manifest that opactl generates inside the bundle misses some roots from the bundle

[gusega]

Hello,

I build my bundle with ocp and create a local archive. When I extract the archive I checked the manifest and it does not contain many of the roots that I have in my policies. If I try to start opa with that bundle, it tells me:

error: load error: bundle /bundles/mybundle.tar.gz: manifest roots [ roots ... ] ] do not permit 'package some.package in module '/dir/jpolicies/my_policy.rego'

If I run opa with --ignore=.*, then opa can start.

[srenatus]

Thanks for the report! Can you share some more details about your config, please?

[gusega]

@srenatus

  use-cases:
    object_storage:
      filesystem:
        path: bundles/the-bundle.tar.gz
    requirements:
      - source: jonaGold
      - source: grannySmith
      - source: gala
      - source: heloWorld
      - source: thiIs
      - source: aNiceWeather
      - source: whatIsThis
      - source: today
      - source: itsTime
      - source: to
      - source: eatMy
      - source: breakfastQuickly
      - source: thereAreMany
      - source: many
      - source: variousSources
      - source: fuji
      - source: alvanija
      - source: mdpl
      - source: americanBeauty
      - source: anabela
      - source: annaBoelens
      - source: anneElizabethAPPL
      - source: antonovka
      - source: apiEtoile
      - source: arkansasBlack
      - source: arthurTurner
      - source: arthurWBarnes
      - source: ashmaedsKernel
      - source: ashmoreAPPLE
      - source: ausbacherRotapfelApple
      - source: austinSweetApple
sources:
  jonaGold:
    directory: ../../../../use-cases-repository/use-cases/jonaGold/policies
    paths: &rego_glob
      - "**/*.rego"
  grannySmith:
    directory: ../../../../use-cases-repository/use-cases/grannySmith/policies
    paths: *rego_glob
  gala:
    directory: ../../../../use-cases-repository/use-cases/gala/policies
    paths: *rego_glob
  heloWorld:
    directory: ../../../../use-cases-repository/use-cases/heloWorld/policies
    paths: *rego_glob
  thiIs:
    directory: ../../../../use-cases-repository/use-cases/thiIs/policies
    paths: *rego_glob
  aNiceWeather:
    directory: ../../../../use-cases-repository/use-cases/aNiceWeather/policies
    paths: *rego_glob
  whatIsThis:
    directory: ../../../../use-cases-repository/use-cases/whatIsThis/policies
    paths: *rego_glob
  today:
    directory: ../../../../use-cases-repository/use-cases/today/policies
    paths: *rego_glob
  itsTime:
    directory: ../../../../use-cases-repository/use-cases/itsTime/policies
    paths: *rego_glob
  to:
    directory: ../../../../use-cases-repository/use-cases/to/policies
    paths: *rego_glob
  eatMy:
    directory: ../../../../use-cases-repository/use-cases/eatMy/policies
    paths: *rego_glob
  breakfastQuickly:
    directory: ../../../../use-cases-repository/use-cases/breakfastQuickly/policies
    paths: *rego_glob
  thereAreMany:
    directory: ../../../../use-cases-repository/use-cases/thereAreMany/policies
    paths: *rego_glob
  many:
    directory: ../../../../use-cases-repository/use-cases/many/policies
    paths: *rego_glob
  variousSources:
    directory: ../../../../use-cases-repository/use-cases/variousSources/policies
    paths: *rego_glob
  fuji:
    directory: ../../../../use-cases-repository/use-cases/fuji/policies
    paths: *rego_glob
  alvanija:
    directory: ../../../../use-cases-repository/use-cases/alvanija/policies
    paths: *rego_glob
  mdpl:
    directory: ../../../../use-cases-repository/use-cases/ambrosia/policies
    paths: *rego_glob
  americanBeauty:
    directory: ../../../../use-cases-repository/use-cases/americanBeauty/policies
    paths: *rego_glob
  anabela:
    directory: ../../../../use-cases-repository/use-cases/anabela/policies
    paths: *rego_glob
  annaBoelens:
    directory: ../../../../use-cases-repository/use-cases/annaBoelens/policies
    paths: *rego_glob
  anneElizabethAPPL:
    directory: ../../../../use-cases-repository/use-cases/anneElizabethAPPL/policies
    paths: *rego_glob
  antonovka:
    directory: ../../../../use-cases-repository/use-cases/antonovka/policies
    paths: *rego_glob
  apiEtoile:
    directory: ../../../../use-cases-repository/use-cases/apiEtoile/policies
    paths: *rego_glob
  arkansasBlack:
    directory: ../../../../use-cases-repository/use-cases/arkansasBlack/policies
    paths: *rego_glob
  arthurTurner:
    directory: ../../../../use-cases-repository/use-cases/arthurTurner/policies
    paths: *rego_glob
  arthurWBarnes:
    directory: ../../../../use-cases-repository/use-cases/arthurWBarnes/policies
    paths: *rego_glob
  ashmaedsKernel:
    directory: ../../../../use-cases-repository/use-cases/ashmaedsKernel/policies
    paths: *rego_glob
  ashmoreAPPLE:
    directory: ../../../../use-cases-repository/use-cases/ashmoreAPPLE/policies
    paths: *rego_glob
  ausbacherRotapfelApple:
    directory: ../../../../use-cases-repository/use-cases/ausbacherRotapfelApple/policies
    paths: *rego_glob
  austinSweetApple:
    directory: ../../../../use-cases-repository/use-cases/austinSweetApple/policies
    paths: *rego_glob

[gusega]

I first run rego linter through the code so it's all in directories according to the packages names.

What I noticed opa has difficulties with the following layouts:

use-cases/austinSweetApple/policies
	\_some
		\_package
			 \_my_package
					 \_orange_test.rego
					 \_orange.rego
			 \_utils
					\_utils_test.rego
	 				\_utils.rego
			\_hello_something_test.rego
			\_hello_other_test.rego
            \_hello.rego

[gusega]

Or for example with layout like this:

use-cases/johnaGold/policies
	\_some
		\_other
			 \_tree
					 \_tree_test.rego
			 \_squirel
					\_squirel_test.rego
			 \_dog
					\_dog_test.rego
			 \_policy.rego

[gusega]

Also OCP does not filter out _test policies by itself, so I see a lot of test roots like my.package_test in the resulting manifest.

[gusega]

Many packages in different sources share the same package prefix.

[srenatus]

Thanks for the report. It would be easier to fix this if you could try to come up with a MWE. Please try! 🙏

[gusega]

@srenatus ok thanks.

[shwick]

I have run into what I'm pretty sure is the same issue, here's a reproducible example:
Given this source:

alpha/p.rego        package alpha
alpha/c1/p.rego     package alpha.c1
alpha/c2/p.rego     package alpha.c2
gamma/p.rego        package gamma

And this ocp.yaml:

bundles:
  example:
    object_storage:
      filesystem:
        path: "bundle.tar.gz"
    requirements:
    - source: example-policies

sources:
  example-policies:
    directory: '/abs/path/to/example'
    paths:
    - "**/*.rego"

Build and inspect the manifest:

$ opactl build -c ocp.yaml
$ tar -xzOf bundle.tar.gz /.manifest

We expect:

{"revision":"","roots":["alpha","gamma"],"rego_version":0}

But we get:

{"revision":"","roots":["alpha"],"rego_version":0}

gamma is dropped from the roots, the related rego file is present in the bundle.

Trying to run opa inspect bundle.tar.gz or running the bundle with opa produces the following message:

$ opa inspect bundle.tar.gz 
error: bundle bundle.tar.gz: manifest roots [alpha] do not permit 'package gamma' in module '/example-policies/gamma/p.rego''

An AI agent has recommended the following fix. While I've verified everything above is correct, I'm not familiar enough with the codebase to know that this is the correct fix for the issue, but I'll paste it here since I've verified that it does fix this particular issue:
refSet.add method in pkg/builder/builder.go:

func (rs *refSet) add(ns ...ast.Ref) {
+next:
	for _, n := range ns {
		for i, r := range rs.refs {
			switch {
			case r.HasPrefix(n):
				rs.refs[i] = n
-				return        // ← exits the whole function, not just this ref
+				continue next
			case n.HasPrefix(r):
-				return        // ← exits the whole function, not just this ref 
+				continue next
			}
		}
		rs.refs = append(rs.refs, n)
	}
}