Make image archive/save idempotent, using image id and repo tags as keys (#500)

tests/integration/targets/docker_image/tasks/tests/options.yml

@@ -7,10 +7,11 @@
   set_fact:
     iname: "{{ name_prefix ~ '-options' }}"
     iname_1: "{{ name_prefix ~ '-options-1' }}"
+    hello_world_alt: "{{ name_prefix }}-hello-world-alt:v1.2.3-foo"
 
 - name: Registering image name
   set_fact:
-    inames: "{{ inames + [iname, iname_1] }}"
+    inames: "{{ inames + [iname, iname_1, hello_world_alt] }}"
 
 ####################################################################
 ## build.args ######################################################
@@ -235,6 +236,63 @@
     source: pull
   register: archive_image
 
+- assert:
+    that:
+      - archive_image is changed
+
+- name: Copy archive because we will mutate it but other tests need the original
+  copy:
+    remote_src: true
+    src: "{{ remote_tmp_dir }}/image.tar"
+    dest: "{{ remote_tmp_dir }}/image_mutated.tar"
+
+- name: Archive image again (idempotent)
+  docker_image:
+    name: "{{ docker_test_image_hello_world }}"
+    archive_path: "{{ remote_tmp_dir }}/image_mutated.tar"
+    source: local
+  register: archive_image_2
+
+- assert:
+    that:
+      - archive_image_2 is not changed
+
+- name: Archive image 3rd time, should overwrite due to different id
+  docker_image:
+    name: "{{ docker_test_image_alpine_different }}"
+    archive_path: "{{ remote_tmp_dir }}/image_mutated.tar"
+    source: pull
+  register: archive_image_3
+
+- assert:
+    that:
+      - archive_image_3 is changed
+
+- name: Reset archive
+  copy:
+    remote_src: true
+    src: "{{ remote_tmp_dir }}/image.tar"
+    dest: "{{ remote_tmp_dir }}/image_mutated.tar"
+
+- name: Tag image with different name
+  docker_image:
+    name: "{{ docker_test_image_hello_world }}"
+    repository: "{{ hello_world_alt }}"
+    source: local
+
+- name: Archive image 4th time, should overwrite due to different name even when ID is same
+  docker_image:
+    name: "{{ hello_world_alt }}"
+    # Tagged as docker_test_image_hello_world but has same hash/id (before this task overwrites it)
+    archive_path: "{{ remote_tmp_dir }}/image_mutated.tar"
+    source: local
+  register: archive_image_4
+
+- assert:
+    that:
+      - archive_image_4 is changed
+
+# This is the test that needs the original, non-mutated archive
 - name: Archive image by ID
   docker_image:
     name: "{{ archive_image.image.Id }}"

tests/unit/plugins/module_utils/test_image_archive.py

@@ -0,0 +1,94 @@
+# Copyright 2022 Red Hat | Ansible
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import pytest
+import tarfile
+
+from ansible_collections.community.docker.plugins.module_utils.image_archive import (
+    api_image_id,
+    archived_image_manifest,
+    ImageArchiveInvalidException
+)
+
+from ..test_support.docker_image_archive_stubbing import (
+    write_imitation_archive,
+    write_imitation_archive_with_manifest,
+    write_irrelevant_tar,
+)
+
+
+@pytest.fixture
+def tar_file_name(tmpdir):
+    '''
+    Return the name of a non-existing tar file in an existing temporary directory.
+    '''
+
+    # Cast to str required by Python 2.x
+    return str(tmpdir.join('foo.tar'))
+
+
+@pytest.mark.parametrize('expected, value', [
+    ('sha256:foo', 'foo'),
+    ('sha256:bar', 'bar')
+])
+def test_api_image_id_from_archive_id(expected, value):
+    assert api_image_id(value) == expected
+
+
+def test_archived_image_manifest_extracts(tar_file_name):
+    expected_id = "abcde12345"
+    expected_tags = ["foo:latest", "bar:v1"]
+
+    write_imitation_archive(tar_file_name, expected_id, expected_tags)
+
+    actual = archived_image_manifest(tar_file_name)
+
+    assert actual.image_id == expected_id
+    assert actual.repo_tags == expected_tags
+
+
+def test_archived_image_manifest_extracts_nothing_when_file_not_present(tar_file_name):
+    image_id = archived_image_manifest(tar_file_name)
+
+    assert image_id is None
+
+
+def test_archived_image_manifest_raises_when_file_not_a_tar():
+    try:
+        archived_image_manifest(__file__)
+        raise AssertionError()
+    except ImageArchiveInvalidException as e:
+        assert isinstance(e.cause, tarfile.ReadError)
+        assert str(__file__) in str(e)
+
+
+def test_archived_image_manifest_raises_when_tar_missing_manifest(tar_file_name):
+    write_irrelevant_tar(tar_file_name)
+
+    try:
+        archived_image_manifest(tar_file_name)
+        raise AssertionError()
+    except ImageArchiveInvalidException as e:
+        assert isinstance(e.cause, KeyError)
+        assert 'manifest.json' in str(e.cause)
+
+
+def test_archived_image_manifest_raises_when_manifest_missing_id(tar_file_name):
+    manifest = [
+        {
+            'foo': 'bar'
+        }
+    ]
+
+    write_imitation_archive_with_manifest(tar_file_name, manifest)
+
+    try:
+        archived_image_manifest(tar_file_name)
+        raise AssertionError()
+    except ImageArchiveInvalidException as e:
+        assert isinstance(e.cause, KeyError)
+        assert 'Config' in str(e.cause)

tests/unit/plugins/modules/test_docker_image.py

@@ -0,0 +1,117 @@
+# Copyright 2022 Red Hat | Ansible
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import pytest
+
+from ansible_collections.community.docker.plugins.modules.docker_image import ImageManager
+
+from ansible_collections.community.docker.plugins.module_utils.image_archive import (
+    api_image_id,
+    ImageArchiveInvalidException
+)
+
+from ..test_support.docker_image_archive_stubbing import (
+    write_imitation_archive,
+    write_irrelevant_tar,
+)
+
+
+def assert_no_logging(msg):
+    raise AssertionError('Should not have logged anything but logged %s' % msg)
+
+
+def capture_logging(messages):
+    def capture(msg):
+        messages.append(msg)
+
+    return capture
+
+
+@pytest.fixture
+def tar_file_name(tmpdir):
+    """
+    Return the name of a non-existing tar file in an existing temporary directory.
+    """
+
+    # Cast to str required by Python 2.x
+    return str(tmpdir.join('foo.tar'))
+
+
+def test_archived_image_action_when_missing(tar_file_name):
+    fake_name = 'a:latest'
+    fake_id = 'a1'
+
+    expected = 'Archived image %s to %s, since none present' % (fake_name, tar_file_name)
+
+    actual = ImageManager.archived_image_action(assert_no_logging, tar_file_name, fake_name, api_image_id(fake_id))
+
+    assert actual == expected
+
+
+def test_archived_image_action_when_current(tar_file_name):
+    fake_name = 'b:latest'
+    fake_id = 'b2'
+
+    write_imitation_archive(tar_file_name, fake_id, [fake_name])
+
+    actual = ImageManager.archived_image_action(assert_no_logging, tar_file_name, fake_name, api_image_id(fake_id))
+
+    assert actual is None
+
+
+def test_archived_image_action_when_invalid(tar_file_name):
+    fake_name = 'c:1.2.3'
+    fake_id = 'c3'
+
+    write_irrelevant_tar(tar_file_name)
+
+    expected = 'Archived image %s to %s, overwriting an unreadable archive file' % (fake_name, tar_file_name)
+
+    actual_log = []
+    actual = ImageManager.archived_image_action(
+        capture_logging(actual_log),
+        tar_file_name,
+        fake_name,
+        api_image_id(fake_id)
+    )
+
+    assert actual == expected
+
+    assert len(actual_log) == 1
+    assert actual_log[0].startswith('Unable to extract manifest summary from archive')
+
+
+def test_archived_image_action_when_obsolete_by_id(tar_file_name):
+    fake_name = 'd:0.0.1'
+    old_id = 'e5'
+    new_id = 'd4'
+
+    write_imitation_archive(tar_file_name, old_id, [fake_name])
+
+    expected = 'Archived image %s to %s, overwriting archive with image %s named %s' % (
+        fake_name, tar_file_name, old_id, fake_name
+    )
+    actual = ImageManager.archived_image_action(assert_no_logging, tar_file_name, fake_name, api_image_id(new_id))
+
+    assert actual == expected
+
+
+def test_archived_image_action_when_obsolete_by_name(tar_file_name):
+    old_name = 'hi'
+    new_name = 'd:0.0.1'
+    fake_id = 'd4'
+
+    write_imitation_archive(tar_file_name, fake_id, [old_name])
+
+    expected = 'Archived image %s to %s, overwriting archive with image %s named %s' % (
+        new_name, tar_file_name, fake_id, old_name
+    )
+    actual = ImageManager.archived_image_action(assert_no_logging, tar_file_name, new_name, api_image_id(fake_id))
+
+    print('actual   : %s', actual)
+    print('expected : %s', expected)
+    assert actual == expected

tests/unit/plugins/test_support/docker_image_archive_stubbing.py

@@ -0,0 +1,76 @@
+# Copyright 2022 Red Hat | Ansible
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import json
+import tarfile
+from tempfile import TemporaryFile
+
+
+def write_imitation_archive(file_name, image_id, repo_tags):
+    '''
+    Write a tar file meeting these requirements:
+
+    * Has a file manifest.json
+    * manifest.json contains a one-element array
+    * The element has a Config property with "[image_id].json" as the value name
+
+    :param file_name: Name of file to create
+    :type file_name: str
+    :param image_id: Fake sha256 hash (without the sha256: prefix)
+    :type image_id: str
+    :param repo_tags: list of fake image:tag's
+    :type repo_tags: list
+    '''
+
+    manifest = [
+        {
+            'Config': '%s.json' % image_id,
+            'RepoTags': repo_tags
+        }
+    ]
+
+    write_imitation_archive_with_manifest(file_name, manifest)
+
+
+def write_imitation_archive_with_manifest(file_name, manifest):
+    tf = tarfile.open(file_name, 'w')
+    try:
+        with TemporaryFile() as f:
+            f.write(json.dumps(manifest).encode('utf-8'))
+
+            ti = tarfile.TarInfo('manifest.json')
+            ti.size = f.tell()
+
+            f.seek(0)
+            tf.addfile(ti, f)
+
+    finally:
+        # In Python 2.6, this does not have __exit__
+        tf.close()
+
+
+def write_irrelevant_tar(file_name):
+    '''
+    Create a tar file that does not match the spec for "docker image save" / "docker image load" commands.
+
+    :param file_name: Name of tar file to create
+    :type file_name: str
+    '''
+
+    tf = tarfile.open(file_name, 'w')
+    try:
+        with TemporaryFile() as f:
+            f.write('Hello, world.'.encode('utf-8'))
+
+            ti = tarfile.TarInfo('hi.txt')
+            ti.size = f.tell()
+
+            f.seek(0)
+            tf.addfile(ti, f)
+
+    finally:
+        tf.close()