errs, fmt.Sprintf("mismatched Features: %v, %v", got.Features, want.Features))
+		}
+		if len(got.OSFeatures) != 0 || len(want.OSFeatures) != 0 {
+			errs = append(errs, fmt.Sprintf("mismatched OSFeatures: %v, %v", got.OSFeatures, want.OSFeatures))
+		}
+	}
+
+	return errors.New(strings.Join(errs, "\n"))
+}