mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
br0x2
4fa5d202a7
### Why the changes in this PR are needed? The OCI bundle and discovery download paths used a deterministic default OCI store under the process temp directory when `persistence_directory` was not configured. In a shared temp directory, that made the store location predictable before OPA initialized the local OCI layout. This PR follows up on a report discussed with the OPA maintainers, where Anders Eknert confirmed this can be handled as a regular public issue/PR because it assumes local access to the system. ### What are the changes in this PR? This changes the non-persistent default OCI store handling so OPA no longer uses a fixed shared temp path for bundle/discovery OCI downloads. When callers do not provide a store path, `download.NewOCI` now creates a private temporary OCI store directory. The existing `persistence_directory` behavior is preserved: when configured, OPA still stores OCI state below `<persistence_directory>/oci`. This also adds regression coverage for the default and explicit OCI store path behavior. ### Notes to assist PR review: Tested with: ```bash GOMODCACHE=/ssd1/CCS/recurbug/verifies/build/go-mod-cache GOCACHE=/tmp/opa-gocache /tmp/opa-go/go/bin/go test ./v1/download ./v1/plugins/bundle ./v1/plugins/discovery ``` ### Further comments: I kept this PR focused on the default non-persistent OCI store path and did not include unrelated bundle or discovery refactoring. --------- Signed-off-by: kimdu0 <dino700072@gmail.com> Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> Co-authored-by: kimdu0 <dino700072@gmail.com> Co-authored-by: Sebastian Spaink <sebastianspaink@gmail.com>