bottlerocket-os/twoliter

Bug: Twoliter does not validate that the kit or sdk version = field in the lock matches the source url correctly

Open

#450 opened on Feb 4, 2025

View on GitHub
 (0 comments) (0 reactions) (2 assignees)Rust (43 forks)auto 404
buggood first issue

Repository metrics

Stars
 (34 stars)
PR merge metrics
 (PR metrics pending)

Description

We had an occurence where a developer accidentally commited a manual edit of a Twoliter.lock file leading to the version field for the sdk entry to mismatch with the resolved source = "" uri. While this will not cause any issues as the actual object pulled when lockfile is used by twoliter will always be the source it adds ambiguity.

Example human modification that put the lock file into invalid state:

schema-version = 1
kit = []

[sdk]
name = "bottlerocket-sdk"
version = "0.50.0"
vendor = "bottlerocket"
source = "public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.50.1"
digest = "HEh3Lx3F6P4OEPnFubF++RMpMW2vlfp/Tc/tGjnBRcM="

We should make sure our validation when we load a lockfile ensures that the version -> source tag since pubsys will always publish kits currently with that tagging scheme.

Contributor guide

Research direction
Add validation in the lock file loading logic to ensure that the version field matches the source tag (e.g., `v<version>`). Look at how the lock file is parsed and where validation is currently done.
Tech stack
rust
Domain
backendbuild systemdevops
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitRust
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65