forjar 1.30.0

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

//! FJ-2106/E15: image drift — the deployed digest against the built one.
//!
//! Split out of `mod.rs` when forjar#380 added the task detector and the
//! census: the file was at 497 of its 500-line budget, and the image path is
//! the piece with the fewest ties to the rest.

use super::census::{DriftCensus, SkipReason};
use super::ignore::should_ignore_drift;
use super::unmeasured::{self, Reading};
use super::DriftFinding;
use crate::core::types::{Machine, Resource, ResourceStatus, ResourceType, StateLock};

/// FJ-2106/E15: Check all image-type resources for drift.
///
/// For each converged image resource, compares the manifest digest stored
/// in the lock file against the running container's image digest
/// (via `docker inspect`).
pub(super) fn detect_image_drift(
    lock: &StateLock,
    machine: &Machine,
    resources: &indexmap::IndexMap<String, Resource>,
    census: &mut DriftCensus,
) -> Vec<DriftFinding> {
    let mut findings = Vec::new();
    for (id, rl) in &lock.resources {
        if rl.resource_type != ResourceType::Image {
            continue;
        }
        if rl.status != ResourceStatus::Converged {
            census.skipped(id, &rl.resource_type, SkipReason::NotConverged);
            continue;
        }
        if should_ignore_drift(id, resources) {
            census.skipped(id, &rl.resource_type, SkipReason::IgnoreDrift);
            continue;
        }
        // A manifest digest or a container name the lock never recorded is the
        // same blindness as an unobserved task: there is nothing to compare, so
        // say so rather than passing over it in silence.
        let Some(expected_digest) = rl.detail_str("manifest_digest") else {
            census.skipped(id, &rl.resource_type, SkipReason::NoLockedHash);
            continue;
        };
        let Some(container_name) = rl.detail_str("container_name") else {
            census.skipped(id, &rl.resource_type, SkipReason::NoLockedHash);
            continue;
        };
        census.inspected(id, &rl.resource_type);
        if let Some(f) = check_image_drift(id, container_name, expected_digest, machine) {
            findings.push(f);
        }
    }
    findings
}

/// FJ-2106/E15: Check a single image resource for drift.
///
/// Runs `docker inspect <container> --format '{{.Image}}'` on the target
/// machine and compares the actual image digest to the expected manifest
/// digest from the build.
pub fn check_image_drift(
    resource_id: &str,
    container_name: &str,
    expected_digest: &str,
    machine: &Machine,
) -> Option<DriftFinding> {
    let script = format!(
        "docker inspect {container_name} --format '{{{{.Image}}}}' 2>/dev/null || echo 'NOT_RUNNING'"
    );
    let out = match unmeasured::read(machine, &script) {
        Reading::Answered(out) => out,
        // forjar#549: an unanswered `docker inspect` says nothing about the image.
        Reading::Unmeasured(why) => {
            return Some(DriftFinding::unmeasured(
                resource_id,
                ResourceType::Image,
                expected_digest,
                why,
            ))
        }
    };
    if !out.success() {
        return Some(DriftFinding {
            resource_id: resource_id.to_string(),
            resource_type: ResourceType::Image,
            expected_hash: expected_digest.to_string(),
            actual_hash: "ERROR".to_string(),
            detail: format!("docker inspect failed: {}", out.stderr.trim()),
        });
    }
    let actual = out.stdout.trim().to_string();
    if actual == "NOT_RUNNING" {
        Some(DriftFinding {
            resource_id: resource_id.to_string(),
            resource_type: ResourceType::Image,
            expected_hash: expected_digest.to_string(),
            actual_hash: "NOT_RUNNING".to_string(),
            detail: format!("container {container_name} is not running"),
        })
    } else if actual != expected_digest {
        Some(DriftFinding {
            resource_id: resource_id.to_string(),
            resource_type: ResourceType::Image,
            expected_hash: expected_digest.to_string(),
            actual_hash: actual,
            detail: "deployed image differs from built image".to_string(),
        })
    } else {
        None
    }
}