@lazycatcloud/lzc-cli 2.0.0-pre.0 → 2.0.0-pre.2

package/lib/app/lpk_build_images_local.js

@@ -0,0 +1,425 @@
+import fs from 'node:fs';
+import { Writable } from 'node:stream';
+import spawn from 'cross-spawn';
+import logger from 'loglevel';
+import { DockerfileParser } from 'dockerfile-ast';
+
+function createNullWritable() {
+	return new Writable({
+		write(_chunk, _encoding, callback) {
+			callback();
+		},
+	});
+}
+
+function runLocalCommand(command, args, options = {}) {
+	const cwd = options.cwd || process.cwd();
+	const env = options.env ? { ...process.env, ...options.env } : process.env;
+	const stdinFile = String(options.stdinFile ?? '').trim();
+	const stdoutFile = String(options.stdoutFile ?? '').trim();
+	const quietStdout = !!options.quietStdout;
+	const quietStderr = !!options.quietStderr;
+	const stdoutBuffer = [];
+	const stderrBuffer = [];
+
+	logger.debug(`run local command: ${command} ${args.join(' ')}`);
+	const child = spawn(command, args, {
+		cwd,
+		env,
+		shell: false,
+		stdio: ['pipe', 'pipe', 'pipe'],
+	});
+
+	return new Promise((resolve, reject) => {
+		let done = false;
+		const finish = (error, output = {}) => {
+			if (done) {
+				return;
+			}
+			done = true;
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(output);
+		};
+
+		let stdoutStream = null;
+		let stderrMirror = null;
+
+		if (stdinFile) {
+			const stdinStream = fs.createReadStream(stdinFile);
+			stdinStream.on('error', (error) => finish(error));
+			stdinStream.pipe(child.stdin);
+		} else {
+			child.stdin.end();
+		}
+
+		if (stdoutFile) {
+			stdoutStream = fs.createWriteStream(stdoutFile);
+			stdoutStream.on('error', (error) => finish(error));
+			child.stdout.pipe(stdoutStream);
+		} else {
+			child.stdout.on('data', (chunk) => {
+				stdoutBuffer.push(chunk);
+				if (!quietStdout) {
+					process.stdout.write(chunk);
+				}
+			});
+		}
+
+		if (quietStderr) {
+			stderrMirror = createNullWritable();
+			child.stderr.pipe(stderrMirror);
+		} else {
+			child.stderr.on('data', (chunk) => {
+				stderrBuffer.push(chunk);
+				process.stderr.write(chunk);
+			});
+		}
+
+		child.on('error', (error) => finish(error));
+		child.on('close', (code) => {
+			const finalize = () => {
+				const stdout = Buffer.concat(stdoutBuffer).toString('utf-8');
+				const stderr = Buffer.concat(stderrBuffer).toString('utf-8');
+				if (code === 0) {
+					finish(null, { stdout, stderr });
+					return;
+				}
+				finish(new Error(`${command} ${args.join(' ')} failed with code ${code}\n${stderr || stdout}`));
+			};
+			if (stdoutStream) {
+				stdoutStream.end(finalize);
+				return;
+			}
+			finalize();
+		});
+	});
+}
+
+function normalizeSha256Digest(value, fieldName) {
+	const raw = String(value ?? '').trim();
+	const digest = /^[0-9a-f]{64}$/i.test(raw) ? `sha256:${raw}` : raw;
+	if (!digest.startsWith('sha256:')) {
+		throw new Error(`${fieldName} is not a sha256 digest: ${raw}`);
+	}
+	const hex = digest.slice('sha256:'.length);
+	if (!/^[0-9a-f]{64}$/i.test(hex)) {
+		throw new Error(`${fieldName} has invalid sha256 hex: ${digest}`);
+	}
+	return `sha256:${hex.toLowerCase()}`;
+}
+
+function stripRepoDigest(value) {
+	const text = String(value ?? '').trim();
+	const index = text.indexOf('@sha256:');
+	if (index < 0) {
+		return text;
+	}
+	return text.slice(0, index);
+}
+
+function repoStartsWith(repoDigest, upstreamMatch) {
+	const match = String(upstreamMatch ?? '').trim();
+	if (!match) {
+		return false;
+	}
+	return stripRepoDigest(repoDigest).startsWith(match);
+}
+
+function startsWithDigestList(layers, prefix) {
+	if (prefix.length > layers.length) {
+		return false;
+	}
+	for (let index = 0; index < prefix.length; index += 1) {
+		if (layers[index] !== prefix[index]) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function parseInspectArray(stdout, imageRef, commandName) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch (error) {
+		throw new Error(`failed to parse ${commandName} output for ${imageRef}: ${error.message}`);
+	}
+	if (!Array.isArray(parsed) || parsed.length === 0 || !parsed[0] || typeof parsed[0] !== 'object') {
+		throw new Error(`invalid ${commandName} output for ${imageRef}`);
+	}
+	return parsed[0];
+}
+
+function pickRepoDigest(repoDigests, upstreamMatch, expectedDigest = '') {
+	const normalizedExpected = expectedDigest ? normalizeSha256Digest(expectedDigest, 'expected upstream digest') : '';
+	const candidates = Array.isArray(repoDigests) ? repoDigests.map((item) => String(item ?? '').trim()).filter((item) => item) : [];
+	const matched = candidates.filter((item) => repoStartsWith(item, upstreamMatch));
+	if (matched.length === 0) {
+		return '';
+	}
+	if (normalizedExpected) {
+		const exact = matched.find((item) => item.endsWith(`@${normalizedExpected}`));
+		if (exact) {
+			return exact;
+		}
+	}
+	return matched[0];
+}
+
+function parseBuildahInspectOutput(stdout, imageRef) {
+	let inspect;
+	try {
+		inspect = JSON.parse(stdout);
+	} catch (error) {
+		throw new Error(`failed to parse buildah inspect output for ${imageRef}: ${error.message}`);
+	}
+
+	const configRaw = typeof inspect?.Config === 'string' ? inspect.Config : JSON.stringify(inspect?.Config ?? {});
+	let config;
+	try {
+		config = JSON.parse(configRaw);
+	} catch (error) {
+		throw new Error(`failed to parse buildah inspect config for ${imageRef}: ${error.message}`);
+	}
+	const diffIDs = Array.isArray(config?.rootfs?.diff_ids)
+		? config.rootfs.diff_ids.map((item, index) => normalizeSha256Digest(item, `buildah inspect diff_ids[${index}] of ${imageRef}`))
+		: [];
+
+	const manifestRaw = typeof inspect?.Manifest === 'string' ? inspect.Manifest : JSON.stringify(inspect?.Manifest ?? {});
+	let manifest;
+	try {
+		manifest = JSON.parse(manifestRaw);
+	} catch (error) {
+		throw new Error(`failed to parse buildah inspect manifest for ${imageRef}: ${error.message}`);
+	}
+	const imageID = normalizeSha256Digest(manifest?.config?.digest, `buildah inspect image id of ${imageRef}`);
+
+	let baseName = '';
+	let baseDigest = '';
+	const imageAnnotations = inspect?.ImageAnnotations && typeof inspect.ImageAnnotations === 'object' ? inspect.ImageAnnotations : {};
+	const manifestAnnotations = manifest?.annotations && typeof manifest.annotations === 'object' ? manifest.annotations : {};
+	baseName = String(imageAnnotations['org.opencontainers.image.base.name'] ?? '').trim();
+	baseDigest = String(imageAnnotations['org.opencontainers.image.base.digest'] ?? '').trim();
+	if (!baseName) {
+		baseName = String(manifestAnnotations['org.opencontainers.image.base.name'] ?? '').trim();
+	}
+	if (!baseDigest) {
+		baseDigest = String(manifestAnnotations['org.opencontainers.image.base.digest'] ?? '').trim();
+	}
+	if (!baseName) {
+		baseName = String(inspect?.FromImage ?? '').trim();
+	}
+	if (!baseDigest) {
+		baseDigest = String(inspect?.FromImageDigest ?? '').trim();
+	}
+	if (baseDigest) {
+		baseDigest = normalizeSha256Digest(baseDigest, `buildah inspect base digest of ${imageRef}`);
+	}
+
+	return {
+		imageID,
+		diffIDs,
+		baseName,
+		baseDigest,
+	};
+}
+
+function resolveFinalExternalImageFromDockerfile(dockerfilePath) {
+	const ast = DockerfileParser.parse(fs.readFileSync(dockerfilePath, 'utf8'));
+	const stages = [];
+	const stageIndexByName = new Map();
+	for (const instruction of ast.getInstructions()) {
+		if (instruction.getInstruction() !== 'FROM') {
+			continue;
+		}
+		const image = String(instruction.getImage() ?? '').trim();
+		if (!image) {
+			continue;
+		}
+		const stageName = String(instruction.getBuildStage() ?? '').trim().toLowerCase();
+		const stage = {
+			image,
+			stageName,
+		};
+		stages.push(stage);
+		if (stageName) {
+			stageIndexByName.set(stageName, stage);
+		}
+	}
+	if (stages.length === 0) {
+		return '';
+	}
+	let current = stages.at(-1)?.image ?? '';
+	const visited = new Set();
+	while (current) {
+		const key = current.trim().toLowerCase();
+		if (!key || visited.has(key)) {
+			break;
+		}
+		visited.add(key);
+		const stage = stageIndexByName.get(key);
+		if (!stage) {
+			return current;
+		}
+		current = stage.image;
+	}
+	return current;
+}
+
+async function inspectLocalDockerImage(imageRef) {
+	const { stdout } = await runLocalCommand('docker', ['image', 'inspect', imageRef], {
+		quietStdout: true,
+		quietStderr: true,
+	});
+	const item = parseInspectArray(stdout, imageRef, 'docker image inspect');
+	const imageID = normalizeSha256Digest(item.Id, `docker image inspect id of ${imageRef}`);
+	const diffIDs = Array.isArray(item?.RootFS?.Layers)
+		? item.RootFS.Layers.map((layer, index) => normalizeSha256Digest(layer, `docker image inspect rootfs layer ${index} of ${imageRef}`))
+		: [];
+	if (diffIDs.length === 0) {
+		throw new Error(`docker image inspect rootfs layers is empty for ${imageRef}`);
+	}
+	const repoDigests = Array.isArray(item?.RepoDigests) ? item.RepoDigests.map((item) => String(item ?? '').trim()).filter((item) => item) : [];
+	return {
+		imageID,
+		diffIDs,
+		repoDigests,
+	};
+}
+
+async function tryInspectLocalBuildahImage(imageRef) {
+	try {
+		const { stdout } = await runLocalCommand('buildah', ['inspect', imageRef], {
+			quietStdout: true,
+			quietStderr: true,
+		});
+		return parseBuildahInspectOutput(stdout, imageRef);
+	} catch (error) {
+		logger.debug(`skip buildah inspect for ${imageRef}: ${error.message}`);
+		return null;
+	}
+}
+
+async function deriveLocalUpstreamFromBuildah(imageRef, upstreamMatch, builtDiffIDs) {
+	const inspected = await tryInspectLocalBuildahImage(imageRef);
+	if (!inspected?.baseName || !inspected?.baseDigest) {
+		return null;
+	}
+	const baseRef = `${stripRepoDigest(inspected.baseName)}@${inspected.baseDigest}`;
+	const baseInfo = await inspectLocalDockerImage(baseRef);
+	const upstream = pickRepoDigest(baseInfo.repoDigests, upstreamMatch, inspected.baseDigest);
+	if (!upstream) {
+		return null;
+	}
+	if (!startsWithDigestList(builtDiffIDs, baseInfo.diffIDs)) {
+		logger.warn(`ignore local upstream derived from buildah, built layers do not start with upstream layers: ${imageRef}`);
+		return null;
+	}
+	return {
+		upstream,
+		upstreamDiffIDs: baseInfo.diffIDs,
+	};
+}
+
+async function deriveLocalUpstreamFromDockerfile(dockerfilePath, upstreamMatch, builtDiffIDs) {
+	const baseRef = resolveFinalExternalImageFromDockerfile(dockerfilePath);
+	if (!baseRef) {
+		return null;
+	}
+	const baseInfo = await inspectLocalDockerImage(baseRef);
+	const upstream = pickRepoDigest(baseInfo.repoDigests, upstreamMatch);
+	if (!upstream) {
+		return null;
+	}
+	if (!startsWithDigestList(builtDiffIDs, baseInfo.diffIDs)) {
+		logger.warn(`ignore local upstream derived from Dockerfile, built layers do not start with upstream layers: ${baseRef}`);
+		return null;
+	}
+	return {
+		upstream,
+		upstreamDiffIDs: baseInfo.diffIDs,
+	};
+}
+
+export function normalizeTargetPlatform(value) {
+	const normalized = String(value ?? '').trim().toLowerCase();
+	if (!/^[a-z0-9]+\/[a-z0-9]+$/.test(normalized)) {
+		throw new Error(`invalid target platform: ${value}`);
+	}
+	return normalized;
+}
+
+export async function ensureDockerBuildxAvailable() {
+	await runLocalCommand('docker', ['buildx', 'version'], {
+		quietStdout: true,
+		quietStderr: true,
+	});
+}
+
+export async function buildLocalImageForPack(entry, targetPlatform, dockerfilePath = '') {
+	const platform = normalizeTargetPlatform(targetPlatform);
+	await ensureDockerBuildxAvailable();
+	const imageRef = `debug.bridge/${entry.imageLabel}`;
+	await runLocalCommand(
+		'docker',
+		['buildx', 'build', '--platform', platform, '--load', '--tag', imageRef, '--file', 'Dockerfile', '.'],
+		{
+			cwd: entry.contextDir,
+			env: {
+				DOCKER_BUILDKIT: '1',
+			},
+		},
+	);
+	const inspected = await inspectLocalDockerImage(imageRef);
+	let upstream = '';
+	let upstreamDiffIDs = [];
+	if (String(entry?.upstreamMatch ?? '').trim()) {
+		const derivedFromBuildah = await deriveLocalUpstreamFromBuildah(imageRef, entry.upstreamMatch, inspected.diffIDs);
+		const derived = derivedFromBuildah ?? (dockerfilePath ? await deriveLocalUpstreamFromDockerfile(dockerfilePath, entry.upstreamMatch, inspected.diffIDs) : null);
+		if (derived) {
+			upstream = derived.upstream;
+			upstreamDiffIDs = derived.upstreamDiffIDs;
+		}
+	}
+	return {
+		ref: imageRef,
+		imageID: inspected.imageID,
+		builtDiffIDs: inspected.diffIDs,
+		upstream,
+		upstreamDiffIDs,
+		archiveKey: '',
+		platform,
+	};
+}
+
+export async function saveLocalDockerImagesArchive(imageRefs, archivePath) {
+	const refs = [...new Set(imageRefs.map((item) => String(item ?? '').trim()).filter((item) => item))];
+	if (refs.length === 0) {
+		throw new Error('local image refs is empty');
+	}
+	await runLocalCommand('docker', ['image', 'save', ...refs], {
+		stdoutFile: archivePath,
+		quietStderr: true,
+	});
+}
+
+export async function removeLocalDockerImages(imageRefs) {
+	const refs = [...new Set(imageRefs.map((item) => String(item ?? '').trim()).filter((item) => item))];
+	for (const ref of refs) {
+		try {
+			await runLocalCommand('docker', ['image', 'rm', '-f', ref], {
+				quietStdout: true,
+				quietStderr: true,
+			});
+		} catch (error) {
+			logger.debug(`ignore local docker image cleanup failure for ${ref}: ${error.message}`);
+		}
+	}
+}
+
+export const __test__ = {
+	resolveFinalExternalImageFromDockerfile,
+};