Version 5.22 introduced a new option to /etc/containers/policy.json called
keyPaths, see
https://github.com/containers/image/pull/1609
EL9 immediately took advantage of this new feature and started using it, see
04645c4a84
This quickly became an issue in our code: The go library (containers/image)
parses the configuration file very strictly and refuses to create a client
when policy.json with an unknown key is present on the filesystem. As we
used 5.21.1 that doesn't know the new key, our unit tests started to
failing when containers-common was present.
Reproducer:
podman run --pull=always --rm -it centos:stream9
dnf install -y dnf-plugins-core
dnf config-manager --set-enabled crb
dnf install -y gpgme-devel libassuan-devel krb5-devel golang git-core
git clone https://github.com/osbuild/osbuild-composer
cd osbuild-composer
# install the new containers-common and run the test
dnf install -y https://kojihub.stream.centos.org/kojifiles/packages/containers-common/1/44.el9/x86_64/containers-common-1-44.el9.x86_64.rpm
go test -count 1 ./...
# this returns:
--- FAIL: TestClientResolve (0.00s)
client_test.go:31:
Error Trace: client_test.go:31
Error: Received unexpected error:
Unknown key "keyPaths"
invalid policy in "/etc/containers/policy.json"
github.com/containers/image/v5/signature.NewPolicyFromFile
/osbuild-composer/vendor/github.com/containers/image/v5/signature/policy_config.go:88
github.com/osbuild/osbuild-composer/internal/container.NewClient
/osbuild-composer/internal/container/client.go:123
github.com/osbuild/osbuild-composer/internal/container_test.TestClientResolve
/osbuild-composer/internal/container/client_test.go:29
testing.tRunner
/usr/lib/golang/src/testing/testing.go:1439
runtime.goexit
/usr/lib/golang/src/runtime/asm_amd64.s:1571
Test: TestClientResolve
client_test.go:32:
Error Trace: client_test.go:32
Error: Expected value not to be nil.
Test: TestClientResolve
When run with an older containers-common, it succeeds:
dnf install -y https://kojihub.stream.centos.org/kojifiles/packages/containers-common/1/40.el9/x86_64/containers-common-1-40.el9.x86_64.rpm
go test -count 1 ./...
PASS
To sum it up, I had to upgrade github.com/containers/image/v5 to v5.22.0.
Unfortunately, this wasn't so simple, see
go get github.com/containers/image/v5@latest
go: github.com/containers/image/v5@v5.22.0 requires
github.com/letsencrypt/boulder@v0.0.0-20220331220046-b23ab962616e requires
github.com/honeycombio/beeline-go@v1.1.1 requires
github.com/gobuffalo/pop/v5@v5.3.1 requires
github.com/mattn/go-sqlite3@v2.0.3+incompatible: reading github.com/mattn/go-sqlite3/go.mod at revision v2.0.3: unknown revision v2.0.3
It turns out that github.com/mattn/go-sqlite3@v2.0.3+incompatible has been
recently retracted https://github.com/mattn/go-sqlite3/pull/998 and this
broke a ton of packages depending on it. I was able to fix it by adding
exclude github.com/mattn/go-sqlite3 v2.0.3+incompatible
to our go.mod, see
https://github.com/mattn/go-sqlite3/issues/975#issuecomment-955661657
After adding it,
go get github.com/containers/image/v5@latest
succeeded and tools/prepare-source.sh took care of the rest.
Signed-off-by: Ondřej Budai <ondrej@budai.cz>
123 lines
3.6 KiB
Go
123 lines
3.6 KiB
Go
// Copyright 2019+ Klaus Post. All rights reserved.
|
|
// License information can be found in the LICENSE file.
|
|
// Based on work by Yann Collet, released under BSD License.
|
|
|
|
package zstd
|
|
|
|
import (
|
|
"errors"
|
|
"runtime"
|
|
)
|
|
|
|
// DOption is an option for creating a decoder.
|
|
type DOption func(*decoderOptions) error
|
|
|
|
// options retains accumulated state of multiple options.
|
|
type decoderOptions struct {
|
|
lowMem bool
|
|
concurrent int
|
|
maxDecodedSize uint64
|
|
maxWindowSize uint64
|
|
dicts []dict
|
|
ignoreChecksum bool
|
|
}
|
|
|
|
func (o *decoderOptions) setDefault() {
|
|
*o = decoderOptions{
|
|
// use less ram: true for now, but may change.
|
|
lowMem: true,
|
|
concurrent: runtime.GOMAXPROCS(0),
|
|
maxWindowSize: MaxWindowSize,
|
|
}
|
|
if o.concurrent > 4 {
|
|
o.concurrent = 4
|
|
}
|
|
o.maxDecodedSize = 64 << 30
|
|
}
|
|
|
|
// WithDecoderLowmem will set whether to use a lower amount of memory,
|
|
// but possibly have to allocate more while running.
|
|
func WithDecoderLowmem(b bool) DOption {
|
|
return func(o *decoderOptions) error { o.lowMem = b; return nil }
|
|
}
|
|
|
|
// WithDecoderConcurrency sets the number of created decoders.
|
|
// When decoding block with DecodeAll, this will limit the number
|
|
// of possible concurrently running decodes.
|
|
// When decoding streams, this will limit the number of
|
|
// inflight blocks.
|
|
// When decoding streams and setting maximum to 1,
|
|
// no async decoding will be done.
|
|
// When a value of 0 is provided GOMAXPROCS will be used.
|
|
// By default this will be set to 4 or GOMAXPROCS, whatever is lower.
|
|
func WithDecoderConcurrency(n int) DOption {
|
|
return func(o *decoderOptions) error {
|
|
if n < 0 {
|
|
return errors.New("concurrency must be at least 1")
|
|
}
|
|
if n == 0 {
|
|
o.concurrent = runtime.GOMAXPROCS(0)
|
|
} else {
|
|
o.concurrent = n
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDecoderMaxMemory allows to set a maximum decoded size for in-memory
|
|
// non-streaming operations or maximum window size for streaming operations.
|
|
// This can be used to control memory usage of potentially hostile content.
|
|
// Maximum is 1 << 63 bytes. Default is 64GiB.
|
|
func WithDecoderMaxMemory(n uint64) DOption {
|
|
return func(o *decoderOptions) error {
|
|
if n == 0 {
|
|
return errors.New("WithDecoderMaxMemory must be at least 1")
|
|
}
|
|
if n > 1<<63 {
|
|
return errors.New("WithDecoderMaxmemory must be less than 1 << 63")
|
|
}
|
|
o.maxDecodedSize = n
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDecoderDicts allows to register one or more dictionaries for the decoder.
|
|
// If several dictionaries with the same ID is provided the last one will be used.
|
|
func WithDecoderDicts(dicts ...[]byte) DOption {
|
|
return func(o *decoderOptions) error {
|
|
for _, b := range dicts {
|
|
d, err := loadDict(b)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
o.dicts = append(o.dicts, *d)
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// WithDecoderMaxWindow allows to set a maximum window size for decodes.
|
|
// This allows rejecting packets that will cause big memory usage.
|
|
// The Decoder will likely allocate more memory based on the WithDecoderLowmem setting.
|
|
// If WithDecoderMaxMemory is set to a lower value, that will be used.
|
|
// Default is 512MB, Maximum is ~3.75 TB as per zstandard spec.
|
|
func WithDecoderMaxWindow(size uint64) DOption {
|
|
return func(o *decoderOptions) error {
|
|
if size < MinWindowSize {
|
|
return errors.New("WithMaxWindowSize must be at least 1KB, 1024 bytes")
|
|
}
|
|
if size > (1<<41)+7*(1<<38) {
|
|
return errors.New("WithMaxWindowSize must be less than (1<<41) + 7*(1<<38) ~ 3.75TB")
|
|
}
|
|
o.maxWindowSize = size
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// IgnoreChecksum allows to forcibly ignore checksum checking.
|
|
func IgnoreChecksum(b bool) DOption {
|
|
return func(o *decoderOptions) error {
|
|
o.ignoreChecksum = b
|
|
return nil
|
|
}
|
|
}
|