[BUG] opm alpha bundle validate does not detect invalid semver

[sugarraysam]

Introduction

OPM recently changed their semver package #910. It does not allow the "v" prefix in the CSV version fields. When running bundle validation command, my expectation is that the tooling should detect and failed on invalid semver. This error is unfortunately only catched after an index image is built using the faulty bundle.

The validation should cover all CSV fields where semver are expected:

• spec.version
• spec.replaces
• spec.skips
• annotations."olm.skipRange"

Example

I have a local bundle which uses v1.1.1-57:

# CSV uses "v" prefix
$ cat manifests/rhods-operator.1.1.1-57.clusterserviceversion.yml| yq .spec.version
"v1.1.1-57"

# Image is built and pushed here: quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da
$ opm alpha bundle validate --tag quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da
INFO[0000] Create a temp directory at /tmp/bundle-1847428757  container-tool=docker
DEBU[0000] Pulling and unpacking container image         container-tool=docker
INFO[0000] running /usr/bin/docker pull quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da  container-tool=docker
INFO[0002] running docker create                         container-tool=docker
DEBU[0002] [docker create quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da ]  container-tool=docker
INFO[0002] running docker cp                             container-tool=docker
DEBU[0002] [docker cp f2e44644351599e36e52268fc34fda9a95b16848aefe039cb39b327d74670561:/. /tmp/bundle-1847428757]  container-tool=docker
INFO[0002] running docker rm                             container-tool=docker
DEBU[0002] [docker rm f2e44644351599e36e52268fc34fda9a95b16848aefe039cb39b327d74670561]  container-tool=docker
INFO[0002] Unpacked image layers, validating bundle image format & contents  container-tool=docker
DEBU[0002] Found manifests directory                     container-tool=docker
DEBU[0002] Found metadata directory                      container-tool=docker
DEBU[0002] Getting mediaType info from manifests directory  container-tool=docker
DEBU[0002] Found annotations file                        container-tool=docker
DEBU[0002] Could not find optional dependencies file     container-tool=docker
DEBU[0002] Validating bundle contents                    container-tool=docker
DEBU[0002] Validating "apiextensions.k8s.io/v1, Kind=CustomResourceDefinition" from file "kfdef.apps.kubeflow.org.crd.yml"  container-tool=docker
DEBU[0002] Validating "operators.coreos.com/v1alpha1, Kind=ClusterServiceVersion" from file "rhods-operator.1.1.1-57.clusterserviceversion.yml"  container-tool=docker
INFO[0002] All validation tests have been completed successfully  container-tool=docker

# Validation is successful
$ echo $?
0

# Invalid semver is triggered by `opm index` when building an sql-based index image with the bundle
$ opm index --container-tool docker add --bundles quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da --tag quay.io/sblaisdo/rhods-index:5ac30da
WARN[0000] DEPRECATION NOTICE:
Sqlite-based catalogs and their related subcommands are deprecated. Support for
them will be removed in a future release. Please migrate your catalog workflows
to the new file-based catalog format.
INFO[0000] building the index                            bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]"
INFO[0000] running /usr/bin/docker pull quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da  bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]"
INFO[0001] running docker create                         bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]"
INFO[0001] running docker cp                             bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]"
INFO[0001] running docker rm                             bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]"
INFO[0001] Could not find optional dependencies file     file=bundle_tmp1812320581/metadata load=annotations with=./bundle_tmp1812320581
INFO[0001] Could not find optional properties file       file=bundle_tmp1812320581/metadata load=annotations with=./bundle_tmp1812320581
INFO[0001] Could not find optional dependencies file     file=bundle_tmp1812320581/metadata load=annotations with=./bundle_tmp1812320581
INFO[0001] Could not find optional properties file       file=bundle_tmp1812320581/metadata load=annotations with=./bundle_tmp1812320581
ERRO[0001] permissive mode disabled                      bundles="[quay.io/sblaisdo/rhods-bundle:1.1.1-57-5ac30da]" error="error parsing bundle rhods-operator.1.1.1-57 version v1.1.1-57: Invalid character(s) found in major number \"v1\""
Error: error parsing bundle rhods-operator.1.1.1-57 version v1.1.1-57: Invalid character(s) found in major number "v1"

OPM version

$ opm version
Version: version.Version{OpmVersion:"v1.21.0", GitCommit:"9999f796", BuildDate:"2022-03-03T21:23:12Z", GoOs:"linux", GoArch:"amd64"}

[joelanford]

Semver is not expected in spec.replaces or spec.skips.

Also, this validation logic exists in the operator-framework/api repo. The issue tracking these fixes is: https://github.com/operator-framework/api/issues/226

We'll need to vendor a new version of the api repo in this repo when that fix is released.

[sugarraysam]

I'm confused though, because if you use "v" prefixes in your version, than how would you reference past bundles in spec.replaces ?