Add tests and more validation for Read (#917)

* Add tests for reader and validate call in reader

* Switch to a smaller test index and update correct hard coded SHA codes

container/go/pkg/oci/BUILD

@@ -27,6 +27,7 @@ go_library(
         "@com_github_google_go_containerregistry//pkg/v1:go_default_library",
         "@com_github_google_go_containerregistry//pkg/v1/empty:go_default_library",
         "@com_github_google_go_containerregistry//pkg/v1/layout:go_default_library",
+        "@com_github_google_go_containerregistry//pkg/v1/validate:go_default_library",
         "@com_github_pkg_errors//:go_default_library",
     ],
 )

container/go/pkg/oci/reader.go

@@ -21,6 +21,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/layout"
+	"github.com/google/go-containerregistry/pkg/v1/validate"
 	"github.com/pkg/errors"
 )
 
@@ -55,5 +56,9 @@ func Read(src string) (v1.Image, error) {
 		return nil, errors.Wrapf(err, "unable to load image with digest %s obtained from the manifest", digest)
 	}
 
+	if err := validate.Image(img); err != nil {
+		return nil, errors.Wrapf(err, "unable to load image with digest %s due to invalid OCI layout format", digest)
+	}
+
 	return img, nil
 }

container/go/pkg/oci/reader_test.go

@@ -1,3 +1,18 @@
+// Copyright 2015 The Bazel Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//////////////////////////////////////////////////////////////////////
+// Tests for Read function.
 package oci
 
 import (
@@ -24,25 +39,29 @@ var readertests = []struct {
 	// testPath is the relative path of this test case.
 	testPath string
 }{
-	// This test index ensures the image downloaded by puller.go from gcr.io/distroless/base@sha256:edc3643ddf96d75032a55e240900b68b335186f1e5fea0a95af3b4cc96020b77 located in testdata/test_index1 can be loaded.
+	// This test index ensures the image downloaded by puller.go from gcr.io/asci-toolchain-sandbox/small_img@sha256:4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46 located in testdata/test_index1 can be loaded.
 	{
-		"distroless(/test_index1)",
+		"three layer small img(/test_index1)",
 		v1.Hash{
 			Algorithm: "sha256",
-			Hex:       "edc3643ddf96d75032a55e240900b68b335186f1e5fea0a95af3b4cc96020b77",
+			Hex:       "4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46",
 		},
 		v1.Hash{
 			Algorithm: "sha256",
-			Hex:       "a0cfcd4cc98a67def7ce9a0c7644d1c415d56d6d44c4a079a447f7eafb253048",
+			Hex:       "93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569",
 		},
 		[]v1.Hash{
 			v1.Hash{
 				Algorithm: "sha256",
-				Hex:       "1558143043601a425aa864511da238799b57fcf7d062d47044f6ddd0e04fe99a",
+				Hex:       "2cbd3e7a7cca7df9201e626abe080efe75e0588dda3c0188b1caf3a011f300ca",
 			},
 			v1.Hash{
 				Algorithm: "sha256",
-				Hex:       "5f5edd681dcbc3a4a9df93e200e59e1708031e65b2299970eabdc91a78cc8234",
+				Hex:       "26c668c40574f4fefe17ddfbc3a8744a5b83b8c00a03dff790cbe6a397f66d79",
+			},
+			v1.Hash{
+				Algorithm: "sha256",
+				Hex:       "3d4d5ef7eb586de880424d1613e36bc25a1617239ff81d8cf961c6481e6193af",
 			},
 		},
 		types.DockerManifestSchema2,
@@ -61,7 +80,7 @@ func TestRead(t *testing.T) {
 
 			// Validates that img does not violate any invariants of the image format by validating the layers, manifests and config.
 			if err := validate.Image(img); err != nil {
-				t.Errorf("validate.Image(): %v", err)
+				t.Fatalf("validate.Image(): %v", err)
 			}
 
 			mt, err := img.MediaType()
@@ -73,17 +92,17 @@ func TestRead(t *testing.T) {
 
 			cfg, err := img.LayerByDigest(rt.configDigest)
 			if err != nil {
-				t.Fatalf("LayerByDigest(%s): %v", rt.configDigest, err)
+				t.Errorf("LayerByDigest(%s): %v", rt.configDigest, err)
 			}
 
 			cfgName, err := img.ConfigName()
 			if err != nil {
-				t.Fatalf("ConfigName(): %v", err)
+				t.Errorf("ConfigName(): %v", err)
 			}
 
 			cfgDigest, err := cfg.Digest()
 			if err != nil {
-				t.Fatalf("cfg.Digest(): %v", err)
+				t.Errorf("cfg.Digest(): %v", err)
 			}
 
 			if got, want := cfgDigest, cfgName; got != want {
@@ -92,7 +111,7 @@ func TestRead(t *testing.T) {
 
 			layers, err := img.Layers()
 			if err != nil {
-				t.Fatalf("img.Layers(): %v", err)
+				t.Errorf("img.Layers(): %v", err)
 			}
 
 			// Validate the digests and media type for each layer.
@@ -127,3 +146,52 @@ func validateLayer(layer v1.Layer, layerHash v1.Hash) error {
 
 	return nil
 }
+
+// readerErrorTests has error handling test cases for the Read function.
+// Ensures the Read function exits gracefully when given invalid/mismatching path, digest or type.
+var readerErrorTests = []struct {
+	// name is the name of this test case.
+	name string
+	// testPath is the relative path of this test case.
+	testPath string
+}{
+	// Tests error handling for a non-existent index path.
+	{
+		"non-existent testPath",
+		"testdata/does_not_exist",
+	},
+	// Tests error handling for an index missing index.json file.
+	{
+		"missing index.json",
+		"testdata/test_index2",
+	},
+	// Tests error handling for an index missing manifest metadata file.
+	{
+		"missing manifest metadata",
+		"testdata/test_index3",
+	},
+	// Tests error handling for an index missing config metadata file.
+	{
+		"missing config file",
+		"testdata/test_index4",
+	},
+	// Tests error handling for an index missing the specified layer.
+	{
+		"missing layer",
+		"testdata/test_index5",
+	},
+}
+
+// TestReadErrors checks if each error resulted from readerErrorTests is handled appropriately.
+// Tests will fail if Read does not report an error in these cases.
+func TestReadErrors(t *testing.T) {
+	for _, rt := range readerErrorTests {
+		t.Run(rt.name, func(t *testing.T) {
+			_, err := Read(rt.testPath)
+
+			if err == nil {
+				t.Fatalf("got unexpected success when trying to read an OCI image index, want error")
+			}
+		})
+	}
+}

container/go/pkg/oci/testdata/test_index1/blobs/sha256/4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46

@@ -0,0 +1 @@
+{"config": {"digest": "sha256:93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569", "mediaType": "application/vnd.docker.container.image.v1+json", "size": 658}, "layers": [{"digest": "sha256:2cbd3e7a7cca7df9201e626abe080efe75e0588dda3c0188b1caf3a011f300ca", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 157}, {"digest": "sha256:26c668c40574f4fefe17ddfbc3a8744a5b83b8c00a03dff790cbe6a397f66d79", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}, {"digest": "sha256:3d4d5ef7eb586de880424d1613e36bc25a1617239ff81d8cf961c6481e6193af", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}], "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "schemaVersion": 2}

container/go/pkg/oci/testdata/test_index1/blobs/sha256/93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569

@@ -0,0 +1 @@
+{"architecture": "amd64", "author": "Bazel", "config": {}, "created": "1970-01-01T00:00:00Z", "history": [{"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}], "os": "linux", "rootfs": {"diff_ids": ["sha256:cfebe149e813482640cd5509f6c866bd83709a56aaa82bda6b05d633bd571591", "sha256:7bb7138798ce1c3019d6e2f306296ef3712a6ebd52368bf8ee3a2c97a6ffda41", "sha256:f2cc51d9aa9896cb1491b84be069511dccbe7140284c363c2223770aec9fcb74"], "type": "layers"}}

container/go/pkg/oci/testdata/test_index1/index.json

@@ -3,8 +3,8 @@
    "manifests": [
       {
          "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-         "size": 737,
-         "digest": "sha256:edc3643ddf96d75032a55e240900b68b335186f1e5fea0a95af3b4cc96020b77"
+         "size": 772,
+         "digest": "sha256:4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46"
       }
    ]
 }

container/go/pkg/oci/testdata/test_index2/blobs/sha256/4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46

@@ -0,0 +1 @@
+{"config": {"digest": "sha256:93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569", "mediaType": "application/vnd.docker.container.image.v1+json", "size": 658}, "layers": [{"digest": "sha256:2cbd3e7a7cca7df9201e626abe080efe75e0588dda3c0188b1caf3a011f300ca", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 157}, {"digest": "sha256:26c668c40574f4fefe17ddfbc3a8744a5b83b8c00a03dff790cbe6a397f66d79", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}, {"digest": "sha256:3d4d5ef7eb586de880424d1613e36bc25a1617239ff81d8cf961c6481e6193af", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}], "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "schemaVersion": 2}

container/go/pkg/oci/testdata/test_index2/blobs/sha256/93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569

@@ -0,0 +1 @@
+{"architecture": "amd64", "author": "Bazel", "config": {}, "created": "1970-01-01T00:00:00Z", "history": [{"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}], "os": "linux", "rootfs": {"diff_ids": ["sha256:cfebe149e813482640cd5509f6c866bd83709a56aaa82bda6b05d633bd571591", "sha256:7bb7138798ce1c3019d6e2f306296ef3712a6ebd52368bf8ee3a2c97a6ffda41", "sha256:f2cc51d9aa9896cb1491b84be069511dccbe7140284c363c2223770aec9fcb74"], "type": "layers"}}

container/go/pkg/oci/testdata/test_index2/oci-layout

@@ -0,0 +1,3 @@
+{
+    "imageLayoutVersion": "1.0.0"
+}

container/go/pkg/oci/testdata/test_index3/blobs/sha256/93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569

@@ -0,0 +1 @@
+{"architecture": "amd64", "author": "Bazel", "config": {}, "created": "1970-01-01T00:00:00Z", "history": [{"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}], "os": "linux", "rootfs": {"diff_ids": ["sha256:cfebe149e813482640cd5509f6c866bd83709a56aaa82bda6b05d633bd571591", "sha256:7bb7138798ce1c3019d6e2f306296ef3712a6ebd52368bf8ee3a2c97a6ffda41", "sha256:f2cc51d9aa9896cb1491b84be069511dccbe7140284c363c2223770aec9fcb74"], "type": "layers"}}

container/go/pkg/oci/testdata/test_index3/index.json

@@ -0,0 +1,10 @@
+{
+   "schemaVersion": 2,
+   "manifests": [
+      {
+         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+         "size": 772,
+         "digest": "sha256:4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46"
+      }
+   ]
+}

container/go/pkg/oci/testdata/test_index3/oci-layout

@@ -0,0 +1,3 @@
+{
+    "imageLayoutVersion": "1.0.0"
+}

container/go/pkg/oci/testdata/test_index4/blobs/sha256/4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46

@@ -0,0 +1 @@
+{"config": {"digest": "sha256:93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569", "mediaType": "application/vnd.docker.container.image.v1+json", "size": 658}, "layers": [{"digest": "sha256:2cbd3e7a7cca7df9201e626abe080efe75e0588dda3c0188b1caf3a011f300ca", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 157}, {"digest": "sha256:26c668c40574f4fefe17ddfbc3a8744a5b83b8c00a03dff790cbe6a397f66d79", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}, {"digest": "sha256:3d4d5ef7eb586de880424d1613e36bc25a1617239ff81d8cf961c6481e6193af", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}], "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "schemaVersion": 2}

container/go/pkg/oci/testdata/test_index4/index.json

@@ -0,0 +1,10 @@
+{
+   "schemaVersion": 2,
+   "manifests": [
+      {
+         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+         "size": 772,
+         "digest": "sha256:4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46"
+      }
+   ]
+}

container/go/pkg/oci/testdata/test_index4/oci-layout

@@ -0,0 +1,3 @@
+{
+    "imageLayoutVersion": "1.0.0"
+}

container/go/pkg/oci/testdata/test_index5/blobs/sha256/4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46

@@ -0,0 +1 @@
+{"config": {"digest": "sha256:93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569", "mediaType": "application/vnd.docker.container.image.v1+json", "size": 658}, "layers": [{"digest": "sha256:2cbd3e7a7cca7df9201e626abe080efe75e0588dda3c0188b1caf3a011f300ca", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 157}, {"digest": "sha256:26c668c40574f4fefe17ddfbc3a8744a5b83b8c00a03dff790cbe6a397f66d79", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}, {"digest": "sha256:3d4d5ef7eb586de880424d1613e36bc25a1617239ff81d8cf961c6481e6193af", "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", "size": 135}], "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "schemaVersion": 2}

container/go/pkg/oci/testdata/test_index5/blobs/sha256/93cd8b73a9da05da6e1a9739e3610cbb0f19439d693931d3bf011d1d92b9e569

@@ -0,0 +1 @@
+{"architecture": "amd64", "author": "Bazel", "config": {}, "created": "1970-01-01T00:00:00Z", "history": [{"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}, {"author": "Bazel", "created": "1970-01-01T00:00:00Z", "created_by": "bazel build ..."}], "os": "linux", "rootfs": {"diff_ids": ["sha256:cfebe149e813482640cd5509f6c866bd83709a56aaa82bda6b05d633bd571591", "sha256:7bb7138798ce1c3019d6e2f306296ef3712a6ebd52368bf8ee3a2c97a6ffda41", "sha256:f2cc51d9aa9896cb1491b84be069511dccbe7140284c363c2223770aec9fcb74"], "type": "layers"}}

container/go/pkg/oci/testdata/test_index5/index.json

@@ -0,0 +1,10 @@
+{
+   "schemaVersion": 2,
+   "manifests": [
+      {
+         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+         "size": 772,
+         "digest": "sha256:4817a495758a70edcaa9ed6723cd927f21c44e2061313b03aaf5d5ae2c1bff46"
+      }
+   ]
+}

container/go/pkg/oci/testdata/test_index5/oci-layout

@@ -0,0 +1,3 @@
+{
+    "imageLayoutVersion": "1.0.0"
+}