[engine] Add support for vendor_path

Confirmed that the digest is enforced for vendored packages. While the
version is required, it is effectively ignored.

Change-Id: I96df2b906920d6d0bd681d2c1b1ef36a66bdefb5
Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/912874
Reviewed-by: Oliver Newman <olivernewman@google.com>
Fuchsia-Auto-Submit: Marc-Antoine Ruel <maruel@google.com>
Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>

internal/engine/config.go

@@ -116,7 +116,6 @@ func (doc *Document) Validate() error {
 		if path.Clean(doc.VendorPath) != doc.VendorPath {
 			return fmt.Errorf("vendor_path %s is not clean", doc.VendorPath)
 		}
-		return errors.New("vendor_path is not yet supported")
 	}
 	return nil
 }

internal/engine/config_test.go

@@ -251,6 +251,10 @@ func TestDocument_Validate(t *testing.T) {
 			"vendor_path: \"\"\n",
 			"",
 		},
+		{
+			"vendor_path: \"foo\"\n",
+			"",
+		},
 		{
 			"min_shac_version: \"1000\"\n",
 			func() string {
@@ -274,10 +278,6 @@ func TestDocument_Validate(t *testing.T) {
 			"vendor_path: \"foo/../bar\"\n",
 			"vendor_path foo/../bar is not clean",
 		},
-		{
-			"vendor_path: \"foo\"\n",
-			"vendor_path is not yet supported",
-		},
 		{
 			"requirements {\n" +
 				"  indirect {\n" +

internal/engine/pkg.go

@@ -100,6 +100,30 @@ func (p *PackageManager) RetrievePackages(ctx context.Context, root string, doc
 		depslists = [][]*Dependency{doc.Requirements.Direct, doc.Requirements.Indirect}
 	}
 
+	if doc.VendorPath != "" {
+		// Use the vendored versions.
+		vendorRoot := filepath.Join(root, doc.VendorPath)
+		for _, deps := range depslists {
+			// Do it serially for now, decided if parallelism helps performance later.
+			for _, d := range deps {
+				// url is believed to be vetted at this point.
+				dir := filepath.Join(vendorRoot, d.Url)
+				if err := isDir(dir); err != nil {
+					return packages, fmt.Errorf("vendored %w", err)
+				}
+				f, err := p.verifyDir(dir, d.Url, d.Version, doc.Sum.Digest(d.Url, d.Version))
+				if err != nil {
+					return packages, fmt.Errorf("%s couldn't be fetched: %w", d.Url, err)
+				}
+				packages[d.Url] = f
+				if d.Alias != "" {
+					packages[d.Alias] = f
+				}
+			}
+		}
+		return packages, nil
+	}
+
 	eg, ctx := errgroup.WithContext(ctx)
 	eg.SetLimit(pkgConcurrency)
 	for _, deps := range depslists {

internal/engine/run_test.go

@@ -1944,6 +1944,10 @@ func TestRun_FilesystemSandbox(t *testing.T) {
 	testStarlarkPrint(t, root, "ctx-os-exec-filesystem_sandbox.star", false, want)
 }
 
+func TestRun_Vendored(t *testing.T) {
+	testStarlarkPrint(t, "testdata/vendored", "shac.star", false, "[//shac.star:17] True\n")
+}
+
 // Utilities
 
 // testStarlarkPrint test a starlark file that calls print().

internal/engine/testdata/vendored/shac.star

@@ -0,0 +1,17 @@
+# Copyright 2023 The Shac Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@example.com/foo//pkg.star", "Awesomeness")
+
+print(Awesomeness)

internal/engine/testdata/vendored/shac.textproto

@@ -0,0 +1,32 @@
+# Copyright 2023 The Shac Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+min_shac_version: "0.0.0"
+allow_network: False
+vendor_path: "vendor"
+requirements {
+  direct {
+    url: "example.com/foo"
+    version: "unspecified"
+  }
+}
+sum {
+  known {
+    url: "example.com/foo"
+    seen {
+      version: "unspecified"
+      digest: "h1:mMeUDgNiVbXSAAycH71G2ZqOgTMRe5ujBGSSymGUlj0="
+    }
+  }
+}

shac.textproto

@@ -20,6 +20,7 @@ allow_network: False
 ignore: "/vendor/"
 # Vendored code for test data only.
 ignore: "/internal/engine/testdata/ut/"
+ignore: "/internal/engine/testdata/vendored/"
 # TODO(olivernewman): Make root non-writable once we can use caches and
 # pass-throughs to avoid having checks install tools and do Go builds within the
 # checkout directory.