Merge branch 'main' into fix/tg5-explicit-evidence-dispatch

Author: mchmarny

pkg/bom/extract.go

@@ -35,6 +35,7 @@ const (
 	helmTemplatePlaceholder = "_aicr_helm_template_"
 	imageRepositoryKey      = "repository"
 	imageTagKey             = "tag"
+	imageDigestKey          = "digest"
 )
 
 var helmTemplateRE = regexp.MustCompile(`\{\{[^{}]*\}\}`)
@@ -72,10 +73,12 @@ func stripHelmTemplates(data []byte) []byte {
 // mappings. Empty or null scalar `image:` values and values still containing an
 // unrendered Go template directive are skipped. A recognized structured
 // descriptor returns an invalid-request error when a present name or
-// repository field is null, empty, or non-scalar, when a tag field is
-// non-scalar, or when a registry or digest member is present (dropping either
-// would emit a wrong or un-pinned reference). A null or empty tag follows the
-// Helm appVersion idiom and is treated as absent.
+// repository field is null, empty, or non-scalar, when a tag or digest field
+// is non-scalar, or when a registry member is present (which cannot be folded
+// into the reference without losing information). A null or empty tag or digest
+// follows the Helm appVersion/unpinned idiom and is treated as absent. A
+// non-empty digest is validated as sha256:<64 lowercase hex chars> and folded
+// in as an @<digest> suffix.
 //
 // Helm template directives ({{ ... }}) are replaced with a placeholder before
 // parsing, so files mixing YAML with Helm templates (those under
@@ -206,31 +209,40 @@ func isStructuredImageKey(key string) bool {
 //	  repository: ghcr.io/kai-scheduler/kai-scheduler
 //	  tag: v0.14.1
 //
+// It also handles the digest-pinned form used by Helm charts that separate
+// repository, tag, and digest into sibling fields (e.g., Bitnami-style):
+//
+//	image:
+//	  repository: docker.io/library/postgres
+//	  tag: "17.4"
+//	  digest: sha256:304ab813518754228f9f792f79d6da36359b82d8ecf418096c636725f8c930ad
+//
 // Some charts omit name because repository already carries the full image
 // path. In that form, repository becomes the image name before tag is
 // appended. A present name or repository must be a non-null, non-empty
 // scalar. A null or empty tag is the Helm idiom for "default to the chart
-// appVersion" and is treated like an absent tag. Only name, repository, and
-// tag are combined; a present registry or digest member is rejected because
-// dropping it would emit a reference that resolves to the wrong registry or
-// silently un-pins a digest. Other members (pullPolicy, pullSecrets, ...)
-// do not affect the reference identity and are ignored.
+// appVersion" and is treated like an absent tag. A present digest is appended
+// as @<digest> so the extracted reference is fully pinned. A present registry
+// member is rejected because dropping it would resolve to the wrong registry.
+// Other members (pullPolicy, pullSecrets, ...) do not affect reference
+// identity and are ignored.
 func imageReferenceFromMapping(n *yaml.Node) (string, error) {
-	var name, repository, tag string
+	var name, repository, tag, digest string
 	var namePresent bool
+	var digestNode *yaml.Node
 	for i := 0; i+1 < len(n.Content); i += 2 {
 		key, value := n.Content[i], n.Content[i+1]
 		switch key.Value {
-		case "name", imageRepositoryKey, imageTagKey:
-		case "registry", "digest":
+		case "name", imageRepositoryKey, imageTagKey, imageDigestKey:
+		case "registry":
 			return "", errors.Wrap(
 				errors.ErrCodeInvalidRequest,
 				"invalid image descriptor member",
 				&invalidStructuredImageDescriptorError{
 					field:  key.Value,
 					line:   key.Line,
 					column: key.Column,
-					reason: "is not combined into the extracted reference; fold it into repository or tag",
+					reason: "is not combined into the extracted reference; fold it into repository",
 				},
 			)
 		default:
@@ -239,10 +251,11 @@ func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 
 		scalar, ok := nonNullImageMappingScalar(value)
 		if !ok {
-			if key.Value == imageTagKey && isNullOrEmptyScalar(value) {
-				// tag: "" / tag: null — the Helm "use appVersion"
-				// idiom. Treat like an absent tag instead of failing
-				// the whole survey.
+			if (key.Value == imageTagKey || key.Value == imageDigestKey) && isNullOrEmptyScalar(value) {
+				// tag: "" / tag: null — the Helm "use appVersion" idiom.
+				// digest: "" / digest: null — unpinned default in charts
+				// that optionally carry a digest pin.
+				// Treat both as absent rather than failing the whole survey.
 				continue
 			}
 			return "", errors.Wrap(
@@ -264,6 +277,9 @@ func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 			repository = scalar
 		case imageTagKey:
 			tag = scalar
+		case imageDigestKey:
+			digest = scalar
+			digestNode = value
 		}
 	}
 	if !namePresent {
@@ -276,7 +292,23 @@ func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 	if name == "" {
 		return "", nil
 	}
-	return combineCRDTriplet(name, repository, tag), nil
+	ref := combineCRDTriplet(name, repository, tag)
+	if digest == "" || strings.Contains(ref, "@") {
+		return ref, nil
+	}
+	if !containerSHARE.MatchString(digest) {
+		return "", errors.Wrap(
+			errors.ErrCodeInvalidRequest,
+			"invalid image descriptor member",
+			&invalidStructuredImageDescriptorError{
+				field:  imageDigestKey,
+				line:   digestNode.Line,
+				column: digestNode.Column,
+				reason: fmt.Sprintf("must match sha256:<64 lowercase hex chars>, got %q", digest),
+			},
+		)
+	}
+	return ref + "@" + digest, nil
 }
 
 func nonNullImageMappingScalar(n *yaml.Node) (string, bool) {

pkg/bom/extract_test.go

@@ -350,6 +350,78 @@ spec:
 				"ghcr.io/example/null-tag",
 			},
 		},
+		{
+			// Bitnami-style and Helm-chart patterns split the image reference
+			// into separate repository, tag, and digest sibling fields. The
+			// digest is appended as @<digest> so the extracted reference is
+			// fully pinned and digest-pin tests see the correct form.
+			name: "operator image mapping with separate digest field produces tag@digest ref",
+			in: `spec:
+  db:
+    image:
+      repository: docker.io/library/postgres
+      tag: "17.4"
+      digest: sha256:304ab813518754228f9f792f79d6da36359b82d8ecf418096c636725f8c930ad
+      pullPolicy: IfNotPresent
+`,
+			want: []string{
+				"docker.io/library/postgres:17.4@sha256:304ab813518754228f9f792f79d6da36359b82d8ecf418096c636725f8c930ad",
+			},
+		},
+		{
+			// Charts that optionally carry a digest pin ship digest: "" or
+			// digest: null as a "not pinned" default. Treat like an absent
+			// digest rather than failing the whole survey.
+			name: "operator image mapping treats empty and null digest as absent",
+			in: `spec:
+  empty:
+    image:
+      repository: ghcr.io/example/unpinned
+      tag: v1
+      digest: ""
+  null:
+    image:
+      repository: ghcr.io/example/unpinned-null
+      tag: v1
+      digest:
+`,
+			want: []string{
+				"ghcr.io/example/unpinned-null:v1",
+				"ghcr.io/example/unpinned:v1",
+			},
+		},
+		{
+			// The name-present branch combined with a sibling digest field
+			// must produce a fully-pinned reference.
+			name: "operator image mapping with name repository tag and digest produces pinned ref",
+			in: `spec:
+  binder:
+    image:
+      name: binder
+      repository: ghcr.io/kai
+      tag: v1
+      digest: sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b
+`,
+			want: []string{
+				"ghcr.io/kai/binder:v1@sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b",
+			},
+		},
+		{
+			// When the repository already carries an inline @digest, the
+			// sibling digest field must not re-append a different digest.
+			// The inline digest is preserved and the sibling is ignored.
+			name: "operator image mapping does not double-append digest when ref already has one",
+			in: `spec:
+  pinned:
+    image:
+      repository: ghcr.io/example/pinned@sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b
+      tag: v1
+      digest: sha256:304ab813518754228f9f792f79d6da36359b82d8ecf418096c636725f8c930ad
+`,
+			want: []string{
+				"ghcr.io/example/pinned@sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -399,13 +471,6 @@ func TestExtractImagesFromYAML_InvalidStructuredImageDescriptor(t *testing.T) {
       tag: v1`,
 			wantField: "registry",
 		},
-		{
-			name: "digest member present",
-			descriptor: `repository: ghcr.io/example/pinned
-      tag: v1
-      digest: sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b`,
-			wantField: "digest",
-		},
 		{
 			name: "empty name",
 			descriptor: `name: ""
@@ -535,6 +600,68 @@ func TestExtractImagesFromYAML_InvalidContainerSHA(t *testing.T) {
 	}
 }
 
+// TestExtractImagesFromYAML_InvalidDigestInMapping exercises the fail-loud
+// guard for the structured image descriptor's `digest` field: any value that
+// does not match `^sha256:[a-f0-9]{64}$` must surface as an
+// invalidStructuredImageDescriptorError so mirror-discovery and BOM-generation
+// callers that gate on IsInvalidStructuredImageDescriptor fail closed rather
+// than warning-and-continuing with the image omitted.
+func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      string
+		wantSub string
+	}{
+		{
+			name: "non-sha256 prefix in digest field",
+			in: `spec:
+  db:
+    image:
+      repository: docker.io/library/postgres
+      tag: "17.4"
+      digest: notasha256
+`,
+			wantSub: `field "digest"`,
+		},
+		{
+			name: "sha256 prefix but truncated hex in digest field",
+			in: `spec:
+  db:
+    image:
+      repository: docker.io/library/postgres
+      tag: "17.4"
+      digest: sha256:abc123
+`,
+			wantSub: `field "digest"`,
+		},
+		{
+			name: "uppercase hex in digest field",
+			in: `spec:
+  db:
+    image:
+      repository: docker.io/library/postgres
+      tag: "17.4"
+      digest: sha256:304AB813518754228F9F792F79D6DA36359B82D8ECF418096C636725F8C930AD
+`,
+			wantSub: `field "digest"`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := ExtractImagesFromYAML([]byte(tt.in))
+			if err == nil {
+				t.Fatal("expected error for malformed digest field")
+			}
+			if !IsInvalidStructuredImageDescriptor(err) {
+				t.Errorf("IsInvalidStructuredImageDescriptor(%v) = false, want true", err)
+			}
+			if !strings.Contains(err.Error(), tt.wantSub) {
+				t.Errorf("error %q does not contain %q", err.Error(), tt.wantSub)
+			}
+		})
+	}
+}
+
 func TestParseImageRef(t *testing.T) {
 	tests := []struct {
 		in       string