feat: add bsf dockerfile digests command

cmd/dockerfile/df.go

@@ -2,27 +2,15 @@ package dockerfile
 
 import (
 	"fmt"
-	"io"
 	"os"
 
 	"github.com/spf13/cobra"
 
-	binit "github.com/buildsafedev/bsf/cmd/init"
-	ocicmd "github.com/buildsafedev/bsf/cmd/oci"
 	"github.com/buildsafedev/bsf/cmd/styles"
-	"github.com/buildsafedev/bsf/pkg/builddocker"
-	"github.com/buildsafedev/bsf/pkg/generate"
-	bgit "github.com/buildsafedev/bsf/pkg/git"
-	"github.com/buildsafedev/bsf/pkg/hcl2nix"
-)
-
-var (
-	output, platform string
 )
 
 func init() {
-	DFCmd.Flags().StringVarP(&output, "output", "o", "", "location of the dockerfile generated")
-	DFCmd.Flags().StringVarP(&platform, "platform", "p", "", "The platform to build the image for")
+	DFCmd.AddCommand(DGCmd)
 }
 
 // DFCmd represents the generate command
@@ -32,64 +20,9 @@ var DFCmd = &cobra.Command{
 	Aliases: []string{"df"},
 	Long: `
 	bsf dockerfile <artifact> 
-	bsf dockerfile <artifact> --platform <platform>
-	bsf dockerfile <artifact> --platform <platform> --output <output filename>
 	`,
 	Run: func(cmd *cobra.Command, args []string) {
-		if len(args) < 1 {
-			fmt.Println(styles.HintStyle.Render("hint:", "run `bsf dockerfile <artifact>` to export the environment"))
-			os.Exit(1)
-		}
-
-		conf, err := hcl2nix.ReadHclFile("bsf.hcl")
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-
-		env, p, err := ocicmd.ProcessPlatformAndConfig(conf, platform, args[0])
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-		platform = p
-
-		sc, fh, err := binit.GetBSFInitializers()
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-
-		err = generate.Generate(fh, sc)
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-
-		err = bgit.Add("bsf/")
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-
-		var dfw io.Writer
-		if output == "" {
-			dfw = os.Stdout
-		} else {
-			dfh, err := os.Create(output)
-			if err != nil {
-				fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-				os.Exit(1)
-			}
-			defer dfh.Close()
-			dfw = dfh
-		}
-
-		err = builddocker.GenerateDockerfile(dfw, env, platform)
-		if err != nil {
-			fmt.Println(styles.ErrorStyle.Render("error: ", err.Error()))
-			os.Exit(1)
-		}
-
+		fmt.Println(styles.HintStyle.Render("hint: use bsf dockerfile with a subcomand"))
+		os.Exit(1)
 	},
 }

cmd/dockerfile/digests.go

@@ -0,0 +1,71 @@
+package dockerfile
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/buildsafedev/bsf/cmd/styles"
+	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-billy/v5/osfs"
+	"github.com/spf13/cobra"
+	"github.com/stacklok/frizbee/pkg/replacer"
+	"github.com/stacklok/frizbee/pkg/utils/config"
+)
+
+var DGCmd = &cobra.Command{
+	Use:     "digests",
+	Short:   "Replace Dockerfile image tags with immutable digests",
+	Aliases: []string{"dg"},
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) < 1 {
+			fmt.Println(styles.HintStyle.Render("hint:", "run `bsf dockerfile digests <Dockerfile>` to replace image tags with digests"))
+			os.Exit(1)
+		}
+
+		dockerfile := args[0]
+
+		r := replacer.NewContainerImagesReplacer(config.DefaultConfig())
+
+		str, err := r.ParsePath(context.TODO(), dockerfile)
+		if err != nil {
+			fmt.Println(styles.ErrorStyle.Render("error in parsing Dockerfile contents", err.Error()))
+			os.Exit(1)
+		}
+
+		if err = processOutput(dockerfile, str.Modified); err != nil {
+			fmt.Println(styles.ErrorStyle.Render("error in writing Dockerfile contents", err.Error()))
+			os.Exit(1)
+		}
+	},
+}
+
+func processOutput(path string, modified map[string]string) error {
+	basedir := filepath.Dir(path)
+	bfs := osfs.New(basedir, osfs.WithBoundOS())
+	var out io.Writer
+
+	for path, content := range modified {
+		f, err := bfs.OpenFile(path, os.O_WRONLY|os.O_TRUNC, 0644)
+		if err != nil {
+			return fmt.Errorf("failed to open file %s: %w", path, err)
+		}
+
+		defer func(f billy.File) {
+			if err := f.Close(); err != nil {
+				fmt.Println(styles.ErrorStyle.Render("failed to close file %s: %v", path, err.Error()))
+			}
+		}(f)
+
+		out = f
+
+		_, err = fmt.Fprintf(out, "%s", content)
+		if err != nil {
+			return fmt.Errorf("failed to write to file %s: %w", path, err)
+		}
+	}
+
+	return nil
+}

go.mod

@@ -1,9 +1,11 @@
 module github.com/buildsafedev/bsf
 
-go 1.21
+go 1.21.0
+
+toolchain go1.22.2
 
 require (
-	github.com/BurntSushi/toml v0.3.1
+	github.com/BurntSushi/toml v1.2.1
 	github.com/awalterschulze/gographviz v2.0.3+incompatible
 	github.com/bom-squad/protobom v0.3.0
 	github.com/buildsafedev/bsf-apis v0.0.0-20240301225559-0cabfd4c881d
@@ -13,13 +15,15 @@ require (
 	github.com/elewis787/boa v0.1.2
 	github.com/go-git/go-git/v5 v5.11.0
 	github.com/google/go-cmp v0.6.0
+	github.com/google/go-containerregistry v0.20.1
 	github.com/google/go-github/v62 v62.0.0
 	github.com/hashicorp/hcl/v2 v2.19.1
 	github.com/in-toto/in-toto-golang v0.9.0
 	github.com/nix-community/go-nix v0.0.0-20231219074122-93cb24a86856
 	github.com/opencontainers/image-spec v1.1.0
-	github.com/spf13/cobra v1.8.0
-	github.com/stretchr/testify v1.8.4
+	github.com/spf13/cobra v1.8.1
+	github.com/stacklok/frizbee v0.0.20
+	github.com/stretchr/testify v1.9.0
 	github.com/tidwall/gjson v1.17.1
 	golang.org/x/mod v0.17.0
 	golang.org/x/oauth2 v0.21.0
@@ -32,12 +36,23 @@ require (
 
 require (
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
+	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/deckarep/golang-set/v2 v2.6.0 // indirect
+	github.com/docker/cli v27.0.3+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/google/go-github/v61 v61.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/moby/buildkit v0.14.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/puzpuzpuz/xsync v1.5.2 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
+	github.com/vbatts/tar-split v0.11.5 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	golang.org/x/sync v0.7.0 // indirect
 )
@@ -46,7 +61,7 @@ require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.32.0-20231115204500-e097f827e652.1 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/CycloneDX/cyclonedx-go v0.8.0 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20230627203149-c72ef8859ca9 // indirect
@@ -58,8 +73,8 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/containerd/console v1.0.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.3.0 // indirect
 	github.com/dgraph-io/badger/v3 v3.2103.2 // indirect
 	github.com/dgraph-io/ristretto v0.1.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -78,7 +93,7 @@ require (
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jedib0t/go-pretty/v6 v6.5.9
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.2 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
@@ -96,7 +111,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sahilm/fuzzy v0.1.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.7.0 // indirect
 	github.com/sergi/go-diff v1.1.0 // indirect
@@ -110,9 +125,8 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	golang.org/x/crypto v0.24.0 // indirect
 	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240610135401-a8a62080eff3 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240617180043-68d350f18fd4 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect