fix: tighten airgap checksum handling

Signed-off-by: Kimmo Lehto <klehto@mirantis.com>

Author: kke

pkg/airgap/airgap.go

@@ -229,10 +229,16 @@ func EnsureCached(ctx context.Context, k0sVersion *version.Version, artifact Art
 	if _, err := os.Stat(dest); err == nil {
 		if artifact.SHA256 != "" {
 			if err := VerifySHA256(dest, artifact.SHA256); err != nil {
-				return "", fmt.Errorf("verify cached airgap bundle: %w", err)
+				log.Warnf("cached airgap bundle %s failed checksum verification, removing it: %v", dest, err)
+				if removeErr := os.Remove(dest); removeErr != nil {
+					return "", fmt.Errorf("remove invalid cached airgap bundle %s after checksum failure: %w", dest, removeErr)
+				}
+			} else {
+				return dest, nil
 			}
+		} else {
+			return dest, nil
 		}
-		return dest, nil
 	} else if !errors.Is(err, os.ErrNotExist) {
 		return "", fmt.Errorf("stat airgap cache path %s: %w", dest, err)
 	}

pkg/airgap/airgap_test.go

@@ -1,12 +1,16 @@
 package airgap
 
 import (
+	"context"
 	"crypto/sha256"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/adrg/xdg"
 	"github.com/k0sproject/k0sctl/configurer"
 	linuxcfg "github.com/k0sproject/k0sctl/configurer/linux"
 	"github.com/k0sproject/k0sctl/pkg/apis/k0sctl.k0sproject.io/v1beta1/cluster"
@@ -90,6 +94,49 @@ func TestVerifySHA256(t *testing.T) {
 	require.ErrorContains(t, VerifySHA256(file, "0000"), "sha256 mismatch")
 }
 
+func TestEnsureCachedReplacesInvalidCachedBundle(t *testing.T) {
+	k0sVersion := version.MustParse("v1.34.1+k0s.0")
+	oldCacheHome, hadCacheHome := os.LookupEnv("XDG_CACHE_HOME")
+	require.NoError(t, os.Setenv("XDG_CACHE_HOME", t.TempDir()))
+	xdg.Reload()
+	t.Cleanup(func() {
+		if hadCacheHome {
+			require.NoError(t, os.Setenv("XDG_CACHE_HOME", oldCacheHome))
+		} else {
+			require.NoError(t, os.Unsetenv("XDG_CACHE_HOME"))
+		}
+		xdg.Reload()
+	})
+
+	content := []byte("good bundle")
+	sum := sha256.Sum256(content)
+	var requests int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		requests++
+		_, err := w.Write(content)
+		require.NoError(t, err)
+	}))
+	t.Cleanup(server.Close)
+
+	artifact := Artifact{
+		Name:   "bundle",
+		URL:    server.URL + "/bundle",
+		OS:     "linux",
+		Arch:   "amd64",
+		SHA256: fmt.Sprintf("%x", sum),
+	}
+	cachePath, err := CacheFilePath(k0sVersion, artifact.OS, artifact.Arch, artifact.Name)
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(cachePath), 0o755))
+	require.NoError(t, os.WriteFile(cachePath, []byte("bad bundle"), 0o644))
+
+	got, err := EnsureCached(context.Background(), k0sVersion, artifact)
+	require.NoError(t, err)
+	require.Equal(t, cachePath, got)
+	require.Equal(t, 1, requests)
+	require.NoError(t, VerifySHA256(cachePath, artifact.SHA256))
+}
+
 func TestLocalPath(t *testing.T) {
 	dir := t.TempDir()
 	bundle := filepath.Join(dir, "bundle")

pkg/apis/k0sctl.k0sproject.io/v1beta1/cluster/airgap.go

@@ -52,7 +52,7 @@ func (a *Airgap) Validate() error {
 		validation.Field(&a.Mode, validation.Required, validation.In(AirgapModeUpload, AirgapModeRemoteDownload)),
 		validation.Field(&a.Path, validation.Required.When(a.Source == AirgapSourceLocal)),
 		validation.Field(&a.URL, validation.Required.When(a.Source == AirgapSourceURL)),
-		validation.Field(&a.SHA256, validation.By(validateSHA256)),
+		validation.Field(&a.SHA256, validation.By(validateSHA256), validation.By(validateSHA256Source(a.Source))),
 	); err != nil {
 		return err
 	}
@@ -79,6 +79,19 @@ func validateSHA256(value any) error {
 	return nil
 }
 
+func validateSHA256Source(source string) validation.RuleFunc {
+	return func(value any) error {
+		checksum, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("not a string")
+		}
+		if source == AirgapSourceAuto && checksum != "" {
+			return fmt.Errorf("must be empty when source is %q", AirgapSourceAuto)
+		}
+		return nil
+	}
+}
+
 // Resolve prepares path-based airgap configuration after unmarshalling.
 func (a *Airgap) Resolve(baseDir string) {
 	if a == nil || a.Path == "" || filepath.IsAbs(a.Path) || baseDir == "" {

pkg/apis/k0sctl.k0sproject.io/v1beta1/cluster/k0s.go

@@ -104,12 +104,18 @@ func validateVersion(value any) error {
 }
 
 func (k *K0s) Validate() error {
-	return validation.ValidateStruct(k,
+	if err := validation.ValidateStruct(k,
 		validation.Field(&k.Version, validation.By(validateVersion)),
 		validation.Field(&k.DynamicConfig, validation.By(k.validateMinDynamic())),
 		validation.Field(&k.VersionChannel, validation.In("stable", "latest"), validation.When(k.VersionChannel != "")),
 		validation.Field(&k.Airgap),
-	)
+	); err != nil {
+		return err
+	}
+	if k.Airgap != nil && k.Airgap.Enabled && (k.Version == nil || k.Version.IsZero()) {
+		return fmt.Errorf("version is required when airgap is enabled")
+	}
+	return nil
 }
 
 func (k *K0s) validateMinDynamic() func(any) error {

pkg/apis/k0sctl.k0sproject.io/v1beta1/cluster/k0s_test.go

@@ -45,7 +45,7 @@ func TestVersionDefaulting(t *testing.T) {
 }
 
 func TestAirgapDefaults(t *testing.T) {
-	k0s := &K0s{Airgap: &Airgap{Enabled: true}}
+	k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true}}
 
 	require.NoError(t, defaults.Set(k0s))
 	require.NoError(t, k0s.Validate())
@@ -63,29 +63,39 @@ func TestAirgapValidateSetsDefaults(t *testing.T) {
 
 func TestAirgapValidation(t *testing.T) {
 	t.Run("local requires path", func(t *testing.T) {
-		k0s := &K0s{Airgap: &Airgap{Enabled: true, Source: AirgapSourceLocal}}
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, Source: AirgapSourceLocal}}
 		require.ErrorContains(t, k0s.Validate(), "Path: cannot be blank")
 	})
 
 	t.Run("url requires url", func(t *testing.T) {
-		k0s := &K0s{Airgap: &Airgap{Enabled: true, Source: AirgapSourceURL}}
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, Source: AirgapSourceURL}}
 		require.ErrorContains(t, k0s.Validate(), "URL: cannot be blank")
 	})
 
 	t.Run("invalid source", func(t *testing.T) {
-		k0s := &K0s{Airgap: &Airgap{Enabled: true, Source: "other"}}
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, Source: "other"}}
 		require.ErrorContains(t, k0s.Validate(), "Source: must be a valid value")
 	})
 
 	t.Run("remote download deferred", func(t *testing.T) {
-		k0s := &K0s{Airgap: &Airgap{Enabled: true, Mode: AirgapModeRemoteDownload}}
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, Mode: AirgapModeRemoteDownload}}
 		require.ErrorContains(t, k0s.Validate(), `mode "remoteDownload" is not supported yet`)
 	})
 
 	t.Run("invalid sha256", func(t *testing.T) {
-		k0s := &K0s{Airgap: &Airgap{Enabled: true, SHA256: "abc123"}}
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, Source: AirgapSourceURL, URL: "https://example.invalid/bundle", SHA256: "abc123"}}
 		require.ErrorContains(t, k0s.Validate(), "SHA256: must be 64 hex characters")
 	})
+
+	t.Run("auto source rejects sha256", func(t *testing.T) {
+		k0s := &K0s{Version: version.MustParse("v1.34.1+k0s.0"), Airgap: &Airgap{Enabled: true, SHA256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}}
+		require.ErrorContains(t, k0s.Validate(), `SHA256: must be empty when source is "auto"`)
+	})
+
+	t.Run("airgap requires version", func(t *testing.T) {
+		k0s := &K0s{Airgap: &Airgap{Enabled: true}}
+		require.ErrorContains(t, k0s.Validate(), "version is required when airgap is enabled")
+	})
 }
 
 func TestNodeConfigUsesLowercaseMetadataKey(t *testing.T) {