frontend: address source filter review feedback

Scope source filter config loading to the requested YAML path and decode it strictly so misspelled policy keys fail the build instead of silently disabling filtering.

Apply global excludes to generated node module source states as well, keep Windows preprocessing consistent with the unfiltered build source path, and make RPM provenance comments safe for multi-line exclusion patterns.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Author: cpuguy83

frontend/request.go

@@ -155,36 +155,23 @@ func getSigningConfigFromContext(ctx context.Context, client gwclient.Client, cf
 	return pc.Signer, nil
 }
 
-func getSourceFilterConfigFromContext(ctx context.Context, client gwclient.Client, cfgPath string, configState llb.State) (dalec.SourceFilterConfig, error) {
-	scDef, err := configState.Marshal(ctx)
-	if err != nil {
-		return dalec.SourceFilterConfig{}, err
-	}
-
-	res, err := client.Solve(ctx, gwclient.SolveRequest{
-		Definition: scDef.ToPB(),
-	})
-	if err != nil {
-		return dalec.SourceFilterConfig{}, err
-	}
-
-	ref, err := res.SingleRef()
+func getSourceFilterConfigFromContext(ctx context.Context, client gwclient.Client, cfgPath string, configCtxName string, getContext func(string, ...llb.LocalOption) (*llb.State, error), opts ...llb.ConstraintsOpt) (dalec.SourceFilterConfig, error) {
+	dt, err := readConfigFromContext(ctx, client, cfgPath, configCtxName, dalec.SourceOpts{
+		GetContext:   getContext,
+		SourceFilter: dalec.NoSourceFilter,
+	}, opts...)
 	if err != nil {
 		return dalec.SourceFilterConfig{}, err
 	}
 
-	dt, err := ref.ReadFile(ctx, gwclient.ReadRequest{
-		Filename: cfgPath,
-	})
-	if err != nil {
-		return dalec.SourceFilterConfig{}, err
-	}
+	return decodeSourceFilterConfig(ctx, dt)
+}
 
+func decodeSourceFilterConfig(ctx context.Context, dt []byte) (dalec.SourceFilterConfig, error) {
 	var cfg dalec.SourceFilterConfig
-	if err := yaml.Unmarshal(dt, &cfg); err != nil {
+	if err := yaml.UnmarshalContext(ctx, dt, &cfg, yaml.Strict()); err != nil {
 		return dalec.SourceFilterConfig{}, err
 	}
-
 	return cfg, nil
 }
 
@@ -291,22 +278,13 @@ func getSourceFilterContextNameWithDefault(client gwclient.Client) string {
 	return configCtxName
 }
 
-func loadSourceFilterConfig(ctx context.Context, client gwclient.Client, getContext func(string, ...llb.LocalOption) (*llb.State, error), opts ...llb.LocalOption) (dalec.SourceFilterConfig, error) {
+func loadSourceFilterConfig(ctx context.Context, client gwclient.Client, getContext func(string, ...llb.LocalOption) (*llb.State, error)) (dalec.SourceFilterConfig, error) {
 	cfgPath := getSourceFilterConfigPath(client)
 	if cfgPath == "" {
 		return dalec.SourceFilterConfig{}, nil
 	}
 
-	configCtxName := getSourceFilterContextNameWithDefault(client)
-	configState, err := getContext(configCtxName, opts...)
-	if err != nil {
-		return dalec.SourceFilterConfig{}, err
-	}
-	if configState == nil {
-		return dalec.SourceFilterConfig{}, errors.Errorf("context %q not found", configCtxName)
-	}
-
-	return getSourceFilterConfigFromContext(ctx, client, cfgPath, *configState)
+	return getSourceFilterConfigFromContext(ctx, client, cfgPath, getSourceFilterContextNameWithDefault(client), getContext)
 }
 
 func forwardToSigner(ctx context.Context, client gwclient.Client, cfg *dalec.PackageSigner, s llb.State, opts ...llb.ConstraintsOpt) (llb.State, error) {

frontend/request_test.go

@@ -0,0 +1,18 @@
+package frontend
+
+import (
+	"context"
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestDecodeSourceFilterConfigStrict(t *testing.T) {
+	t.Parallel()
+
+	_, err := decodeSourceFilterConfig(context.Background(), []byte(`
+global_exclude:
+  - vendor/**
+`))
+	assert.Assert(t, err != nil, "expected unknown source filter fields to fail")
+}

generator_nodemodules.go

@@ -104,7 +104,7 @@ func (s *Spec) NodeModDeps(sOpt SourceOpts, worker llb.State, opts ...llb.Constr
 			}
 			merged = merged.With(withNodeMod(gen, worker, key, opts...))
 		}
-		result[key] = merged
+		result[key] = merged.With(sourceFilterAtPath(sOpt, key, opts...))
 	}
 	return result
 }

packaging/linux/rpm/template.go

@@ -393,7 +393,13 @@ func docSourceFilter(w io.Writer, name string, values []string) error {
 		return err
 	}
 	for _, value := range values {
-		if _, err := fmt.Fprintf(w, "# \t%s\n", value); err != nil {
+		scanner := bufio.NewScanner(strings.NewReader(value))
+		for scanner.Scan() {
+			if _, err := fmt.Fprintf(w, "# \t%s\n", scanner.Text()); err != nil {
+				return err
+			}
+		}
+		if err := scanner.Err(); err != nil {
 			return err
 		}
 	}

packaging/linux/rpm/template_test.go

@@ -297,6 +297,23 @@ func TestTemplateSources(t *testing.T) {
 		assert.Check(t, strings.Contains(s, "# \tExcludes:\n# \t\t testdata/**\n"))
 		assert.Check(t, strings.Contains(s, "# Exclusions:\n# \tvendor/**\n"))
 	})
+
+	t.Run("source filter docs multiline exclusion", func(t *testing.T) {
+		w := &specWrapper{
+			Spec: &dalec.Spec{
+				Sources: map[string]dalec.Source{
+					"src1": {
+						Inline: &dalec.SourceInline{Dir: &dalec.SourceInlineDir{}},
+					},
+				},
+			},
+			SourceFilter: dalec.SourceFilterConfig{GlobalExcludes: []string{"vendor/**\nmalicious: value"}},
+		}
+
+		out, err := w.Sources()
+		assert.NilError(t, err)
+		assert.Check(t, strings.Contains(out.String(), "# Exclusions:\n# \tvendor/**\n# \tmalicious: value\n"))
+	})
 }
 
 func TestTemplate_Artifacts(t *testing.T) {

source_filter.go

@@ -60,6 +60,19 @@ func sourceFilter(sOpt SourceOpts, opts ...llb.ConstraintsOpt) llb.StateOption {
 	}
 }
 
+func sourceFilterAtPath(sOpt SourceOpts, base string, opts ...llb.ConstraintsOpt) llb.StateOption {
+	return func(in llb.State) llb.State {
+		excludes, err := sOpt.sourceFilterExcludes()
+		if err != nil {
+			return ErrorState(in, err)
+		}
+		if len(excludes) == 0 {
+			return in
+		}
+		return in.With(SourceFilterAtPath(base, SourceFilterConfig{GlobalExcludes: excludes}, opts...))
+	}
+}
+
 // SourceFilter filters source package content from the root of the input state.
 func SourceFilter(cfg SourceFilterConfig, opts ...llb.ConstraintsOpt) llb.StateOption {
 	return func(in llb.State) llb.State {

targets/windows/handle_zip.go

@@ -161,17 +161,17 @@ func buildBinaries(ctx context.Context, spec *dalec.Spec, worker llb.State, clie
 		worker = worker.With(distroConfig.InstallBuildDeps(ctx, sOpt, spec, targetKey, opts...))
 	}
 
+	buildSourceOpts := sOpt.WithoutSourceFilter()
+
 	// Preprocess the spec to generate patches for gomod edits and other generators
 	// This must happen after build deps are installed so Go is available
-	if err := spec.Preprocess(sOpt, worker, opts...); err != nil {
+	if err := spec.Preprocess(buildSourceOpts, worker, opts...); err != nil {
 		return dalec.ErrorState(worker, err)
 	}
 
 	// Apply source map constraints for build steps
 	opts = append(opts, spec.Build.Steps.GetSourceLocation(worker))
 
-	buildSourceOpts := sOpt
-	buildSourceOpts = buildSourceOpts.WithoutSourceFilter()
 	sources := sources(worker, spec, buildSourceOpts, opts...)
 
 	addGoCache(spec, targetKey)