CWCOW: Include merged layer hash

Signed-off-by: Mahati Chamarthy <mahati.chamarthy@gmail.com>

Author: MahatiC

internal/gcs-sidecar/handlers.go

@@ -641,11 +641,7 @@ func (b *Bridge) modifySettings(req *request) (err error) {
 					log.G(ctx).Debugf("block CIM layer digest %s, path: %s\n", layerHashes[i], physicalDevPath)
 				}
 
-				// skip the merged cim and verify individual layer hashes
 				hashesToVerify := layerHashes
-				if len(layerHashes) > 1 {
-					hashesToVerify = layerHashes[1:]
-				}
 
 				err := b.hostState.securityOptions.PolicyEnforcer.EnforceVerifiedCIMsPolicy(req.ctx, containerID, hashesToVerify)
 				if err != nil {

pkg/ociwclayer/cim/import.go

@@ -96,7 +96,7 @@ func WithParentLayers(parentLayers []*cimfs.BlockCIM) BlockCIMLayerImportOpt {
 	}
 }
 
-func writeIntegrityChecksumInfoFile(ctx context.Context, blockPath string) error {
+func writeIntegrityChecksumInfoFile(ctx context.Context, blockPath string, pathName string) error {
 	log.G(ctx).Debugf("writing integrity checksum file for block CIM `%s`", blockPath)
 	// for convenience write a file that has the hex encoded root digest of the generated verified CIM.
 	// this same hex string can be used in the confidential policy.
@@ -105,7 +105,7 @@ func writeIntegrityChecksumInfoFile(ctx context.Context, blockPath string) error
 		return fmt.Errorf("failed to query verified info of the CIM layer: %w", err)
 	}
 
-	digestFile, err := os.Create(filepath.Join(filepath.Dir(blockPath), "integrity_checksum"))
+	digestFile, err := os.Create(filepath.Join(filepath.Dir(blockPath), pathName))
 	if err != nil {
 		return fmt.Errorf("failed to create verification info file: %w", err)
 	}
@@ -120,6 +120,18 @@ func writeIntegrityChecksumInfoFile(ctx context.Context, blockPath string) error
 	return nil
 }
 
+func GetIntegrityChecksum(ctx context.Context, blockPath string) (string, error) {
+	log.G(ctx).Debugf("Getting integrity checksum for block CIM `%s`", blockPath)
+	digest, err := cimfs.GetVerificationInfo(blockPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to query verified info of the CIM layer: %w", err)
+	}
+
+	digestStr := hex.EncodeToString(digest)
+
+	return digestStr, nil
+}
+
 func ImportBlockCIMLayerWithOpts(ctx context.Context, r io.Reader, layer *cimfs.BlockCIM, opts ...BlockCIMLayerImportOpt) (_ int64, err error) {
 	log.G(ctx).WithField("layer", layer).Debug("Importing block CIM layer from tar")
 
@@ -164,7 +176,7 @@ func ImportBlockCIMLayerWithOpts(ctx context.Context, r io.Reader, layer *cimfs.
 	}
 
 	if config.dataIntegrity {
-		if err = writeIntegrityChecksumInfoFile(ctx, layer.BlockPath); err != nil {
+		if err = writeIntegrityChecksumInfoFile(ctx, layer.BlockPath, "integrity_checksum"); err != nil {
 			return 0, err
 		}
 	}
@@ -358,5 +370,10 @@ func MergeBlockCIMLayersWithOpts(ctx context.Context, sourceCIMs []*cimfs.BlockC
 			return fmt.Errorf("append VHD footer to block CIM: %w", err)
 		}
 	}
+	if config.dataIntegrity {
+		if err = writeIntegrityChecksumInfoFile(ctx, mergedCIM.BlockPath, "merged_integrity_checksum"); err != nil {
+			return err
+		}
+	}
 	return nil
 }