willbennett-devops opened a new issue, #14431:
URL: https://github.com/apache/cloudstack/issues/14431
### problem
`getUploadParamsForIso` accepts `checksum`, but the value never reaches the
template record. The upload completes, the ISO goes Ready, and `listIsos` shows
no checksum. Nothing compares the uploaded bytes to it.
`getUploadParamsForKubernetesSupportedVersion` goes through the same path (it
builds a `GetUploadParamsForIsoCmd` and sets the checksum on it), so it's
affected too.
Cause: `TemplateAdapterBase.prepare(GetUploadParamsForIsoCmd)` builds
`IsoUploadParams` without `cmd.getChecksum()`, and the short `UploadParamsBase`
constructor leaves checksum null. The template version of `prepare` does pass
it.
### versions
4.23.0.0, KVM, advanced zone. Same code on main (d3f0700e97) and in 4.22.0.0
from reading the source, so probably not a regression.
### The steps to reproduce the bug
1. `sha256sum some.iso`
2. `getUploadParamsForIso name=test zoneid=<zone> ostypeid=<os>
checksum={SHA-256}<digest>` (or `getUploadParamsForKubernetesSupportedVersion
... format=ISO checksum=...`)
3. POST the file to the returned URL with the signature, metadata and
expires headers.
4. Wait for Ready, then `listIsos id=<id>`.
Expected: checksum is stored, checked against the uploaded file, and shown
in `listIsos`.
Actual: no checksum on the ISO, so a file that doesn't match the digest
would go Ready just the same.
### What to do about it?
Pass the checksum through in `prepare(GetUploadParamsForIsoCmd)` (a setter
on `UploadParamsBase`, or the long constructor).
Careful though, forwarding it alone probably breaks the upload.
`NfsSecondaryStorageResource.postUpload` adds `-c <checksum>` when it calls
`createtmplt.sh`, but in that script `-c` is a no-argument flag (`getopts
'vcuht:n:f:s:d:S:'`, it sets `cloud=true`). So the digest becomes a stray
argument and getopts stops before `-n`, `-t`, `-f` and `-u`. That's from
reading the code, haven't run it with the checksum forwarded. The checksum
probably needs to be checked somewhere else (e.g. a `ComputeChecksumCommand`
after the upload completes) instead of being handed to the script.
Also worth a look: template sync can move a pending uploaded ISO to Ready on
its own, which would skip any check added in the upload status path.
Happy to put up a PR if that direction sounds right.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
