bottlerocket-os / bottlerocket-os/twoliter
Bug: Twoliter does not validate that the kit or sdk version = field in the lock matches the source url correctly
Open
@Sparksssj is already working on this.
Since Feb 4, 2025.
bug
good first issue
- Dominant language
- Rust
- Stars
- 34
- Forks
- 45
- Avg merge
- 11h 13m
- Merged PRs (30d)
- 16
Description
We had an occurence where a developer accidentally commited a manual edit of a Twoliter.lock file leading to the version field for the sdk entry to mismatch with the resolved source = "" uri. While this will not cause any issues as the actual object pulled when lockfile is used by twoliter will always be the source it adds ambiguity.
Example human modification that put the lock file into invalid state:
schema-version = 1
kit = []
[sdk]
name = "bottlerocket-sdk"
version = "0.50.0"
vendor = "bottlerocket"
source = "public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.50.1"
digest = "HEh3Lx3F6P4OEPnFubF++RMpMW2vlfp/Tc/tGjnBRcM="
We should make sure our validation when we load a lockfile ensures that the version -> source tag since pubsys will always publish kits currently with that tagging scheme.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.