baker.go

package carvel

import (
	"crypto/sha1"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"io/fs"
	"os"
	"os/exec"
	"path"
	"path/filepath"
	"regexp"
	"sort"
	"strings"

	"github.com/pivotal-cf/kiln/internal/carvel/models"
	"github.com/pivotal-cf/kiln/internal/component"
	"github.com/pivotal-cf/kiln/pkg/cargo"
	"github.com/pivotal-cf/kiln/pkg/proofing"

	"github.com/hashicorp/go-version"
	"gopkg.in/yaml.v3"
)

type BakeOptions struct {
	SkipFetch         bool
	ReleasesDirectory string
}

// Baker transforms an imgpkg bundle and tile metadata into a BOSH release
// and kiln-compatible tile structure that can be baked into a .pivotal file.
type Baker interface {
	Bake(source string, kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, opts BakeOptions) error
	BakeFromLockfile(source string, kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, releaseLock cargo.BOSHReleaseTarballLock, localTarball string, opts BakeOptions) error
	KilnBake(destination string) error
	ParseMetadata(source string) error
	GetName() string
	// GetVersion returns the product version from base.yml or the version file.
	GetVersion() (string, error)
	// GetReleaseVersion returns the BOSH release version, which includes a
	// content fingerprint suffix (e.g., "10.4.0+a1b2c3d4e5f6"). Only valid
	// after Bake() or BakeFromLockfile() has been called.
	GetReleaseVersion() string
	GetReleaseTarball() (string, error)
	SetWriter(w io.Writer)
	SetProgressWriter(w io.Writer)
}

// NewBaker creates a new Baker for transforming imgpkg bundles into BOSH releases.
func NewBaker() Baker {
	return &baker{
		writer:         io.Discard,
		progressWriter: io.Discard,
	}
}

type baker struct {
	metadata            models.Metadata
	source, destination string
	releaseVersion      string
	writer              io.Writer
	progressWriter      io.Writer
}

func (b *baker) KilnBake(destination string) error {
	b.progress("Assembling final .pivotal file...")
	cmd := exec.Command("kiln",
		"bake",
		"--skip-fetch",
		"--output-file", destination,
	)
	cmd.Dir = b.destination
	out, err := cmd.CombinedOutput()
	b.log(string(out))
	if err != nil {
		b.log("failed to invoke kiln: " + string(out))
		return err
	}

	return nil
}

func (b *baker) Bake(source string, kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, opts BakeOptions) error {
	b.source = source
	b.destination = path.Join(source, ".carvel-tile")

	b.progress("Reading tile metadata from " + path.Join(source, "base.yml"))
	yamlPath := path.Join(source, "base.yml")
	yamlData, err := os.ReadFile(yamlPath)
	if err != nil {
		return err
	}

	err = yaml.Unmarshal(yamlData, &b.metadata)
	if err != nil {
		return err
	}
	if err := validateVariables(b.metadata.Variables); err != nil {
		return err
	}

	ver, err := b.GetVersion()
	if err != nil {
		return err
	}
	b.progress(fmt.Sprintf("Tile: %s version %s (metadata_version %s)", b.metadata.Name, ver, b.metadata.MetadataVersion))

	metadataVersion, err := version.NewVersion(b.metadata.MetadataVersion)
	if err != nil {
		return err
	}
	minVersion, _ := version.NewVersion("3.2.0")
	if metadataVersion.LessThan(minVersion) {
		return errors.New("tile metadata_version too old for kubernetes support (must be >=3.2.0)")
	}

	b.progress("Generating BOSH release structure...")
	err = b.generateBoshReleaseDir()
	if err != nil {
		b.log(err.Error())
		return err
	}

	b.progress("Generating tile layout in " + b.destination)
	err = b.generateOutputTile(kilnfile, kilnfileLock, opts)
	if err != nil {
		b.log(err.Error())
		return err
	}

	return nil
}

func (b *baker) BakeFromLockfile(source string, kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, releaseLock cargo.BOSHReleaseTarballLock, localTarball string, opts BakeOptions) error {
	b.source = source
	b.destination = path.Join(source, ".carvel-tile")

	b.progress("Reading tile metadata from " + path.Join(source, "base.yml"))
	yamlPath := path.Join(source, "base.yml")
	yamlData, err := os.ReadFile(yamlPath)
	if err != nil {
		return err
	}

	err = yaml.Unmarshal(yamlData, &b.metadata)
	if err != nil {
		return err
	}
	if err := validateVariables(b.metadata.Variables); err != nil {
		return err
	}

	ver, err := b.GetVersion()
	if err != nil {
		return err
	}
	b.progress(fmt.Sprintf("Tile: %s version %s (metadata_version %s)", b.metadata.Name, ver, b.metadata.MetadataVersion))

	if releaseLock.Name != b.metadata.Name {
		return fmt.Errorf("lockfile release name %q does not match tile name %q", releaseLock.Name, b.metadata.Name)
	}

	b.releaseVersion = releaseLock.Version

	err = os.RemoveAll(b.destination)
	if err != nil {
		return err
	}
	err = os.MkdirAll(b.destination, 0755)
	if err != nil {
		return err
	}

	b.progress("Generating tile layout in " + b.destination)
	err = b.generateBaseYaml()
	if err != nil {
		return err
	}
	err = b.copyFiles()
	if err != nil {
		return err
	}
	err = b.generateJobFiles()
	if err != nil {
		return err
	}
	err = b.generateInstanceGroupFiles()
	if err != nil {
		return err
	}
	err = b.generateRuntimeConfigs()
	if err != nil {
		return err
	}

	releasesDir := path.Join(b.destination, "releases")
	err = os.MkdirAll(releasesDir, 0755)
	if err != nil {
		return err
	}

	destTarball := path.Join(releasesDir, b.metadata.Name+"-"+releaseLock.Version+".tgz")

	b.progress("Copying cached BOSH release from " + localTarball)
	b.log("copying cached BOSH release from " + localTarball)
	err = copyFileContents(localTarball, destTarball)
	if err != nil {
		return fmt.Errorf("failed to copy cached release tarball: %w", err)
	}

	// We also need to fetch any additional releases when baking from lockfile,
	// otherwise the final .pivotal assembly will fail because it looks for them.
	if len(b.metadata.AdditionalReleases) > 0 {
		b.progress("  Fetching additional BOSH releases")
		err = b.fetchAdditionalReleases(kilnfile, kilnfileLock, opts)
		if err != nil {
			return err
		}
	}

	return nil
}

func (b *baker) GetReleaseTarball() (string, error) {
	if b.releaseVersion == "" {
		return "", fmt.Errorf("release version not set -- call Bake() or BakeFromLockfile() first")
	}
	tarball := path.Join(b.destination, "releases", b.metadata.Name+"-"+b.releaseVersion+".tgz")
	if _, err := os.Stat(tarball); err != nil {
		return "", fmt.Errorf("release tarball not found at %s: %w", tarball, err)
	}
	return tarball, nil
}

func (b *baker) ParseMetadata(source string) error {
	b.source = source
	baseYMLPath := path.Join(source, "base.yml")
	raw, err := os.ReadFile(baseYMLPath)
	if err != nil {
		return fmt.Errorf("failed to read base.yml: %w", err)
	}
	if err := yaml.Unmarshal(raw, &b.metadata); err != nil {
		return fmt.Errorf("failed to parse base.yml: %w", err)
	}
	return nil
}

func (b *baker) GetName() string {
	return b.metadata.Name
}

func (b *baker) hookJobName(hookName string) string {
	prefix := b.metadata.Name + "-"
	if strings.HasPrefix(hookName, prefix) {
		return hookName
	}
	return prefix + hookName
}

func (b *baker) GetReleaseVersion() string {
	return b.releaseVersion
}

func (b *baker) GetVersion() (string, error) {
	re := regexp.MustCompile(`\s+`)

	// Replace all occurrences of whitespace with an empty string
	versionNoSpace := re.ReplaceAllString(b.metadata.ProductVersion, "")
	if versionNoSpace != `$(version)` {
		return versionNoSpace, nil
	} else {
		// find the version from a "version" file
		version, err := os.ReadFile(path.Join(b.source, "version"))
		return strings.Trim(string(version), " \t\n\r"), err
	}
}

func (b *baker) SetWriter(w io.Writer) {
	b.writer = w
}

func (b *baker) SetProgressWriter(w io.Writer) {
	b.progressWriter = w
}

func (b *baker) log(message string) {
	_, _ = fmt.Fprintln(b.writer, message)
}

func (b *baker) progress(message string) {
	_, _ = fmt.Fprintln(b.progressWriter, message)
}

// deduplicateConsumes removes duplicate BOSH link consumer entries by name.
// Identical duplicates are dropped silently. If two entries share a name but
// differ in type or optional, the first is kept and a WARNING is emitted —
// BOSH rejects duplicate link names in job.MF, so the second is always ignored.
func (b *baker) deduplicateConsumes(consumes []boshLinkConsumer) []boshLinkConsumer {
	seen := make(map[string]boshLinkConsumer)
	var deduped []boshLinkConsumer
	for _, c := range consumes {
		existing, ok := seen[c.Name]
		if !ok {
			seen[c.Name] = c
			deduped = append(deduped, c)
			continue
		}
		if existing != c {
			b.progress(fmt.Sprintf(
				"WARNING: duplicate BOSH link consumer name %q found across packageinstalls.\n"+
					"  Keeping:  {type: %s, optional: %v}\n"+
					"  Ignoring: {type: %s, optional: %v}\n"+
					"  Ensure all packageinstalls agree on the link definition.",
				c.Name, existing.Type, existing.Optional, c.Type, c.Optional,
			))
		}
	}
	return deduped
}

// boshLinkConsumer declares a BOSH link the registry-data job should consume.
// Populated from per-packageinstall *.job-spec-overlay.yml sidecar files.
type boshLinkConsumer struct {
	Name     string `yaml:"name"`
	Type     string `yaml:"type"`
	Optional bool   `yaml:"optional"`
}

// jobSpecOverlay is the schema for <entry>.job-spec-overlay.yml sidecar files.
// kiln reads these from packageinstalls/ and merges the consumes entries into
// the generated registry-data job.MF alongside the hardcoded cluster-info link.
type jobSpecOverlay struct {
	Consumes []boshLinkConsumer `yaml:"consumes"`
}

func validateVariables(vars []proofing.Variable) error {
	var errs []error
	for i, v := range vars {
		if v.Name == "" {
			errs = append(errs, fmt.Errorf("variables[%d]: missing required field 'name'", i))
		} else if v.Type == "" {
			errs = append(errs, fmt.Errorf("variables[%d] (%q): missing required field 'type'", i, v.Name))
		}
	}
	return errors.Join(errs...)
}

func (b *baker) generateBoshReleaseDir() error {
	dirName := path.Join(b.source, ".boshrelease")
	err := os.RemoveAll(dirName)
	if err != nil {
		return err
	}

	b.progress("  Initializing BOSH release")
	commands := []*exec.Cmd{
		exec.Command("bosh", "init-release", "--dir="+dirName),
		exec.Command("bosh", "add-blob", "--dir="+dirName, path.Join(b.source, "bundle.tar"), "imgpkg/bundle.tar"),
		exec.Command("bosh", "generate-package", "--dir="+dirName, "registry-data"),
		exec.Command("bosh", "generate-job", "--dir="+dirName, "registry-data"),
	}
	for _, cmd := range commands {
		b.log("executing " + cmd.String())
		out, err := cmd.CombinedOutput()
		if err != nil {
			return err
		}

		b.log("output: " + string(out))
	}

	// Now populate the specs for packages and jobs
	fileContents := map[string]string{
		"packages/registry-data/packaging": `set -eu
mkdir -p ${BOSH_INSTALL_TARGET}/imgpkg
cp imgpkg/*.tar ${BOSH_INSTALL_TARGET}/imgpkg
`,
		"packages/registry-data/spec": `---
name: registry-data
dependencies: []
files:
- imgpkg/bundle.tar
`,
	}
	for outpath, contents := range fileContents {
		err = os.WriteFile(path.Join(dirName, outpath), []byte(contents), 0644)
		if err != nil {
			return err
		}
	}

	registryDataTemplates := ""
	registryDataProperties := ""
	var allConsumes []boshLinkConsumer

	b.progress("  Configuring package installs")
	for _, entry := range b.metadata.PackageInstalls {
		entry = strings.Trim(entry, "$() ")
		entry = strings.TrimPrefix(entry, "package")
		entry = strings.Trim(entry, `"' `)

		b.progress("    - " + entry)
		b.log("looking for package install: " + entry)

		// find this entry in the packageinstalls directory
		matches, err := filepath.Glob(path.Join(b.source, "packageinstalls/*.yml"))
		if err != nil {
			return err
		}

		for _, match := range matches {
			yamlData, err := os.ReadFile(match)
			if err != nil {
				return err
			}

			var pi models.PackageInstall
			err = yaml.Unmarshal(yamlData, &pi)
			if err != nil {
				return err
			}
			if pi.Name != entry {
				continue
			}

			b.log("found " + pi.Name + " at " + match)
		}

		registryDataTemplates += fmt.Sprintf("  packageinstalls/%s.yml.erb: packageinstalls/%s.yml\n", entry, entry)

		registryDataProperties += "  " + entry + ":\n"
		registryDataProperties += `    name:
      description: "package name"
    version:
      description: "package version"
    values:
      description: "values.yml contents"
`

		if err = os.MkdirAll(path.Join(dirName, "jobs", "registry-data", "templates", "packageinstalls"), 0755); err != nil {
			return err
		}

		// Read optional values-overlay ERB file alongside the packageinstall YAML.
		overlayContent := ""
		overlayData, overlayErr := os.ReadFile(path.Join(b.source, "packageinstalls", entry+".values-overlay.erb"))
		if overlayErr != nil {
			if !errors.Is(overlayErr, os.ErrNotExist) {
				return overlayErr
			}
		} else {
			overlayContent = string(overlayData)
		}

		// Read optional job-spec-overlay sidecar to discover additional BOSH link consumptions.
		jobSpecOverlayPath := path.Join(b.source, "packageinstalls", entry+".job-spec-overlay.yml")
		overlayData, overlayErr = os.ReadFile(jobSpecOverlayPath)
		if overlayErr != nil {
			if !errors.Is(overlayErr, os.ErrNotExist) {
				return overlayErr
			}
		} else {
			var overlay jobSpecOverlay
			if parseErr := yaml.Unmarshal(overlayData, &overlay); parseErr != nil {
				return fmt.Errorf("parsing %s: %w", jobSpecOverlayPath, parseErr)
			}
			allConsumes = append(allConsumes, overlay.Consumes...)
		}

		manifestTemplate := generateManifestTemplate(entry, overlayContent)

		err = os.WriteFile(
			path.Join(dirName, "jobs", "registry-data", "templates", "packageinstalls", entry+".yml.erb"),
			[]byte(manifestTemplate),
			0644,
		)
		if err != nil {
			return err
		}
	}

	deduped := b.deduplicateConsumes(allConsumes)

	registryDataSpec, err := buildRegistryDataSpec(registryDataTemplates, registryDataProperties, deduped)
	if err != nil {
		return err
	}

	err = os.WriteFile(path.Join(dirName, "jobs", "registry-data", "spec"), []byte(registryDataSpec), 0644)
	if err != nil {
		return err
	}

	type hookModeGroup struct {
		mode  string
		hooks []models.HookDeclaration
	}
	for _, group := range []hookModeGroup{
		{mode: "pre-install", hooks: b.metadata.PreInstallHooks},
		{mode: "post-install", hooks: b.metadata.PostInstallHooks},
	} {
		for _, hook := range group.hooks {
			if hook.Name == "" || hook.Command == "" {
				return fmt.Errorf("%s hook declaration missing name or command", group.mode)
			}

			jobName := b.hookJobName(hook.Name)

			genCmd := exec.Command("bosh", "generate-job", "--dir="+dirName, jobName)
			b.log("executing " + genCmd.String())
			out, err := genCmd.CombinedOutput()
			b.log("output: " + string(out))
			if err != nil {
				return err
			}

			templateName := "hooks-" + group.mode + ".erb"
			jobSpec := fmt.Sprintf(`---
name: %s
templates:
  %s: bin/hooks/%s
packages: []
properties: {}
`, jobName, templateName, group.mode)
			if err = os.WriteFile(path.Join(dirName, "jobs", jobName, "spec"), []byte(jobSpec), 0644); err != nil {
				return err
			}

			if err = os.MkdirAll(path.Join(dirName, "jobs", jobName, "templates"), 0755); err != nil {
				return err
			}
			templateContent := fmt.Sprintf("#!/bin/bash\nset -euo pipefail\nexec %s\n", hook.Command)
			err = os.WriteFile(
				path.Join(dirName, "jobs", jobName, "templates", templateName),
				[]byte(templateContent),
				0644,
			)
			if err != nil {
				return err
			}
		}
	}

	return nil
}

// buildRegistryDataSpec constructs the job.MF content for the registry-data BOSH job.
// It always includes the hardcoded cluster-info link and appends any additional links
// collected from *.job-spec-overlay.yml sidecars in the packageinstalls/ directory.
func buildRegistryDataSpec(templates, properties string, additionalLinks []boshLinkConsumer) (string, error) {
	extraLinks := ""
	if len(additionalLinks) > 0 {
		data, err := yaml.Marshal(additionalLinks)
		if err != nil {
			return "", err
		}
		extraLinks = string(data)
	}
	return `---
name: registry-data
templates:
` + templates + `packages:
- registry-data
consumes:
- name: cluster
  type: cluster-info
  optional: true
` + extraLinks + `properties:
` + properties, nil
}

// generateManifestTemplate produces the ERB template for the registry-data BOSH job.
// overlayContent is optional ERB code injected into the values manipulation block
// before YAML.dump(values) is called, enabling BOSH link-based value overrides.
func generateManifestTemplate(entry, overlayContent string) string {
	return `---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: <%= p("` + entry + `.name") %>-sa
  namespace: <%= link("cluster").p("content-namespace") rescue "default" %>
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <%= p("` + entry + `.name") %>-sa-cluster-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: <%= p("` + entry + `.name") %>-sa-cluster-role-binding
subjects:
- kind: ServiceAccount
  name: <%= p("` + entry + `.name") %>-sa
  namespace: <%= link("cluster").p("content-namespace") rescue "default" %>
roleRef:
  kind: ClusterRole
  name: <%= p("` + entry + `.name") %>-sa-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Secret
metadata:
  name: <%= p("` + entry + `.name") %>-values
  namespace: <%= link("cluster").p("content-namespace") rescue "default" %>
type: Opaque
stringData:
  values.yaml: |
<% require 'yaml' %>
<%
  values = p("` + entry + `.values")
  values = YAML.load(values) if values.is_a?(String)
  # Inject namespace from BOSH link into context
  if values.is_a?(Hash) && values["context"].is_a?(Hash)
    values["context"]["namespace"] = link("cluster").p("content-namespace") rescue "default"
  end
%>
` + overlayContent + `
<%= YAML.dump(values).split("\n").map { |line| "    " + line }.join("\n") %>
---
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: <%= p("` + entry + `.name") %>
  namespace: <%= link("cluster").p("content-namespace") rescue "default" %>
spec:
  serviceAccountName: <%= p("` + entry + `.name") %>-sa
  packageRef:
    refName: <%= p("` + entry + `.name") %>
    versionSelection:
      constraints: <%= p("` + entry + `.version") %>
  values:
  - secretRef:
      name: <%= p("` + entry + `.name") %>-values
`
}

func (b *baker) generateOutputTile(kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, opts BakeOptions) error {
	err := os.RemoveAll(b.destination)
	if err != nil {
		return err
	}

	err = os.MkdirAll(b.destination, 0755)
	if err != nil {
		return err
	}

	b.progress("  Generating base.yml")
	err = b.generateBaseYaml()
	if err != nil {
		return err
	}

	b.progress("  Copying forms, properties, and static assets")
	err = b.copyFiles()
	if err != nil {
		return err
	}

	err = b.generateJobFiles()
	if err != nil {
		return err
	}

	err = b.generateInstanceGroupFiles()
	if err != nil {
		return err
	}

	b.progress("  Generating runtime configs")
	err = b.generateRuntimeConfigs()
	if err != nil {
		return err
	}

	if len(b.metadata.AdditionalReleases) > 0 {
		b.progress("  Fetching additional BOSH releases")
		err = b.fetchAdditionalReleases(kilnfile, kilnfileLock, opts)
		if err != nil {
			return err
		}
	}

	b.progress("  Creating BOSH release tarball (this may take a while)...")
	err = b.createBoshRelease()
	if err != nil {
		return err
	}

	return nil
}

func (b *baker) generateBaseYaml() error {
	meta := models.MetadataOut{}
	meta.Name = b.metadata.Name
	meta.Label = b.metadata.Label
	meta.IconImage = b.metadata.IconImage
	meta.ProductVersion = b.metadata.ProductVersion
	meta.MetadataVersion = b.metadata.MetadataVersion
	meta.Rank = b.metadata.Rank
	meta.Serial = b.metadata.Serial
	meta.CompatibleKubernetesDistributions = b.metadata.CompatibleKubernetesDistributions
	meta.FormTypes = b.metadata.FormTypes
	meta.PropertyBlueprints = b.metadata.PropertyBlueprints
	meta.Variables = b.metadata.Variables
	meta.MinimumVersionForUpgrade = b.metadata.MinimumVersionForUpgrade
	meta.RequiresKubernetes = true
	// stemcell criteria are dummy data that OM will ignore when the tile is folded into
	// TKR, but we need them as kiln inputs.
	meta.StemcellCriteria.Os = "ubuntu-jammy"
	meta.StemcellCriteria.Version = "1.446"
	meta.InstanceGroups = []string{}
	meta.RuntimeConfigs = []string{
		`$( runtime_config "` + b.metadata.Name + `-pkgr" )`,
	}

	meta.Releases = []string{
		`$( release "` + b.metadata.Name + `" )`,
	}
	for _, ar := range b.metadata.AdditionalReleases {
		meta.Releases = append(meta.Releases, `$( release "`+ar.Name+`" )`)
	}

	yamlData, err := yaml.Marshal(&meta)
	if err != nil {
		return err
	}
	err = os.WriteFile(path.Join(b.destination, "base.yml"), yamlData, 0644) // 0644 sets file permissions
	if err != nil {
		return err
	}
	return nil
}

// copyfiles schleps all the files that we can collect from the source directory without
// modification:
// - variables, properties and forms
// - the icon file
// - the version file
func (b *baker) copyFiles() error {
	for _, subdir := range []string{"bosh_variables", "forms", "properties"} {
		info, err := os.Stat(path.Join(b.source, subdir))
		if err == nil && info.IsDir() {
			err = os.CopyFS(path.Join(b.destination, subdir), os.DirFS(path.Join(b.source, subdir)))
			if err != nil {
				return err
			}
		}
	}

	for _, fn := range []string{"icon.png", "version"} {
		info, statErr := os.Stat(path.Join(b.source, fn))
		if statErr == nil && !info.IsDir() {
			if err := copyFileContents(path.Join(b.source, fn), path.Join(b.destination, fn)); err != nil {
				return err
			}
		}
	}

	return nil
}

func (b *baker) generateRuntimeConfigs() error {
	err := os.MkdirAll(path.Join(b.destination, "runtime_configs"), 0755)
	if err != nil {
		return err
	}

	registryDataProps := map[string]interface{}{}

	// we need one PackageInstall for each entry in the metadata.
	for _, entry := range b.metadata.PackageInstalls {
		entry = strings.Trim(entry, "$() ")
		entry = strings.TrimPrefix(entry, "package")
		entry = strings.Trim(entry, `"' `)

		// find this entry in the packageinstalls directory
		matches, err := filepath.Glob(path.Join(b.source, "packageinstalls/*.yml"))
		if err != nil {
			return err
		}

		found := false
		for _, match := range matches {
			yamlData, err := os.ReadFile(match)
			if err != nil {
				return err
			}

			var pi models.PackageInstall
			err = yaml.Unmarshal(yamlData, &pi)
			if err != nil {
				return err
			}
			if pi.Name != entry {
				continue
			}

			found = true
			registryDataProps[entry] = models.PackageInstallProps{
				Name:    pi.PackageName,
				Version: pi.PackageVersion,
				Values:  pi.Values,
			}
		}
		if !found {
			return errors.New("package install not found: " + entry)
		}
	}

	registryDataJob := models.Job{
		Name:       "registry-data",
		Release:    b.metadata.Name,
		Properties: registryDataProps,
	}

	releases := []string{`$( release "` + b.metadata.Name + `" )`}
	addonJobs := []models.Job{registryDataJob}

	for _, hook := range append(
		append([]models.HookDeclaration{}, b.metadata.PreInstallHooks...),
		b.metadata.PostInstallHooks...,
	) {
		if hook.Name == "" || hook.Command == "" {
			return fmt.Errorf("hook declaration missing name or command")
		}
		addonJobs = append(addonJobs, models.Job{Name: b.hookJobName(hook.Name), Release: b.metadata.Name})
	}

	for _, ar := range b.metadata.AdditionalReleases {
		releases = append(releases, `$( release "`+ar.Name+`" )`)
		for _, job := range ar.Jobs {
			addonJobs = append(addonJobs, models.Job{
				Name:       job.Name,
				Release:    ar.Name,
				Properties: job.Properties,
			})
		}
	}

	inner := models.RuntimeConfigInner{
		Releases: releases,
		Addons: []models.Addon{
			{
				Name: b.metadata.Name + "-pkgr",
				Include: models.Inclusion{
					Deployments: []string{
						`(( ..` + b.metadata.Name + `.deployment_name ))`,
					},
					Jobs: []models.Job{
						{Name: "install-package-repository", Release: "tanzu-content"},
						{Name: "install-packages", Release: "tanzu-content"},
					},
				},
				Jobs: addonJobs,
			},
		},
	}
	yamlData, err := yaml.Marshal(&inner)
	if err != nil {
		return err
	}
	rc := models.RuntimeConfigOuter{
		Name:          b.metadata.Name + "-pkgr",
		RuntimeConfig: string(yamlData),
	}

	yamlData, err = yaml.Marshal(&rc)
	if err != nil {
		return err
	}
	err = os.WriteFile(path.Join(b.destination, "runtime_configs", b.metadata.Name+"-pkgr.yml"), yamlData, 0644)
	if err != nil {
		return err
	}

	return nil
}

// generateInstanceGroups creates an empty instance group folder
func (b *baker) generateInstanceGroupFiles() error {
	err := os.MkdirAll(path.Join(b.destination, "instance_groups"), 0755)
	if err != nil {
		return err
	}

	return nil
}

// generateJobFiles creates an empty jobs folder
func (b *baker) generateJobFiles() error {
	err := os.MkdirAll(path.Join(b.destination, "jobs"), 0755)
	if err != nil {
		return err
	}

	return nil
}

func (b *baker) fetchAdditionalReleases(kilnfile cargo.Kilnfile, kilnfileLock cargo.KilnfileLock, opts BakeOptions) error {
	releasesDir := path.Join(b.destination, "releases")
	if err := os.MkdirAll(releasesDir, 0755); err != nil {
		return err
	}
	sources := component.NewReleaseSourceRepo(kilnfile)

	for _, ar := range b.metadata.AdditionalReleases {
		lockEntry, found := findReleaseLock(kilnfileLock, ar.Name)
		if !found {
			return fmt.Errorf("additional_releases entry %q not found in Kilnfile.lock — run `kiln fetch` or add it to Kilnfile", ar.Name)
		}

		dst := path.Join(releasesDir, ar.Name+"-"+lockEntry.Version+".tgz")
		src := path.Join(opts.ReleasesDirectory, additionalReleaseLocalFilename(sources, ar.Name, lockEntry))

		if opts.SkipFetch {
			if _, err := os.Stat(src); err != nil {
				return fmt.Errorf("release %q not found in %s and --skip-fetch was set: %w", ar.Name, opts.ReleasesDirectory, err)
			}
			if src != dst {
				if err := copyFileContents(src, dst); err != nil {
					return fmt.Errorf("failed to copy additional release %q: %w", ar.Name, err)
				}
			}
			continue
		}

		if _, err := os.Stat(src); err == nil {
			f, err := os.Open(src)
			if err == nil {
				h := sha1.New()
				if _, err := io.Copy(h, f); err == nil {
					actualSHA1 := hex.EncodeToString(h.Sum(nil))
					if lockEntry.SHA1 == "" || actualSHA1 == lockEntry.SHA1 {
						b.progress(fmt.Sprintf("  Release %s %s already exists locally with correct SHA1 — skipping fetch", lockEntry.Name, lockEntry.Version))
						f.Close()
						if src != dst {
							if err := copyFileContents(src, dst); err != nil {
								return fmt.Errorf("failed to copy additional release %q: %w", ar.Name, err)
							}
						}
						continue
					}
				}
				f.Close()
			}
		}

		b.progress(fmt.Sprintf("  Fetching %s %s from %s", lockEntry.Name, lockEntry.Version, lockEntry.RemoteSource))
		local, err := sources.DownloadRelease(opts.ReleasesDirectory, lockEntry)
		if err != nil {
			return fmt.Errorf("failed to download additional release %q: %w", ar.Name, err)
		}
		if lockEntry.SHA1 != "" && local.Lock.SHA1 != lockEntry.SHA1 {
			return fmt.Errorf("downloaded release %q had incorrect SHA1 - expected %q, got %q", ar.Name, lockEntry.SHA1, local.Lock.SHA1)
		}
		if local.LocalPath != dst {
			if err := copyFileContents(local.LocalPath, dst); err != nil {
				return err
			}
		}
	}
	return nil
}

func additionalReleaseLocalFilename(sources component.ReleaseSourceList, name string, lockEntry cargo.BOSHReleaseTarballLock) string {
	defaultName := name + "-" + lockEntry.Version + ".tgz"
	if lockEntry.RemotePath == "" || lockEntry.RemoteSource == "" {
		return defaultName
	}
	source, err := sources.FindByID(lockEntry.RemoteSource)
	if err != nil {
		return defaultName
	}
	switch source.Configuration().Type {
	case cargo.BOSHReleaseTarballSourceTypeS3, cargo.BOSHReleaseTarballSourceTypeArtifactory:
		return filepath.Base(lockEntry.RemotePath)
	default:
		return defaultName
	}
}

func findReleaseLock(lock cargo.KilnfileLock, name string) (cargo.BOSHReleaseTarballLock, bool) {
	for _, r := range lock.Releases {
		if r.Name == name {
			return r, true
		}
	}
	return cargo.BOSHReleaseTarballLock{}, false
}

func (b *baker) createBoshRelease() error {
	err := os.MkdirAll(path.Join(b.destination, "releases"), 0755)
	if err != nil {
		return err
	}

	productVersion, err := b.GetVersion()
	if err != nil {
		return err
	}

	dirName := path.Join(b.source, ".boshrelease")

	fingerprint, err := hashBoshReleaseInputs(dirName)
	if err != nil {
		return err
	}

	releaseVersion := buildReleaseVersion(productVersion, fingerprint)
	b.releaseVersion = releaseVersion

	finalTarball := path.Join(b.destination, "releases", b.metadata.Name+"-"+releaseVersion+".tgz")
	cmd := exec.Command("bosh",
		"create-release",
		"--dir="+dirName,
		"--force",
		"--name", b.metadata.Name,
		"--version", releaseVersion,
		"--tarball", finalTarball)
	b.log("executing " + cmd.String())
	out, err := cmd.CombinedOutput()
	b.log("output: " + string(out))
	if err != nil {
		return err
	}

	b.progress(fmt.Sprintf("  BOSH release version: %s", releaseVersion))
	return nil
}

func hashBoshReleaseInputs(boshReleaseDir string) (string, error) {
	h := sha256.New()

	var paths []string
	err := filepath.WalkDir(boshReleaseDir, func(p string, d fs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if d.IsDir() {
			if d.Name() == ".git" {
				return filepath.SkipDir
			}
			return nil
		}
		rel, err := filepath.Rel(boshReleaseDir, p)
		if err != nil {
			return err
		}
		paths = append(paths, rel)
		return nil
	})
	if err != nil {
		return "", fmt.Errorf("failed to walk .boshrelease directory: %w", err)
	}

	sort.Strings(paths)

	for _, rel := range paths {
		_, _ = fmt.Fprintf(h, "path:%s\n", rel)

		f, err := os.Open(filepath.Join(boshReleaseDir, rel))
		if err != nil {
			return "", err
		}
		if _, err := io.Copy(h, f); err != nil {
			_ = f.Close()
			return "", err
		}
		_ = f.Close()
	}

	return hex.EncodeToString(h.Sum(nil))[:12], nil
}

func buildReleaseVersion(productVersion, fingerprint string) string {
	if strings.Contains(productVersion, "+") {
		return productVersion + "." + fingerprint
	}
	return productVersion + "+" + fingerprint
}

func copyFileContents(src, dst string) (err error) {
	in, err := os.Open(src)
	if err != nil {
		return
	}
	defer func() { _ = in.Close() }()
	out, err := os.Create(dst)
	if err != nil {
		return
	}
	defer func() {
		cerr := out.Close()
		if err == nil {
			err = cerr
		}
	}()
	if _, err = io.Copy(out, in); err != nil {
		return
	}
	err = out.Sync()
	return
}