Skip to content

Commit

Permalink
feat(checksum): support enforcing checksum verification via environme…
Browse files Browse the repository at this point in the history 
…nt variables (#2806)

* feat(checksum): support enforcing checksum verification via environment variables

* fix(checksum): remove unused fields and pass EnforceRequireChecksum properly

* fix: fix lint errors

* refactor(checksum): remove EnforceRequireChecksum from ParamInstallPackages
  • Loading branch information
@suzuki-shunsuke
suzuki-shunsuke authored Apr 6, 2024
1 parent 0dfa781 commit 62f0457
Show file tree
Hide file tree
Showing 18 changed files with 94 additions and 72 deletions.
21 changes: 21 additions & 0 deletions pkg/cli/runner.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,13 +110,34 @@ func (r *Runner) setParam(c *cli.Context, commandName string, param *config.Para
}
}
}
if a := os.Getenv("AQUA_CHECKSUM"); a != "" {
chksm, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_CHECKSUM as bool: %w", err)
}
param.Checksum = chksm
}
if a := os.Getenv("AQUA_REQUIRE_CHECKSUM"); a != "" {
requireChecksum, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_REQUIRE_CHECKSUM as bool: %w", err)
}
param.RequireChecksum = requireChecksum
}
if a := os.Getenv("AQUA_ENFORCE_CHECKSUM"); a != "" {
chksm, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_ENFORCE_CHECKSUM as bool: %w", err)
}
param.EnforceChecksum = chksm
}
if a := os.Getenv("AQUA_ENFORCE_REQUIRE_CHECKSUM"); a != "" {
requireChecksum, err := strconv.ParseBool(a)
if err != nil {
return fmt.Errorf("parse the environment variable AQUA_ENFORCE_REQUIRE_CHECKSUM as bool: %w", err)
}
param.EnforceRequireChecksum = requireChecksum
}
return nil
}

Expand Down
14 changes: 10 additions & 4 deletions pkg/config/aqua/checksum.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,20 @@ package aqua

import "github.com/aquaproj/aqua/v2/pkg/config/registry"

func (c *Config) ChecksumEnabled() bool {
if c == nil {
return false
func (c *Config) ChecksumEnabled(enforceValue, defValue bool) bool {
if enforceValue {
return true
}
if c == nil || c.Checksum == nil || c.Checksum.Enabled == nil {
return defValue
}
return c.Checksum.GetEnabled()
}

func (c *Config) RequireChecksum(defValue bool) bool {
func (c *Config) RequireChecksum(enforceValue, defValue bool) bool {
if enforceValue {
return true
}
if c == nil || c.Checksum == nil || c.Checksum.RequireChecksum == nil {
return defValue
}
Expand Down
83 changes: 43 additions & 40 deletions pkg/config/package.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -240,46 +240,49 @@ const (
)

type Param struct {
GlobalConfigFilePaths []string
ConfigFilePath string
LogLevel string
File string
AQUAVersion string
AquaCommitHash string
RootDir string
PWD string
InsertFile string
LogColor string
Dest string
HomeDir string
OutTestData string
Limit int
MaxParallelism int
Args []string
Tags map[string]struct{}
ExcludedTags map[string]struct{}
DisableLazyInstall bool
OnlyLink bool
All bool
Global bool
Insert bool
SelectVersion bool
ShowVersion bool
ProgressBar bool
Deep bool
SkipLink bool
Pin bool
Prune bool
RequireChecksum bool
DisablePolicy bool
Detail bool
OnlyPackage bool
OnlyRegistry bool
CosignDisabled bool
SLSADisabled bool
Installed bool
PolicyConfigFilePaths []string
Commands []string
GlobalConfigFilePaths []string
ConfigFilePath string
LogLevel string
File string
AQUAVersion string
AquaCommitHash string
RootDir string
PWD string
InsertFile string
LogColor string
Dest string
HomeDir string
OutTestData string
Limit int
MaxParallelism int
Args []string
Tags map[string]struct{}
ExcludedTags map[string]struct{}
DisableLazyInstall bool
OnlyLink bool
All bool
Global bool
Insert bool
SelectVersion bool
ShowVersion bool
ProgressBar bool
Deep bool
SkipLink bool
Pin bool
Prune bool
Checksum bool
RequireChecksum bool
EnforceChecksum bool
EnforceRequireChecksum bool
DisablePolicy bool
Detail bool
OnlyPackage bool
OnlyRegistry bool
CosignDisabled bool
SLSADisabled bool
Installed bool
PolicyConfigFilePaths []string
Commands []string
}

func appendExt(s, format string) string {
Expand Down
2 changes: 0 additions & 2 deletions pkg/controller/cp/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ type Controller struct {
which WhichController
installer Installer
policyConfigReader PolicyReader
requireChecksum bool
}

type PackageInstaller interface {
Expand All @@ -49,7 +48,6 @@ func New(param *config.Param, pkgInstaller PackageInstaller, fs afero.Fs, rt *ru
which: whichCtrl,
installer: installer,
policyConfigReader: policyConfigReader,
requireChecksum: param.RequireChecksum,
}
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/cp/install.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ import (

func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult *which.FindResult, policyConfigs []*policy.Config, param *config.Param) error {
var checksums *checksum.Checksums
if findResult.Config.ChecksumEnabled() {
if findResult.Config.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, findResult.ConfigFilePath)
if err != nil {
Expand All @@ -35,7 +35,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult
if err := c.packageInstaller.InstallPackage(ctx, logE, &installpackage.ParamInstallPackage{
Pkg: findResult.Package,
Checksums: checksums,
RequireChecksum: findResult.Config.RequireChecksum(c.requireChecksum),
RequireChecksum: findResult.Config.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
ConfigFileDir: filepath.Dir(findResult.ConfigFilePath),
PolicyConfigs: policyConfigs,
DisablePolicy: param.DisablePolicy,
Expand Down
4 changes: 1 addition & 3 deletions pkg/controller/exec/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,13 @@ type Controller struct {
policyConfigReader PolicyReader
policyConfigFinder policy.ConfigFinder
enabledXSysExec bool
requireChecksum bool
}

type Installer interface {
InstallPackage(ctx context.Context, logE *logrus.Entry, param *installpackage.ParamInstallPackage) error
}

func New(param *config.Param, pkgInstaller Installer, whichCtrl WhichController, executor Executor, osEnv osenv.OSEnv, fs afero.Fs, policyConfigReader PolicyReader, policyConfigFinder policy.ConfigFinder) *Controller {
func New(pkgInstaller Installer, whichCtrl WhichController, executor Executor, osEnv osenv.OSEnv, fs afero.Fs, policyConfigReader PolicyReader, policyConfigFinder policy.ConfigFinder) *Controller {
return &Controller{
stdin: os.Stdin,
stdout: os.Stdout,
Expand All @@ -45,7 +44,6 @@ func New(param *config.Param, pkgInstaller Installer, whichCtrl WhichController,
fs: fs,
policyConfigReader: policyConfigReader,
policyConfigFinder: policyConfigFinder,
requireChecksum: param.RequireChecksum,
}
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/exec/exec.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ func (c *Controller) Exec(ctx context.Context, logE *logrus.Entry, param *config

func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult *which.FindResult, policies []*policy.Config, param *config.Param) error {
var checksums *checksum.Checksums
if findResult.Config.ChecksumEnabled() {
if findResult.Config.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, findResult.ConfigFilePath)
if err != nil {
Expand All @@ -85,7 +85,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, findResult
if err := c.packageInstaller.InstallPackage(ctx, logE, &installpackage.ParamInstallPackage{
Pkg: findResult.Package,
Checksums: checksums,
RequireChecksum: findResult.Config.RequireChecksum(c.requireChecksum),
RequireChecksum: findResult.Config.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
PolicyConfigs: policies,
DisablePolicy: param.DisablePolicy,
}); err != nil {
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/exec/exec_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ packages:
executor := &exec.Mock{}
pkgInstaller := installpackage.New(d.param, downloader, d.rt, fs, linker, nil, &checksum.Calculator{}, unarchive.New(executor, fs), &cosign.MockVerifier{}, &slsa.MockVerifier{}, &installpackage.MockGoInstallInstaller{}, &installpackage.MockGoBuildInstaller{}, &installpackage.MockCargoPackageInstaller{})
policyFinder := policy.NewConfigFinder(fs)
ctrl := execCtrl.New(d.param, pkgInstaller, whichCtrl, executor, osEnv, fs, policy.NewReader(fs, policy.NewValidator(d.param, fs), policyFinder, policy.NewConfigReader(fs)), policyFinder)
ctrl := execCtrl.New(pkgInstaller, whichCtrl, executor, osEnv, fs, policy.NewReader(fs, policy.NewValidator(d.param, fs), policyFinder, policy.NewConfigReader(fs)), policyFinder)
if err := ctrl.Exec(ctx, logE, d.param, d.exeName, d.args...); err != nil {
if d.isErr {
return
Expand Down Expand Up @@ -246,7 +246,7 @@ packages:
downloader := download.NewDownloader(nil, download.NewHTTPDownloader(http.DefaultClient))
executor := &exec.Mock{}
pkgInstaller := installpackage.New(d.param, downloader, d.rt, fs, linker, nil, &checksum.Calculator{}, unarchive.New(executor, fs), &cosign.MockVerifier{}, &slsa.MockVerifier{}, &installpackage.MockGoInstallInstaller{}, &installpackage.MockGoBuildInstaller{}, &installpackage.MockCargoPackageInstaller{})
ctrl := execCtrl.New(d.param, pkgInstaller, whichCtrl, executor, osEnv, fs, &policy.MockReader{}, policy.NewConfigFinder(fs))
ctrl := execCtrl.New(pkgInstaller, whichCtrl, executor, osEnv, fs, &policy.MockReader{}, policy.NewConfigFinder(fs))
b.ResetTimer()
for i := 0; i < b.N; i++ {
func() {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/generate/generate.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ func (c *Controller) getConfigFile(param *config.Param) (string, error) {

func (c *Controller) listPkgs(ctx context.Context, logE *logrus.Entry, param *config.Param, cfg *aqua.Config, cfgFilePath string, args ...string) ([]*aqua.Package, error) {
var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 0 additions & 2 deletions pkg/controller/install/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ type Controller struct {
policyConfigFinder policy.ConfigFinder
policyConfigReader PolicyReader
skipLink bool
requireChecksum bool
}

func New(param *config.Param, configFinder ConfigFinder, configReader ConfigReader, registInstaller RegistryInstaller, pkgInstaller Installer, fs afero.Fs, rt *runtime.Runtime, policyConfigReader PolicyReader, policyConfigFinder policy.ConfigFinder) *Controller {
Expand All @@ -44,7 +43,6 @@ func New(param *config.Param, configFinder ConfigFinder, configReader ConfigRead
excludedTags: param.ExcludedTags,
policyConfigReader: policyConfigReader,
policyConfigFinder: policyConfigFinder,
requireChecksum: param.RequireChecksum,
}
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/install/install.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, cfgFilePat
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down Expand Up @@ -125,7 +125,7 @@ func (c *Controller) install(ctx context.Context, logE *logrus.Entry, cfgFilePat
ExcludedTags: c.excludedTags,
PolicyConfigs: policyConfigs,
Checksums: checksums,
RequireChecksum: c.requireChecksum,
RequireChecksum: cfg.RequireChecksum(param.EnforceRequireChecksum, param.RequireChecksum),
DisablePolicy: param.DisablePolicy,
})
}
2 changes: 1 addition & 1 deletion pkg/controller/list/list.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ func (c *Controller) List(ctx context.Context, param *config.Param, logE *logrus
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/remove/remove.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ func (c *Controller) Remove(ctx context.Context, logE *logrus.Entry, param *conf
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
2 changes: 0 additions & 2 deletions pkg/controller/update/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ type Controller struct {
registryInstaller RegistryInstaller
fs afero.Fs
runtime *runtime.Runtime
requireChecksum bool
fuzzyGetter FuzzyGetter
fuzzyFinder FuzzyFinder
which WhichController
Expand Down Expand Up @@ -62,7 +61,6 @@ func New(param *config.Param, gh RepositoriesService, configFinder ConfigFinder,
registryInstaller: registInstaller,
fs: fs,
runtime: rt,
requireChecksum: param.RequireChecksum,
fuzzyGetter: fuzzyGetter,
fuzzyFinder: fuzzyFinder,
which: whichController,
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/update/update.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ func (c *Controller) update(ctx context.Context, logE *logrus.Entry, param *conf
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
8 changes: 4 additions & 4 deletions pkg/controller/which/which.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ type FindResult struct {

func (c *Controller) Which(ctx context.Context, logE *logrus.Entry, param *config.Param, exeName string) (*FindResult, error) {
for _, cfgFilePath := range c.configFinder.Finds(param.PWD, param.ConfigFilePath) {
findResult, err := c.findExecFile(ctx, logE, cfgFilePath, exeName)
findResult, err := c.findExecFile(ctx, logE, param, cfgFilePath, exeName)
if err != nil {
return nil, err
}
Expand All @@ -38,7 +38,7 @@ func (c *Controller) Which(ctx context.Context, logE *logrus.Entry, param *confi
if _, err := c.fs.Stat(cfgFilePath); err != nil {
continue
}
findResult, err := c.findExecFile(ctx, logE, cfgFilePath, exeName)
findResult, err := c.findExecFile(ctx, logE, param, cfgFilePath, exeName)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -67,14 +67,14 @@ func (c *Controller) getExePath(findResult *FindResult) (string, error) {
return pkg.ExePath(c.rootDir, file, c.runtime) //nolint:wrapcheck
}

func (c *Controller) findExecFile(ctx context.Context, logE *logrus.Entry, cfgFilePath, exeName string) (*FindResult, error) {
func (c *Controller) findExecFile(ctx context.Context, logE *logrus.Entry, param *config.Param, cfgFilePath, exeName string) (*FindResult, error) {
cfg := &aqua.Config{}
if err := c.configReader.Read(cfgFilePath, cfg); err != nil {
return nil, err //nolint:wrapcheck
}

var checksums *checksum.Checksums
if cfg.ChecksumEnabled() {
if cfg.ChecksumEnabled(param.EnforceChecksum, param.Checksum) {
checksums = checksum.New()
checksumFilePath, err := checksum.GetChecksumFilePathFromConfigFilePath(c.fs, cfgFilePath)
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/wire_gen.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pkg/installpackage/installer.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ func (is *Installer) InstallPackages(ctx context.Context, logE *logrus.Entry, pa
if err := is.InstallPackage(ctx, logE, &ParamInstallPackage{
Pkg: pkg,
Checksums: param.Checksums,
RequireChecksum: param.Config.RequireChecksum(param.RequireChecksum),
RequireChecksum: param.RequireChecksum,
PolicyConfigs: param.PolicyConfigs,
DisablePolicy: param.DisablePolicy,
}); err != nil {
Expand Down

0 comments on commit 62f0457

Please sign in to comment.