snap/pack: ensure layout sources presence for core26 and later WIP

Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>

Author: bboozzoo

snap/pack/pack.go

@@ -24,6 +24,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 
 	"github.com/snapcore/snapd/gadget"
@@ -120,9 +121,6 @@ func validateContentPlugTargets(container snap.Container, info *snap.Info) error
 		if err := plug.Attr("target", &target); err != nil || target == "" {
 			continue
 		}
-		// Only $SNAP paths (or paths with no variable prefix) can be checked at
-		// pack time; $SNAP_DATA and $SNAP_COMMON are read-write runtime
-		// directories and mount points can be created as needed.
 		if strings.HasPrefix(target, "$SNAP_DATA") || strings.HasPrefix(target, "$SNAP_COMMON") {
 			continue
 		}
@@ -142,6 +140,67 @@ func validateContentPlugTargets(container snap.Container, info *snap.Info) error
 	return nil
 }
 
+// validateLayoutSources checks that layout bind and bind-file source paths
+// exist in the snap source tree. This check only applies to snaps with base
+// core26 or later.
+func validateLayoutSources(container snap.Container, info *snap.Info) error {
+	// An empty base is equivalent to "core".
+	base := info.Base
+	if base == "" {
+		base = "core"
+	}
+	// Layout source validation does not apply to bases before core26.
+	excluded := []string{
+		"bare", "core", "core18", "core20", "core22", "core24",
+	}
+	if strutil.ListContains(excluded, base) {
+		return nil
+	}
+
+	// Sort layout paths for deterministic error reporting.
+	layoutPaths := make([]string, 0, len(info.Layout))
+	for p := range info.Layout {
+		layoutPaths = append(layoutPaths, p)
+	}
+	sort.Strings(layoutPaths)
+
+	for _, layoutPath := range layoutPaths {
+		layout := info.Layout[layoutPath]
+
+		// Determine the source path. Only check bind and bind-file;
+		// symlink targets and tmpfs layouts are not validated.
+		source := layout.Bind
+		if source == "" {
+			source = layout.BindFile
+		}
+		if source == "" {
+			continue
+		}
+
+		// Only $SNAP paths can be checked at pack time.
+		if strings.HasPrefix(source, "$SNAP_DATA") || strings.HasPrefix(source, "$SNAP_COMMON") {
+			continue
+		}
+		relPath := strings.TrimPrefix(source, "$SNAP")
+		relPath = strings.TrimPrefix(relPath, "/")
+		if relPath == "" {
+			continue
+		}
+
+		fi, err := container.Lstat(relPath)
+		if err != nil {
+			return fmt.Errorf("layout %q source %q does not exist", layoutPath, source)
+		}
+		if layout.Bind != "" && !fi.IsDir() {
+			return fmt.Errorf("layout %q source %q must be a directory", layoutPath, source)
+		}
+		if layout.BindFile != "" && fi.IsDir() {
+			return fmt.Errorf("layout %q source %q must be a file", layoutPath, source)
+		}
+	}
+	return nil
+}
+
 // CheckSkeleton attempts to validate snap data in source directory
 func CheckSkeleton(w io.Writer, sourceDir string) error {
 	yaml, err := os.ReadFile(filepath.Join(sourceDir, "meta", "snap.yaml"))
@@ -177,6 +236,9 @@ func loadAndValidate(sourceDir string, yaml []byte) (*snap.Info, error) {
 	if err := validateContentPlugTargets(container, info); err != nil {
 		return nil, err
 	}
+	if err := validateLayoutSources(container, info); err != nil {
+		return nil, err
+	}
 	if _, err := snap.ReadSnapshotYamlFromSnapFile(container); err != nil {
 		return nil, err
 	}

snap/pack/pack_test.go

@@ -745,3 +745,122 @@ plugs:
 	err := pack.CheckSkeleton(&buf, sourceDir)
 	c.Assert(err, ErrorMatches, `content interface plug "plug-missing" target "\$SNAP/missing" does not exist`)
 }
+
+type layoutSourceTestCase struct {
+	summary  string
+	base     string
+	layout   string   // layout fragment (indented, under "layout:" key)
+	plugs    string   // plugs fragment (indented, under "plugs:" key, optional)
+	files    []string // paths to create: trailing "/" = dir, otherwise file
+	errMatch string   // expected error regex, "" = no error expected
+}
+
+func (s *packSuite) checkSkeletonLayoutSource(c *C, tc layoutSourceTestCase) {
+	yamlStr := fmt.Sprintf("name: hello\nversion: 0\nbase: %s\n", tc.base)
+	if tc.plugs != "" {
+		yamlStr += "plugs:\n" + tc.plugs
+	}
+	yamlStr += "layout:\n" + tc.layout
+
+	sourceDir := makeExampleSnapSourceDir(c, yamlStr)
+	for _, f := range tc.files {
+		path := filepath.Join(sourceDir, f)
+		if strings.HasSuffix(f, "/") {
+			c.Assert(os.MkdirAll(path, 0755), IsNil)
+		} else {
+			c.Assert(os.MkdirAll(filepath.Dir(path), 0755), IsNil)
+			c.Assert(os.WriteFile(path, []byte(""), 0644), IsNil)
+		}
+	}
+	var buf bytes.Buffer
+	err := pack.CheckSkeleton(&buf, sourceDir)
+	if tc.errMatch == "" {
+		c.Assert(err, IsNil, Commentf("test: %s", tc.summary))
+	} else {
+		c.Assert(err, ErrorMatches, tc.errMatch, Commentf("test: %s", tc.summary))
+	}
+}
+
+func (s *packSuite) TestCheckSkeletonLayoutSourceValid(c *C) {
+	for _, tc := range []layoutSourceTestCase{
+		{
+			summary: "bind source directory exists",
+			base:    "core26",
+			layout:  " /opt/lib:\n  bind: $SNAP/lib\n",
+			files:   []string{"lib/"},
+		},
+		{
+			summary: "bind-file source file exists",
+			base:    "core26",
+			layout:  " /opt/foo.conf:\n  bind-file: $SNAP/foo.conf\n",
+			files:   []string{"foo.conf"},
+		},
+		{
+			summary: "source under content target with full path present",
+			base:    "core26",
+			plugs:   " gnome:\n  interface: content\n  target: $SNAP/gnome-platform\n",
+			layout:  " /usr/lib/webkit:\n  bind: $SNAP/gnome-platform/usr/lib/webkit\n",
+			files:   []string{"gnome-platform/usr/lib/webkit/"},
+		},
+		{
+			summary: "source is content target directory",
+			base:    "core26",
+			layout:  " /opt/gnome:\n  bind: $SNAP/gnome-platform\n",
+			files:   []string{"gnome-platform/"},
+		},
+		{
+			summary: "symlink layout not checked",
+			base:    "core26",
+			layout:  " /opt/data:\n  symlink: $SNAP/data\n",
+		},
+		{
+			summary: "$SNAP_DATA source skipped",
+			base:    "core26",
+			layout:  " /opt/lib:\n  bind: $SNAP_DATA/lib\n",
+		},
+		{
+			summary: "$SNAP_COMMON source skipped",
+			base:    "core26",
+			layout:  " /opt/lib:\n  bind: $SNAP_COMMON/lib\n",
+		},
+	} {
+		s.checkSkeletonLayoutSource(c, tc)
+	}
+}
+
+func (s *packSuite) TestCheckSkeletonLayoutSourceInvalid(c *C) {
+	for _, tc := range []layoutSourceTestCase{
+		{
+			summary:  "bind source missing",
+			base:     "core26",
+			layout:   " /opt/lib:\n  bind: $SNAP/lib\n",
+			errMatch: `layout "/opt/lib" source "\$SNAP/lib" does not exist`,
+		},
+		{
+			summary:  "bind source is a file not directory",
+			base:     "core26",
+			layout:   " /opt/lib:\n  bind: $SNAP/lib\n",
+			files:    []string{"lib"},
+			errMatch: `layout "/opt/lib" source "\$SNAP/lib" must be a directory`,
+		},
+		{
+			summary:  "bind-file source is a directory not file",
+			base:     "core26",
+			layout:   " /opt/foo.conf:\n  bind-file: $SNAP/foo.conf\n",
+			files:    []string{"foo.conf/"},
+			errMatch: `layout "/opt/foo.conf" source "\$SNAP/foo.conf" must be a file`,
+		},
+	} {
+		s.checkSkeletonLayoutSource(c, tc)
+	}
+}
+
+func (s *packSuite) TestCheckSkeletonLayoutSourceOldBaseSkipped(c *C) {
+	for _, base := range []string{"bare", "core", "core18", "core20", "core22", "core24"} {
+		s.checkSkeletonLayoutSource(c, layoutSourceTestCase{
+			summary: "old base " + base,
+			base:    base,
+			layout:  " /opt/lib:\n  bind: $SNAP/lib\n",
+		})
+	}
+}