Centralize source manifest validation

internal/state/distributor_test.go

@@ -70,6 +70,60 @@ func TestParseRejectsInvalidEmbeddedManifest(t *testing.T) {
 	assertStateErrorContains(t, err, "source.manifest")
 }
 
+func TestValidateRejectsInvalidEmbeddedManifest(t *testing.T) {
+	tests := map[string]func(bundle.Manifest) bundle.Manifest{
+		"schema version": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.SchemaVersion = 2
+			return manifest
+		},
+		"empty id": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.ID = ""
+			return manifest
+		},
+		"bad digest": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Digest = "SHA256:099b205780d2b050024868399961b05731729a548d5d6329c7b06a6740dd75fe"
+			return manifest
+		},
+		"zero created": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Created = time.Time{}
+			return manifest
+		},
+		"empty files": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Files = nil
+			manifest.Digest = bundle.BundleDigest(manifest.Files)
+			return manifest
+		},
+		"unsafe path": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Files[0].Path = "../report.md"
+			manifest.Digest = bundle.BundleDigest(manifest.Files)
+			return manifest
+		},
+		"duplicate path": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Files[1].Path = manifest.Files[0].Path
+			manifest.Digest = bundle.BundleDigest(manifest.Files)
+			return manifest
+		},
+		"negative size": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Files[0].Size = -1
+			manifest.Digest = bundle.BundleDigest(manifest.Files)
+			return manifest
+		},
+		"digest mismatch": func(manifest bundle.Manifest) bundle.Manifest {
+			manifest.Digest = "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+			return manifest
+		},
+	}
+	for name, mutate := range tests {
+		t.Run(name, func(t *testing.T) {
+			source := mutate(validManifest(t))
+			state := *withState(t, validManifest(t), func(*DistributorState) {})
+			state.Source.Manifest = source
+			err := Validate(state)
+			assertStateErrorContains(t, err, "source.manifest")
+		})
+	}
+}
+
 func TestParseRejectsInvalidOutputMetadata(t *testing.T) {
 	source := validManifest(t)
 	tests := map[string]func(*DistributorState){

internal/state/validate.go

@@ -45,41 +45,7 @@ func Validate(s DistributorState) error {
 }
 
 func validateEmbeddedManifest(manifest bundle.Manifest) error {
-	if manifest.SchemaVersion != 1 {
-		return fmt.Errorf("schema_version must be 1")
-	}
-	if manifest.ID == "" {
-		return fmt.Errorf("id is required")
-	}
-	if err := bundle.ValidateDigest(manifest.Digest); err != nil {
-		return fmt.Errorf("digest: %w", err)
-	}
-	if manifest.Created.IsZero() {
-		return fmt.Errorf("created is required")
-	}
-	if len(manifest.Files) == 0 {
-		return fmt.Errorf("files is required")
-	}
-	seen := make(map[string]struct{}, len(manifest.Files))
-	for index, file := range manifest.Files {
-		if err := bundle.ValidateSourcePath(file.Path); err != nil {
-			return fmt.Errorf("files[%d].path: %w", index, err)
-		}
-		if err := bundle.ValidateDigest(file.SHA256); err != nil {
-			return fmt.Errorf("files[%d].sha256: %w", index, err)
-		}
-		if file.Size < 0 {
-			return fmt.Errorf("files[%d].size must be non-negative", index)
-		}
-		if _, exists := seen[file.Path]; exists {
-			return fmt.Errorf("files[%d].path duplicates %q", index, file.Path)
-		}
-		seen[file.Path] = struct{}{}
-	}
-	if actual := bundle.BundleDigest(manifest.Files); actual != manifest.Digest {
-		return fmt.Errorf("digest mismatch: got %s want %s", actual, manifest.Digest)
-	}
-	return nil
+	return bundle.ValidateManifest(manifest)
 }
 
 func validateOutput(index int, output OutputFile) error {