feat: Add error validation for update all

pkg/pkgmgr/apk.go

@@ -120,7 +120,7 @@
 func (am *apkManager) InstallUpdates(ctx context.Context, manifest *unversioned.UpdateManifest, ignoreErrors bool) (*llb.State, []string, error) {
  // If manifest is nil, update all packages
  if manifest == nil {
- updatedImageState, _, err := am.upgradePackages(ctx, nil)
+ updatedImageState, _, err := am.upgradePackages(ctx, nil, ignoreErrors)
  if err != nil {
  return updatedImageState, nil, err
  }
@@ -140,7 +140,7 @@
  }
  log.Debugf("latest unique APKs: %v", updates)
 
- updatedImageState, resultsBytes, err := am.upgradePackages(ctx, updates)
+ updatedImageState, resultsBytes, err := am.upgradePackages(ctx, updates, ignoreErrors)
  if err != nil {
  return nil, nil, err
  }
@@ -161,7 +161,7 @@
 // TODO: support "distroless" Alpine images (e.g. APKO images)
 // Still assumes that APK exists in the target image and is pathed, which can be addressed by
 // mounting a copy of apk-tools-static into the image and invoking apk-static directly.
-func (am *apkManager) upgradePackages(ctx context.Context, updates unversioned.UpdatePackages) (*llb.State, []byte, error) {
+func (am *apkManager) upgradePackages(ctx context.Context, updates unversioned.UpdatePackages, ignoreErrors bool) (*llb.State, []byte, error) {
  // TODO: Add support for custom APK config
  apkUpdated := am.config.ImageState.Run(llb.Shlex("apk update"), llb.WithProxy(utils.GetProxy()), llb.IgnoreCache).Root()
 
@@ -200,8 +200,13 @@
  }
  } else {
  // if updates is not specified, update all packages
- installCmd := `apk upgrade --no-cache`
- apkInstalled = apkUpdated.Run(llb.Shlex(installCmd), llb.WithProxy(utils.GetProxy())).Root()
+ installCmd := `output=$(apk upgrade --no-cache 2>&1); if [ $? -ne 0 ]; then echo "$output" >>error_log.txt; fi`
+ apkInstalled = apkUpdated.Run(llb.Args([]string{"sh", "-c", installCmd}), llb.WithProxy(utils.GetProxy())).Root()
+
+ // Validate no errors were encountered if updating all
+ if !ignoreErrors {
+ apkInstalled = apkInstalled.Run(llb.Args([]string{"sh", "-c", "if [ -s error_log.txt ]; then cat error_log.txt; exit 1; fi"})).Root()
+ }
  }
 
  // Diff the installed updates and merge that into the target image

pkg/pkgmgr/dpkg.go

@@ -122,19 +122,17 @@
  // If manifest nil, update all packages
  if manifest == nil {
  if dm.isDistroless {
- updatedImageState, _, err := dm.unpackAndMergeUpdates(ctx, nil, toolImageName)
+ updatedImageState, _, err := dm.unpackAndMergeUpdates(ctx, nil, toolImageName, ignoreErrors)
  if err != nil {
  return updatedImageState, nil, err
  }
- // add validation in the future
  return updatedImageState, nil, nil
  }
 
- updatedImageState, _, err := dm.installUpdates(ctx, nil)
+ updatedImageState, _, err := dm.installUpdates(ctx, nil, ignoreErrors)
  if err != nil {
  return updatedImageState, nil, err
  }
- // add validation in the future
  return updatedImageState, nil, nil
  }
 
@@ -153,12 +151,12 @@
  var updatedImageState *llb.State
  var resultManifestBytes []byte
  if dm.isDistroless {
- updatedImageState, resultManifestBytes, err = dm.unpackAndMergeUpdates(ctx, updates, toolImageName)
+ updatedImageState, resultManifestBytes, err = dm.unpackAndMergeUpdates(ctx, updates, toolImageName, ignoreErrors)
  if err != nil {
  return nil, nil, err
  }
  } else {
- updatedImageState, resultManifestBytes, err = dm.installUpdates(ctx, updates)
+ updatedImageState, resultManifestBytes, err = dm.installUpdates(ctx, updates, ignoreErrors)
  if err != nil {
  return nil, nil, err
  }
@@ -304,7 +302,7 @@
 //
 // TODO: Support Debian images with valid dpkg status but missing tools. No current examples exist in test set
 // i.e. extra RunOption to mount a copy of busybox-static or full apt install into the image and invoking that.
-func (dm *dpkgManager) installUpdates(ctx context.Context, updates unversioned.UpdatePackages) (*llb.State, []byte, error) {
+func (dm *dpkgManager) installUpdates(ctx context.Context, updates unversioned.UpdatePackages, ignoreErrors bool) (*llb.State, []byte, error) {
  // TODO: Add support for custom APT config and gpg key injection
  // Since this takes place in the target container, it can interfere with install actions
  // such as the installation of the updated debian-archive-keyring package, so it's probably best
@@ -330,11 +328,16 @@
  installCmd = fmt.Sprintf(aptInstallTemplate, strings.Join(pkgStrings, " "))
  } else {
  // if updates is not specified, update all packages
- installCmd = `sh -c "apt upgrade -y && apt clean -y && apt autoremove"`
+ installCmd = `sh -c "output=$(apt upgrade -y && apt clean -y && apt autoremove 2>&1); if [ $? -ne 0 ]; then echo "$output" >>error_log.txt; fi"`
  }
 
  aptInstalled := aptUpdated.Run(llb.Shlex(installCmd), llb.WithProxy(utils.GetProxy())).Root()
 
+ // Validate no errors were encountered if updating all
+ if updates == nil && !ignoreErrors {
+ aptInstalled = aptInstalled.Run(llb.Args([]string{"sh", "-c", "if [ -s error_log.txt ]; then cat error_log.txt; exit 1; fi"})).Root()
+ }
+
  // Write results.manifest to host for post-patch validation
  const outputResultsTemplate = `sh -c 'grep "^Package:\|^Version:" "%s" >> "%s"'`
  outputResultsCmd := fmt.Sprintf(outputResultsTemplate, dpkgStatusPath, resultManifest)
@@ -352,7 +355,7 @@
  return &patchMerge, resultsBytes, nil
 }
 
-func (dm *dpkgManager) unpackAndMergeUpdates(ctx context.Context, updates unversioned.UpdatePackages, toolImage string) (*llb.State, []byte, error) {
+func (dm *dpkgManager) unpackAndMergeUpdates(ctx context.Context, updates unversioned.UpdatePackages, toolImage string, ignoreErrors bool) (*llb.State, []byte, error) {
  imagePlatform, err := dm.config.ImageState.GetPlatform(ctx)
  if err != nil {
  return nil, nil, fmt.Errorf("unable to get image platform %w", err)
@@ -415,11 +418,25 @@
  }
  downloadCmd = fmt.Sprintf(aptDownloadTemplate, strings.Join(pkgStrings, " "))
  } else {
- // only updated the outdated pacakges from packages.txt
- downloadCmd = "xargs -a packages.txt -n 1 apt download --no-install-recommends"
+ // only update the outdated pacakges from packages.txt
+ downloadCmd = `
+ packages=$(<packages.txt)
+ for package in $packages; do
+ output=$(apt download --no-install-recommends "$package" 2>&1)
+ if [ $? -ne 0 ]; then
+ echo "$output" >>error_log.txt
+ fi
+ done
+ `
  }
 
  downloaded := updated.Dir(dpkgDownloadPath).Run(llb.Args([]string{"bash", "-c", downloadCmd}), llb.WithProxy(utils.GetProxy())).Root()
+
+ // Validate no errors were encountered if updating all
+ if updates == nil && !ignoreErrors {
+ downloaded = downloaded.Run(llb.Args([]string{"sh", "-c", "if [ -s error_log.txt ]; then cat error_log.txt; exit 1; fi"})).Root()
+ }
+
  diffState := llb.Diff(updated, downloaded)
 
  // Scripted enumeration and dpkg unpack of all downloaded packages [layer to merge with target]

pkg/pkgmgr/rpm.go

@@ -211,12 +211,12 @@
  var updatedImageState *llb.State
  var resultManifestBytes []byte
  if rm.isDistroless {
- updatedImageState, resultManifestBytes, err = rm.unpackAndMergeUpdates(ctx, updates, toolImageName)
+ updatedImageState, resultManifestBytes, err = rm.unpackAndMergeUpdates(ctx, updates, toolImageName, ignoreErrors)
  if err != nil {
  return nil, nil, err
  }
  } else {
- updatedImageState, resultManifestBytes, err = rm.installUpdates(ctx, updates)
+ updatedImageState, resultManifestBytes, err = rm.installUpdates(ctx, updates, ignoreErrors)
  if err != nil {
  return nil, nil, err
  }
@@ -383,7 +383,7 @@
 //
 // TODO: Support RPM-based images with valid rpm status but missing tools. (e.g. calico images > v3.21.0)
 // i.e. extra RunOption to mount a copy of rpm tools installed into the image and invoking that.
-func (rm *rpmManager) installUpdates(ctx context.Context, updates unversioned.UpdatePackages) (*llb.State, []byte, error) {
+func (rm *rpmManager) installUpdates(ctx context.Context, updates unversioned.UpdatePackages, ignoreErrors bool) (*llb.State, []byte, error) {
  pkgs := ""
 
  // If specific updates, provided, parse into pkg names, else will update all
@@ -400,20 +400,25 @@
  var installCmd string
  switch {
  case rm.rpmTools["dnf"] != "":
- const dnfInstallTemplate = `sh -c '%[1]s upgrade %[2]s -y && %[1]s clean all'`
+ const dnfInstallTemplate = `sh -c 'output=$(%[1]s upgrade %[2]s -y && %[1]s clean all 2>&1); if [ $? -ne 0 ]; then echo "$output" >>error_log.txt; fi'`
  installCmd = fmt.Sprintf(dnfInstallTemplate, rm.rpmTools["dnf"], pkgs)
  case rm.rpmTools["yum"] != "":
- const yumInstallTemplate = `sh -c '%[1]s upgrade %[2]s -y && %[1]s clean all'`
+ const yumInstallTemplate = `sh -c 'output=$(%[1]s upgrade %[2]s -y && %[1]s clean all 2>&1); if [ $? -ne 0 ]; then echo "$output" >>error_log.txt; fi'`
  installCmd = fmt.Sprintf(yumInstallTemplate, rm.rpmTools["yum"], pkgs)
  case rm.rpmTools["microdnf"] != "":
- const microdnfInstallTemplate = `sh -c '%[1]s update %[2]s && %[1]s clean all'`
+ const microdnfInstallTemplate = `sh -c 'output=$(%[1]s update %[2]s && %[1]s clean all 2>&1); if [ $? -ne 0 ]; then echo "$output" >>error_log.txt; fi'`
  installCmd = fmt.Sprintf(microdnfInstallTemplate, rm.rpmTools["microdnf"], pkgs)
  default:
  err := errors.New("unexpected: no package manager tools were found for patching")
  return nil, nil, err
  }
  installed := rm.config.ImageState.Run(llb.Shlex(installCmd), llb.WithProxy(utils.GetProxy())).Root()
 
+ // Validate no errors were encountered if updating all
+ if updates == nil && !ignoreErrors {
+ installed = installed.Run(llb.Args([]string{"bash", "-c", "if [ -s error_log.txt ]; then cat error_log.txt; exit 1; fi"})).Root()
+ }
+
  // Write results.manifest to host for post-patch validation
  var resultBytes []byte
  var err error
@@ -434,7 +439,7 @@
  return &patchMerge, resultBytes, nil
 }
 
-func (rm *rpmManager) unpackAndMergeUpdates(ctx context.Context, updates unversioned.UpdatePackages, toolImage string) (*llb.State, []byte, error) {
+func (rm *rpmManager) unpackAndMergeUpdates(ctx context.Context, updates unversioned.UpdatePackages, toolImage string, ignoreErrors bool) (*llb.State, []byte, error) {
  // Spin up a build tooling container to fetch and unpack packages to create patch layer.
  // Pull family:version -> need to create version to base image map
  toolingBase := llb.Image(toolImage,
@@ -489,10 +494,23 @@
  downloadCmd = fmt.Sprintf(rpmDownloadTemplate, strings.Join(pkgStrings, " "))
  } else {
  // only updated the outdated pacakges from packages.txt
- downloadCmd = `xargs -a packages.txt -n 1 yumdownloader --downloadonly --downloaddir=. --best -y`
+ downloadCmd = `
+ packages=$(<packages.txt)
+ for package in $packages; do
+ output=$(yumdownloader --downloadonly --downloaddir=. --best -y "$package" 2>&1)
+ if [ $? -ne 0 ]; then
+ echo "$output" >>error_log.txt
+ fi
+ done
+ `
  }
 
- downloaded := busyboxCopied.Run(llb.Shlex(downloadCmd), llb.WithProxy(utils.GetProxy())).Root()
+ downloaded := busyboxCopied.Run(llb.Args([]string{"bash", "-c", downloadCmd}), llb.WithProxy(utils.GetProxy())).Root()
+
+ // Validate no errors were encountered if updating all
+ if updates == nil && !ignoreErrors {
+ downloaded = downloaded.Run(llb.Args([]string{"bash", "-c", "if [ -s error_log.txt ]; then cat error_log.txt; exit 1; fi"})).Root()
+ }
 
  // Scripted enumeration and rpm install of all downloaded packages under the download folder as root
  const extractTemplate = `sh -c 'for f in %[1]s/*.rpm ; do rpm2cpio "$f" | cpio -idmv -D %[1]s ; done'`