mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Philip Conrad
ba8e650e00
This commit fixes an issue where `plan` and `wasm` bundle build targets could produce different output bytes across separate invocations of `opa build` for the same inputs. There were two underlying causes, both from Golang random map iteration order leaking through to the order-sensitive planner. Causes: - `compilePlan` (`v1/compile`) and `planQuery` (`v1/rego`) iterated over the compiler's module map without sorting keys first. This caused the planner to have iteration-dependent variations in output. This was fixed by sorting the module names before use. - `planRules` (`internal/planner`) sorted rules by length of the rule name ref, which is not a unique value. Because the sorting of the rules was using an unstable sorting algorithm, and the rule names were coming from iterating over a `map` type in the rule trie, this had edge cases where non-deterministic output ordering could creep in. This was fixed by adding a ref `Compare` call as a tie-breaker to get a stable sorting order, regardless of iteration order in the rule trie. This commit also adds regression tests that assert plan output is independent of module and rule ordering. The two fixes are needed together because both sets of issues hit the planner from different angles, and are mostly independent of each other. Signed-off-by: Philip Conrad <philip_conrad@apple.com>