Harden pipeline state and plan release upgrades

internal/config/notarius_test.go

@@ -100,6 +100,36 @@ notarius:
 	}
 }
 
+func TestNotariusRelativePathsDoNotMakeEffectiveDigestLocationDependent(t *testing.T) {
+	pipelineYAML := testPipelineBaseYAML + `
+notarius:
+  enabled: true
+  config_path: notarius/config.yml
+  pipeline_id: dnd-session
+`
+	paths := make([]string, 2)
+	configs := make([]*PipelineConfig, 2)
+	for index := range paths {
+		dir := t.TempDir()
+		paths[index] = filepath.Join(dir, "pipeline.yml")
+		if err := os.WriteFile(paths[index], []byte(pipelineYAML), 0o644); err != nil {
+			t.Fatalf("write pipeline %d: %v", index, err)
+		}
+		loaded, err := LoadPipeline(paths[index])
+		if err != nil {
+			t.Fatalf("LoadPipeline(%d) error = %v", index, err)
+		}
+		configs[index] = loaded
+	}
+	if configs[0].Notarius.ConfigPath == configs[1].Notarius.ConfigPath ||
+		configs[0].Notarius.WorkingDirectory == configs[1].Notarius.WorkingDirectory {
+		t.Fatalf("runtime Notarius paths should remain location-specific: %#v / %#v", configs[0].Notarius, configs[1].Notarius)
+	}
+	if first, second := EffectivePipelineDigest(configs[0]), EffectivePipelineDigest(configs[1]); first == "" || first != second {
+		t.Fatalf("relocated logical configuration digests = %q / %q, want equal non-empty values", first, second)
+	}
+}
+
 func TestNotariusStrictYAML(t *testing.T) {
 	tests := []struct {
 		name string