Require matching architecture for bootable images

xref containers/bootc#682

lib/src/container/store.rs

@@ -20,7 +20,9 @@ use containers_image_proxy::{ImageProxy, OpenedImage};
 use flate2::Compression;
 use fn_error_context::context;
 use futures_util::TryFutureExt;
-use oci_spec::image::{self as oci_image, Descriptor, History, ImageConfiguration, ImageManifest};
+use oci_spec::image::{
+    self as oci_image, Arch, Descriptor, History, ImageConfiguration, ImageManifest,
+};
 use ostree::prelude::{Cast, FileEnumeratorExt, FileExt, ToVariant};
 use ostree::{gio, glib};
 use std::collections::{BTreeSet, HashMap};
@@ -584,6 +586,11 @@ impl ImageImporter {
             if !bootable {
                 anyhow::bail!("Target image does not have {bootable_key} label");
             }
+            let container_arch = config.architecture();
+            let target_arch = &Arch::default();
+            if container_arch != target_arch {
+                anyhow::bail!("Image has architecture {container_arch}; expected {target_arch}");
+            }
         }
 
         let (commit_layer, component_layers, remaining_layers) =

lib/src/integrationtest.rs

@@ -10,8 +10,10 @@ use cap_std_ext::cap_std;
 use containers_image_proxy::oci_spec;
 use fn_error_context::context;
 use gio::prelude::*;
-use oci_spec::image as oci_image;
-use ocidir::GzipLayerWriter;
+use ocidir::{
+    oci_spec::image::{Arch, Platform},
+    GzipLayerWriter,
+};
 use ostree::gio;
 use xshell::cmd;
 
@@ -46,6 +48,7 @@ pub fn generate_derived_oci(
             Ok(())
         },
         tag,
+        None,
     )
 }
 
@@ -56,6 +59,7 @@ pub fn generate_derived_oci_from_tar<F>(
     src: impl AsRef<Utf8Path>,
     f: F,
     tag: Option<&str>,
+    arch: Option<Arch>,
 ) -> Result<()>
 where
     F: FnOnce(&mut GzipLayerWriter) -> Result<()>,
@@ -67,6 +71,10 @@ where
     let mut manifest = src.read_manifest()?;
     let mut config: oci_spec::image::ImageConfiguration = src.read_json_blob(manifest.config())?;
 
+    if let Some(arch) = arch.as_ref() {
+        config.set_architecture(arch.clone());
+    }
+
     let mut bw = src.create_gzip_layer(None)?;
     f(&mut bw)?;
     let new_layer = bw.complete()?;
@@ -92,10 +100,15 @@ where
     let new_config_desc = src.write_config(config)?;
     manifest.set_config(new_config_desc);
 
+    let mut platform = Platform::default();
+    if let Some(arch) = arch.as_ref() {
+        platform.set_architecture(arch.clone());
+    }
+
     if let Some(tag) = tag {
-        src.insert_manifest(manifest, Some(tag), oci_image::Platform::default())?;
+        src.insert_manifest(manifest, Some(tag), platform)?;
     } else {
-        src.replace_with_single_manifest(manifest, oci_image::Platform::default())?;
+        src.replace_with_single_manifest(manifest, platform)?;
     }
     Ok(())
 }

lib/tests/it/main.rs

@@ -4,6 +4,7 @@ use cap_std::fs::{Dir, DirBuilder, DirBuilderExt};
 use cap_std_ext::cap_std;
 use containers_image_proxy::oci_spec;
 use containers_image_proxy::oci_spec::image::ImageManifest;
+use ocidir::oci_spec::image::Arch;
 use once_cell::sync::Lazy;
 use ostree_ext::chunking::ObjectMetaSized;
 use ostree_ext::container::{store, ManifestDiff};
@@ -768,6 +769,55 @@ fn validate_chunked_structure(oci_path: &Utf8Path) -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn test_container_arch_mismatch() -> Result<()> {
+    let fixture = Fixture::new_v1()?;
+
+    let imgref = fixture.export_container().await.unwrap().0;
+
+    // Build a derived image
+    let derived_path = &fixture.path.join("derived.oci");
+    let srcpath = imgref.name.as_str();
+    oci_clone(srcpath, derived_path).await.unwrap();
+    ostree_ext::integrationtest::generate_derived_oci_from_tar(
+        derived_path,
+        |w| {
+            let mut layer_tar = tar::Builder::new(w);
+            let mut h = tar::Header::new_gnu();
+            h.set_uid(0);
+            h.set_gid(0);
+            h.set_size(0);
+            h.set_mode(0o755);
+            h.set_entry_type(tar::EntryType::Directory);
+            layer_tar.append_data(
+                &mut h.clone(),
+                "etc/mips-operating-system",
+                &mut std::io::empty(),
+            )?;
+            layer_tar.into_inner()?;
+            Ok(())
+        },
+        None,
+        Some(Arch::Mips64le),
+    )?;
+
+    let derived_imgref = OstreeImageReference {
+        sigverify: SignatureSource::ContainerPolicyAllowInsecure,
+        imgref: ImageReference {
+            transport: Transport::OciDir,
+            name: derived_path.to_string(),
+        },
+    };
+    let mut imp =
+        store::ImageImporter::new(fixture.destrepo(), &derived_imgref, Default::default()).await?;
+    imp.require_bootable();
+    imp.set_ostree_version(2023, 11);
+    let r = imp.prepare().await;
+    assert_err_contains(r, "Image has architecture mips64le");
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn test_container_chunked() -> Result<()> {
     let nlayers = LAYERS_V0_LEN - 1;
@@ -1118,6 +1168,7 @@ async fn test_container_etc_hardlinked() -> Result<()> {
             Ok(())
         },
         None,
+        None,
     )?;
 
     let derived_imgref = OstreeImageReference {
@@ -1534,6 +1585,7 @@ async fn test_container_write_derive_sysroot_hardlink() -> Result<()> {
             Ok::<_, anyhow::Error>(())
         },
         None,
+        None,
     )?;
     let derived_ref = &OstreeImageReference {
         sigverify: SignatureSource::ContainerPolicyAllowInsecure,