@xemahq/edition-tooling 0.0.0-stage → 0.1.0

package/edition/resolve-infra-images.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// resolve-infra-images — re-resolve every edition's infra-images.lock.json.
+//
+// usage: node resolve-infra-images.mjs --editions-root <dir> [--edition <id>]...
+//
+// For each lock, every ref's tag is read from its PUBLIC registry anonymously
+// (the pinned oras, read-only, no ambient credential) and the manifest digest
+// recorded. A registry that refuses the anonymous read is recorded as
+// `unresolvable` with the registry's own refusal as the reason; nothing is
+// guessed and no credential is tried. Locks of one run are written together, so
+// editions cannot disagree about a ref.
+
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { isEntryModule } from './edition-workspace.mjs';
+import {
+  INFRA_IMAGES_LOCK_FILE,
+  InfraImagePin,
+  infraImagesLockProblems,
+  readInfraImagesLock,
+  serializeInfraImagesLock,
+} from './infra-images-lock.mjs';
+import { OrasRegistry } from './oras.mjs';
+
+const DOCKER_HUB_REFERENCE = 'docker.io';
+const DOCKER_HUB_WIRE = 'registry-1.docker.io';
+
+/** `docker.io/postgres:16.6` -> {authority: registry-1.docker.io, repository: library/postgres, tag: 16.6}. */
+export function wireCoordinate(ref) {
+  const slash = ref.indexOf('/');
+  const referenceAuthority = ref.slice(0, slash);
+  let repository = ref.slice(slash + 1);
+  const colon = repository.lastIndexOf(':');
+  const tag = repository.slice(colon + 1);
+  repository = repository.slice(0, colon);
+  if (referenceAuthority !== DOCKER_HUB_REFERENCE) {return { authority: referenceAuthority, repository, tag };}
+  return { authority: DOCKER_HUB_WIRE, repository: repository.includes('/') ? repository : `library/${repository}`, tag };
+}
+
+/** Resolve every entry of `lock` through `registryFor(authority)`; returns a new lock. */
+export async function resolveInfraImagesLock(lock, registryFor) {
+  const images = [];
+  for (const entry of lock.images) {
+    const { authority, repository, tag } = wireCoordinate(entry.ref);
+    try {
+      const manifest = await registryFor(authority).getManifestByTag(repository, tag);
+      images.push({ ref: entry.ref, group: entry.group, pin: InfraImagePin.Digest, digest: manifest.digest });
+    } catch (error) {
+      const reason = `anonymous read of ${authority} refused: ${String(error.message).split('\n')[0]}`;
+      images.push({ ref: entry.ref, group: entry.group, pin: InfraImagePin.Unresolvable, reason });
+    }
+  }
+  return { ...lock, images };
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const take = (flag) => args.flatMap((arg, i) => (arg === flag ? [args[i + 1]] : []));
+  const [root] = take('--editions-root');
+  if (!root) {throw new Error('usage: resolve-infra-images.mjs --editions-root <dir> [--edition <id>]...');}
+  const ids = take('--edition');
+  if (ids.length === 0) {throw new Error('name at least one --edition');}
+  const registries = new Map();
+  const registryFor = (authority) => {
+    if (!registries.has(authority)) {
+      registries.set(authority, new OrasRegistry({ credential: { authority, access: 'anonymous' }, trust: () => null }));
+    }
+    return registries.get(authority);
+  };
+  for (const id of ids) {
+    const current = readInfraImagesLock(join(root, id));
+    if (current === null) {throw new Error(`${id} has no ${INFRA_IMAGES_LOCK_FILE}`);}
+    const next = await resolveInfraImagesLock(current, registryFor);
+    const problems = infraImagesLockProblems(next, { distributionId: id });
+    if (problems.length > 0) {throw new Error(`${id}: ${problems.join('; ')}`);}
+    writeFileSync(join(root, id, INFRA_IMAGES_LOCK_FILE), serializeInfraImagesLock(next));
+    const holes = next.images.filter((e) => e.pin === InfraImagePin.Unresolvable).length;
+    console.log(`[resolve-infra-images] ${id}: ${next.images.length} images, ${holes} unresolvable.`);
+  }
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[resolve-infra-images] ${error.message}`);
+    process.exit(1);
+  });
+}