Validate checksums when fetching cached files for app packaging #4081
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
880e0c6 to
ef5df5c
Compare
nookala
approved these changes
Nov 13, 2024
philippthun
reviewed
Nov 18, 2024
* This also deletes any resources with bad/mismatched checksums
ef5df5c to
a174d5d
Compare
a-b
reviewed
Nov 19, 2024
| @@ -132,7 +132,7 @@ def make_request | |||
| end | |||
|
|
|||
| context 'with at least one resource and an application' do | |||
| let(:req_body) { { resources: Oj.dump([{ 'fn' => 'lol', 'sha1' => 'abc', 'size' => 2048 }]), application: valid_zip } } | |||
| let(:req_body) { { resources: Oj.dump([{ 'fn' => 'lol', 'sha1' => 'da39a3ee5e6b4b0d3255bfef95601890afd80709', 'size' => 2048 }]), application: valid_zip } } | |||
There was a problem hiding this comment.
question (non-blocking): why do we want a valid sha for these units? Can we mock the underlying library?
There was a problem hiding this comment.
The unit tests write/read from a tmp directory: https://github.com/cloudfoundry/cloud_controller_ng/pull/4081/files#diff-919d005706d6fa1e2f65027b4718eab4c664001c3d8d5893ee5395bb47350335L20-L28
a-b
approved these changes
Nov 19, 2024
a-b
approved these changes
Nov 19, 2024
Samze
approved these changes
Nov 19, 2024
ari-wg-gitbot
added a commit
to cloudfoundry/capi-release
that referenced
this pull request
Nov 19, 2024
Changes in cloud_controller_ng:
- Validate checksums when fetching cached files for app packaging
PR: cloudfoundry/cloud_controller_ng#4081
Author: Seth Boyles <seth.boyles@broadcom.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Although resource matching stores files by their sha1 checksum, when later fetching the resource to include in app packaging, the bits packer does not validate the checksum still matches. The packer will still include the corrupted file, and users (most likely) won't receive an error until the staging process. This state is only recoverable by clearing the resource cache, which relies on operator intervention.
With this change, when a bad checksum is found, the cached resource(s) are deleted, and an error is raised, causing faster feedback. Since the cached resources have been deleted, a second push/package upload should succeed.
I have reviewed the contributing guide
I have viewed, signed, and submitted the Contributor License Agreement
I have made this pull request to the
mainbranchI have run all the unit tests using
bundle exec rakeI have run CF Acceptance Tests