Add spoc convert Command

cmd/spoc/main.go

@@ -26,6 +26,7 @@ import (
 
 	"sigs.k8s.io/security-profiles-operator/cmd"
 	spocli "sigs.k8s.io/security-profiles-operator/internal/pkg/cli"
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/cli/converter"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/cli/merger"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/cli/puller"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/cli/pusher"
@@ -99,6 +100,27 @@ func main() {
 				},
 			},
 		},
+		&cli.Command{
+			Name:      "convert",
+			Aliases:   []string{"c"},
+			Usage:     "convert a security profile to its raw format",
+			Action:    convert,
+			ArgsUsage: "PROFILE",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:        converter.FlagOutputFile,
+					Aliases:     []string{"o"},
+					Usage:       "the output file path for the raw profile",
+					DefaultText: converter.DefaultOutputFile,
+					TakesFile:   true,
+				},
+				&cli.StringFlag{
+					Name:    converter.FlagProgramName,
+					Aliases: []string{"p"},
+					Usage:   "AppArmor only: the path to the program that is confined.",
+				},
+			},
+		},
 		&cli.Command{
 			Name:      "run",
 			Aliases:   []string{"x"},
@@ -227,6 +249,20 @@ func merge(ctx *cli.Context) error {
 	return nil
 }
 
+// convert runs the `spoc convert` subcommand.
+func convert(ctx *cli.Context) error {
+	options, err := converter.FromContext(ctx)
+	if err != nil {
+		return fmt.Errorf("build options: %w", err)
+	}
+
+	if err := converter.New(options).Run(); err != nil {
+		return fmt.Errorf("launch converter: %w", err)
+	}
+
+	return nil
+}
+
 // run runs the `spoc run` subcommand.
 func run(ctx *cli.Context) error {
 	options, err := runner.FromContext(ctx)

internal/pkg/artifact/artifact.go

@@ -18,6 +18,7 @@ package artifact
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"path/filepath"
 	"strings"
@@ -337,41 +338,33 @@ func (a *Artifact) Pull(
 		return nil, fmt.Errorf("read profile: %w", err)
 	}
 
-	a.logger.Info("Trying to unmarshal seccomp profile")
-	seccompProfile := &seccompprofileapi.SeccompProfile{}
-	err = a.YamlUnmarshal(content, seccompProfile)
-	if err == nil {
+	profile, err := a.ReadProfile(content)
+	if err != nil {
+		return nil, errors.Join(ErrDecodeYAML, err)
+	}
+
+	switch obj := profile.(type) {
+	case *seccompprofileapi.SeccompProfile:
 		return &PullResult{
 			typ:            PullResultTypeSeccompProfile,
-			seccompProfile: seccompProfile,
+			seccompProfile: obj,
 			content:        content,
 		}, nil
-	}
-
-	a.logger.Info("Trying to unmarshal selinux profile")
-	selinuxProfile := &selinuxprofileapi.SelinuxProfile{}
-	err = a.YamlUnmarshal(content, selinuxProfile)
-	if err == nil {
+	case *selinuxprofileapi.SelinuxProfile:
 		return &PullResult{
 			typ:            PullResultTypeSelinuxProfile,
-			selinuxProfile: selinuxProfile,
+			selinuxProfile: obj,
 			content:        content,
 		}, nil
-	}
-
-	a.logger.Info("Trying to unmarshal apparmor profile")
-	apparmorProfile := &apparmorprofileapi.AppArmorProfile{}
-	err = a.YamlUnmarshal(content, apparmorProfile)
-	if err == nil {
+	case *apparmorprofileapi.AppArmorProfile:
 		return &PullResult{
 			typ:             PullResultTypeApparmorProfile,
-			apparmorProfile: apparmorProfile,
+			apparmorProfile: obj,
 			content:         content,
 		}, nil
+	default:
+		return nil, fmt.Errorf("cannot process %T to PullResult", obj)
 	}
-
-	a.logger.Info("No profile found")
-	return nil, fmt.Errorf("%w: last err: %w", ErrDecodeYAML, err)
 }
 
 // profileName returns the name for the profile based on the platform.

internal/pkg/artifact/artifact_test.go

@@ -28,6 +28,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"oras.land/oras-go/v2/registry/remote"
 
+	apparmorprofileapi "sigs.k8s.io/security-profiles-operator/api/apparmorprofile/v1alpha1"
+	seccompprofileapi "sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1beta1"
+	selinuxprofileapi "sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha2"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/artifact/artifactfakes"
 )
 
@@ -233,6 +236,7 @@ func TestPull(t *testing.T) {
 				mock.NewRepositoryReturns(&remote.Repository{}, nil)
 				mock.ParseReferenceReturns(testRef, nil)
 				mock.ReadFileReturns([]byte{}, nil)
+				mock.ReadProfileReturns(&seccompprofileapi.SeccompProfile{}, nil)
 				mock.RemoveAllReturns(errTest)
 				mock.FileCloseReturns(errTest)
 			},
@@ -250,6 +254,7 @@ func TestPull(t *testing.T) {
 				mock.NewRepositoryReturns(&remote.Repository{}, nil)
 				mock.ParseReferenceReturns(testRef, nil)
 				mock.ReadFileReturns([]byte{}, nil)
+				mock.ReadProfileReturns(&seccompprofileapi.SeccompProfile{}, nil)
 			},
 			assert: func(res *PullResult, err error) {
 				require.NoError(t, err)
@@ -265,7 +270,7 @@ func TestPull(t *testing.T) {
 				mock.NewRepositoryReturns(&remote.Repository{}, nil)
 				mock.ParseReferenceReturns(testRef, nil)
 				mock.ReadFileReturns([]byte{}, nil)
-				mock.YamlUnmarshalReturnsOnCall(0, errTest)
+				mock.ReadProfileReturns(&selinuxprofileapi.SelinuxProfile{}, nil)
 			},
 			assert: func(res *PullResult, err error) {
 				require.NoError(t, err)
@@ -281,8 +286,7 @@ func TestPull(t *testing.T) {
 				mock.NewRepositoryReturns(&remote.Repository{}, nil)
 				mock.ParseReferenceReturns(testRef, nil)
 				mock.ReadFileReturns([]byte{}, nil)
-				mock.YamlUnmarshalReturnsOnCall(0, errTest)
-				mock.YamlUnmarshalReturnsOnCall(1, errTest)
+				mock.ReadProfileReturns(&apparmorprofileapi.AppArmorProfile{}, nil)
 			},
 			assert: func(res *PullResult, err error) {
 				require.NoError(t, err)
@@ -298,7 +302,7 @@ func TestPull(t *testing.T) {
 				mock.NewRepositoryReturns(&remote.Repository{}, nil)
 				mock.ParseReferenceReturns(testRef, nil)
 				mock.ReadFileReturns([]byte{}, nil)
-				mock.YamlUnmarshalReturns(errTest)
+				mock.ReadProfileReturns(nil, errTest)
 			},
 			assert: func(res *PullResult, err error) {
 				require.ErrorIs(t, err, ErrDecodeYAML)