Use tarfs to implement structure test (#228)

Previously, we scanned through the image filesystem and matched the
tar.Header.Name field against the file path given by the test. This
works most of the time, but doesn't handle symlinks at all.

This change writes the entire layer tar to a temporary file, parses it
with tarfs to get an fs.FS, attempts to randomly access each file from
the test, and deletes the temporary file afterwards.

Signed-off-by: Jon Johnson <[email protected]>

Author: jonjohnsonjr

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/hashicorp/terraform-plugin-go v0.26.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-testing v1.12.0
+	github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4
 	github.com/spf13/cobra v1.9.1
 )
 

go.sum

@@ -145,6 +145,8 @@ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOl
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
+github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4 h1:yzUKZR6eq4hfKkNLe2KfxOBiVHyjXny7g4bEDuiYCtY=
+github.com/jonjohnsonjr/targz v0.0.0-20241113200849-4986e08f3fb4/go.mod h1:vFsMbFCBsTclpEtIkbCOBAJj1mBsqoMtm22ibo1cG2o=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

internal/provider/structure_test_data_source_test.go

@@ -36,6 +36,15 @@ func TestAccStructureTestDataSource(t *testing.T) {
 		Size: 6,
 	})
 	_, _ = tw.Write([]byte("blah!!"))
+
+	// Test that /lib -> /usr/lib works.
+	_ = tw.WriteHeader(&tar.Header{
+		Name:     "symlink",
+		Typeflag: tar.TypeSymlink,
+		Mode:     0755,
+		Linkname: "path",
+	})
+
 	tw.Close()
 
 	l, err := tarball.LayerFromOpener(func() (io.ReadCloser, error) {
@@ -96,6 +105,10 @@ func TestAccStructureTestDataSource(t *testing.T) {
       path  = "/path/to/baz"
       regex = "blah!!"
     }
+    files {
+      path  = "/symlink/to/baz"
+      regex = "blah!!"
+    }
   }
 }`, ref),
 			Check: resource.ComposeTestCheckFunc(

pkg/structure/structure.go

@@ -1,16 +1,17 @@
 package structure
 
 import (
-	"archive/tar"
-	"bytes"
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
+	"os"
 	"regexp"
 	"strings"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
+	"github.com/jonjohnsonjr/targz/tarfs"
 )
 
 type Condition interface {
@@ -69,7 +70,6 @@ type FilesCondition struct {
 type File struct {
 	Regex string
 	// TODO: support filemode
-	ran bool
 }
 
 func (f FilesCondition) Check(i v1.Image) error {
@@ -88,56 +88,54 @@ func (f FilesCondition) Check(i v1.Image) error {
 		rc = mutate.Extract(i)
 	}
 
+	tmp, err := os.CreateTemp("", "structure-test")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+
 	defer rc.Close()
-	tr := tar.NewReader(rc)
-	errs := []error{}
-L:
-	for {
-		hdr, err := tr.Next()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return err
-		}
-		if !strings.HasPrefix(hdr.Name, "/") {
-			hdr.Name = "/" + hdr.Name
-		}
 
-		if _, found := f.Want[hdr.Name]; !found {
-			// We don't care about this file at all, on to the next.
+	size, err := io.Copy(tmp, rc)
+	if err != nil {
+		return err
+	}
+
+	fsys, err := tarfs.New(tmp, size)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+
+	for path, f := range f.Want {
+		// https://pkg.go.dev/io/fs#ValidPath
+		name := strings.TrimPrefix(path, "/")
+
+		tf, err := fsys.Open(name)
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				// Avoid breaking backward compatibility.
+				errs = append(errs, fmt.Errorf("file %q not found", path))
+			} else {
+				// Any other error is unexpected, so we want to retain it.
+				errs = append(errs, fmt.Errorf("opening %q: %w", path, err))
+			}
 			continue
 		}
-		if f.Want[hdr.Name].Regex != "" {
+		if f.Regex != "" {
 			// We care about the contents, so read and buffer them and regexp.
-			var buf bytes.Buffer
-			if _, err := io.Copy(&buf, tr); err != nil {
-				return err
+			got, err := io.ReadAll(tf)
+			if err != nil {
+				errs = append(errs, fmt.Errorf("reading %q: %w", path, err))
+				continue
 			}
-			if !regexp.MustCompile(f.Want[hdr.Name].Regex).Match(buf.Bytes()) {
-				errs = append(errs, fmt.Errorf("file %q does not match regexp %q, got:\n%s", hdr.Name, f.Want[hdr.Name].Regex, buf.String()))
-			}
-		}
-		// At least mark that we found this file we cared about.
-		f.Want[hdr.Name] = File{
-			Regex: f.Want[hdr.Name].Regex,
-			ran:   true,
-		}
 
-		// If all the checks have run, we can stop early.
-		// This might not be strictly correct, since tar files can have multiple
-		// files with the same name, and the last one wins; in practice, this is
-		// unlikely to be a problem, and the optimization is worth it.
-		for _, f := range f.Want {
-			if !f.ran {
-				continue L
+			if !regexp.MustCompile(f.Regex).Match(got) {
+				errs = append(errs, fmt.Errorf("file %q does not match regexp %q, got:\n%s", path, f.Regex, got))
 			}
 		}
-		break
-	}
-	for path, f := range f.Want {
-		if !f.ran {
-			errs = append(errs, fmt.Errorf("file %q not found", path))
-		}
 	}
+
 	return errors.Join(errs...)
 }