From 7693a7498ae8383a2abdf0d3b29ff3d19f555300 Mon Sep 17 00:00:00 2001
From: Hang Park <hangpark@kaist.ac.kr>
Date: Sun, 20 Oct 2019 20:00:12 +0900
Subject: [PATCH] fix(pkg/downloader) Generate digest from both chart deps and
 lock file

> Commits would be squashed after reviews.

To make digest includes information about Chart.yaml dependencies, not
only the lock file, digest calculation is changed to accept both
contents.

Signed-off-by: Hang Park <hangpark@kaist.ac.kr>
---
 internal/resolver/resolver.go      |  6 +++---
 internal/resolver/resolver_test.go | 28 ++++++++++++++++++++++------
 pkg/downloader/manager.go          |  2 +-
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/internal/resolver/resolver.go b/internal/resolver/resolver.go
index 79238b22f..600b13471 100644
--- a/internal/resolver/resolver.go
+++ b/internal/resolver/resolver.go
@@ -123,7 +123,7 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string
 		return nil, errors.Errorf("can't get a valid version for repositories %s. Try changing the version constraint in Chart.yaml", strings.Join(missing, ", "))
 	}
 
-	digest, err := HashReq(locked)
+	digest, err := HashReq(reqs, locked)
 	if err != nil {
 		return nil, err
 	}
@@ -139,8 +139,8 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string
 //
 // This should be used only to compare against another hash generated by this
 // function.
-func HashReq(req []*chart.Dependency) (string, error) {
-	data, err := json.Marshal(req)
+func HashReq(req []*chart.Dependency, lock []*chart.Dependency) (string, error) {
+	data, err := json.Marshal([2][]*chart.Dependency{req, lock})
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/resolver/resolver_test.go b/internal/resolver/resolver_test.go
index 6bb29ba9a..390375c71 100644
--- a/internal/resolver/resolver_test.go
+++ b/internal/resolver/resolver_test.go
@@ -125,7 +125,7 @@ func TestResolve(t *testing.T) {
 			t.Fatalf("Expected error in test %q", tt.name)
 		}
 
-		if h, err := HashReq(tt.expect.Dependencies); err != nil {
+		if h, err := HashReq(tt.req, tt.expect.Dependencies); err != nil {
 			t.Fatal(err)
 		} else if h != l.Digest {
 			t.Errorf("%q: hashes don't match.", tt.name)
@@ -150,11 +150,14 @@ func TestResolve(t *testing.T) {
 }
 
 func TestHashReq(t *testing.T) {
-	expect := "sha256:d661820b01ed7bcf26eed8f01cf16380e0a76326ba33058d3150f919d9b15bc0"
+	expect := "sha256:96045f8dfd8769a3a1af6202449fa620c900992277803e799fe31c3897f179e8"
 	req := []*chart.Dependency{
-		{Name: "alpine", Version: "0.1.0", Repository: "http://localhost:8879/charts"},
+		{Name: "alpine", Version: "^0.1.0", Repository: "http://localhost:8879/charts"},
 	}
-	h, err := HashReq(req)
+	lock := []*chart.Dependency{
+		{Name: "alpine", Version: "0.1.2", Repository: "http://localhost:8879/charts"},
+	}
+	h, err := HashReq(req, lock)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -162,8 +165,21 @@ func TestHashReq(t *testing.T) {
 		t.Errorf("Expected %q, got %q", expect, h)
 	}
 
-	req = []*chart.Dependency{}
-	h, err = HashReq(req)
+	req2 := []*chart.Dependency{
+		{Name: "alpine", Version: "^0.1.2", Repository: "http://localhost:8879/charts"},
+	}
+	h, err = HashReq(req2, lock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if expect == h {
+		t.Errorf("Expected %q !=  %q", expect, h)
+	}
+
+	lock2 := []*chart.Dependency{
+		{Name: "alpine", Version: "0.1.3", Repository: "http://localhost:8879/charts"},
+	}
+	h, err = HashReq(req, lock2)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/downloader/manager.go b/pkg/downloader/manager.go
index f1dea342f..b8b810029 100644
--- a/pkg/downloader/manager.go
+++ b/pkg/downloader/manager.go
@@ -79,7 +79,7 @@ func (m *Manager) Build() error {
 	}
 
 	req := c.Metadata.Dependencies
-	if sum, err := resolver.HashReq(req); err != nil || sum != lock.Digest {
+	if sum, err := resolver.HashReq(req, lock.Dependencies); err != nil || sum != lock.Digest {
 		return errors.New("Chart.lock is out of sync with Chart.yaml")
 	}