bazel: add test for containers being equal regardless of the target platform

bazel/release/artifacts/BUILD.bazel

@@ -0,0 +1,74 @@
+load("//bazel/go:go_test.bzl", "go_test")
+load("//bazel/go:platform.bzl", "platform_binary")
+
+CLI_PLATFORMS = [
+    "darwin_amd64",
+    "darwin_arm64",
+    "linux_amd64",
+    "linux_arm64",
+    "windows_amd64",
+]
+
+[
+    platform_binary(
+        name = "container_sums_%s" % platform,
+        platform = "@io_bazel_rules_go//go/toolchain:" + platform,
+        target_file = "//bazel/release:container_sums",
+    )
+    for platform in CLI_PLATFORMS
+]
+
+[
+    platform_binary(
+        name = "cli_transitioned_to_%s" % platform,
+        platform = "@io_bazel_rules_go//go/toolchain:" + platform,
+        target_file = "//cli:cli_enterprise_linux_amd64",
+    )
+    for platform in CLI_PLATFORMS
+]
+
+platform_container_sums_paths = {
+    name: value
+    for name, value in [
+        (
+            "container_sums_%s" % platform,
+            "$(rlocationpath :container_sums_%s)" % platform,
+        )
+        for platform in CLI_PLATFORMS
+    ]
+}
+
+platform_container_sums = [
+    ":container_sums_%s" % platform
+    for platform in CLI_PLATFORMS
+]
+
+platform_clis_paths = {
+    name: value
+    for name, value in [
+        (
+            "cli_transitioned_to_%s" % platform,
+            "$(rlocationpath :cli_transitioned_to_%s)" % platform,
+        )
+        for platform in CLI_PLATFORMS
+    ]
+}
+
+platform_clis = [
+    ":cli_transitioned_to_%s" % platform
+    for platform in CLI_PLATFORMS
+]
+
+go_test(
+    name = "artifacts_test",
+    srcs = ["artifacts_test.go"],
+    # keep
+    count = 1,
+    # keep
+    data = platform_container_sums + platform_clis,
+    # keep
+    env = platform_container_sums_paths | platform_clis_paths,
+    # keep
+    x_defs = {"runsUnder": "bazel"},
+    deps = ["@io_bazel_rules_go//go/runfiles:go_default_library"],
+)

bazel/release/artifacts/artifacts_test.go

@@ -0,0 +1,104 @@
+/*
+Copyright (c) Edgeless Systems GmbH
+
+SPDX-License-Identifier: AGPL-3.0-only
+*/
+
+package artifacts
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/bazelbuild/rules_go/go/runfiles"
+)
+
+func TestContainerArtifacts(t *testing.T) {
+	if !runsUnderBazel() {
+		t.Skip("Skipping test as it is not running under Bazel")
+	}
+	compareArtifactsWithPrefix(t, "container_sums_")
+}
+
+func TestCLIArtifacts(t *testing.T) {
+	if !runsUnderBazel() {
+		t.Skip("Skipping test as it is not running under Bazel")
+	}
+	compareArtifactsWithPrefix(t, "cli_transitioned_to_")
+}
+
+type artifact struct {
+	name, path string
+}
+
+func compareArtifactsWithPrefix(t *testing.T, prefix string) {
+	artifacts := getAllArtifacts(prefix)
+	if len(artifacts) < 2 {
+		t.Fatal("No artifacts found")
+	}
+	hashes := make([]string, len(artifacts))
+	for i, artifact := range artifacts {
+		hash, err := hashForArtifact(artifact)
+		if err != nil {
+			t.Fatalf("hashing artifact %s: %v", artifact, err)
+		}
+		hashes[i] = hash
+	}
+	want := hashes[0]
+	for i := 1; i < len(hashes)-1; i++ {
+		if hashes[i] != want {
+			t.Errorf("hash for %s: %s, want %s", artifacts[i].name, hashes[i], want)
+		}
+	}
+}
+
+func getAllArtifacts(prefix string) []artifact {
+	envVars := os.Environ()
+	var artifacts []artifact
+	for _, envVar := range envVars {
+		k, v := splitEnvVar(envVar)
+		if strings.HasPrefix(k, prefix) {
+			path, err := runfiles.Rlocation(v)
+			if err != nil {
+				panic("could not find path to artifact")
+			}
+			artifacts = append(artifacts, artifact{k, path})
+		}
+	}
+	return artifacts
+}
+
+func splitEnvVar(envVar string) (string, string) {
+	split := strings.SplitN(envVar, "=", 2)
+	if len(split) == 0 {
+		return "", ""
+	}
+	if len(split) == 1 {
+		return split[0], ""
+	}
+	return split[0], split[1]
+}
+
+func hashForArtifact(artifact artifact) (string, error) {
+	f, err := os.Open(artifact.path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	hasher := sha256.New()
+	if _, err := io.Copy(hasher, f); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%x", hasher.Sum(nil)), nil
+}
+
+func runsUnderBazel() bool {
+	return runsUnder == "bazel"
+}
+
+// runsUnder is redefined only by the Bazel build at link time.
+var runsUnder = "go"