opa build: data.json containing "null" value when merged from other bundle

[anderseknert]

Although it is a bit of an edge case, I think it's meant to be supported using another bundle as the source when building a new bundle, adding e.g. another directory or policy to the second bundle. There seems to be a problem when merging two empty (i.e. containing {}) data.json files though.

Provided a directory structure like below:

$ tree -a
.
├── bundle1
│   ├── .manifest
│   └── p1.rego
└── bundle2
    ├── .manifest
    └── p2.rego

3 directories, 4 files

And we build a first bundle from the bundle1 directory:

$ opa build -o bundle1.tar.gz -b bundle1

Looking at the data.json file from the bundle, and as expected, we've been provided an empty object:

$ tar -O -xf bundle1.tar.gz /data.json
{}

Now, let's build a second bundle using the bundle2 directory and the first bundle as input.

$ opa build -o bundle2.tar.gz bundle2 -b bundle1.tar.gz

The command works alright, but trying to run OPA with bundle2.tar.gz fails:

$ opa run bundle2.tar.gz
error: load error: 1 error occurred during loading: bundle bundle2.tar.gz: bundle load failed on /data.json: root value must be object

Checking the contents of data.json in bundle2.tar.gz reveals the following:

$ tar -O -xf bundle2.tar.gz /data.json
null

The expected outcome would be that data.json contained {} just like from the first bundle created.

This was discovered when working on an example for @Ronnie-personal in https://github.com/orgs/open-policy-agent/discussions/352

[ashutosh-narkar]

Seems like an issue in the Merge method. In this case, where the values are nil, the resulting bundle's Data field won't be intialized and hence you get the error at runtime.

[anderseknert]

Thanks @ashutosh-narkar. I've submitted a fix 👍