download: Fix saving OCI bundles on disk

This commit fixes an issue related to zero-sized bundles being saved to disk,
which can cause OPA to fail to start if a remote OCI repository is unavailable.

Fixes: #6939

Signed-off-by: Sergey-Kizimov <serget.kizimov@hiya.com>

download/oci_download.go

@@ -3,6 +3,7 @@
 package download
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -217,6 +218,7 @@ func (d *OCIDownloader) oneShot(ctx context.Context) error {
 
 func (d *OCIDownloader) download(ctx context.Context, m metrics.Metrics) (*downloaderResponse, error) {
 	d.logger.Debug("OCI - Download starting.")
+	var buf bytes.Buffer
 
 	preferences := []string{fmt.Sprintf("modes=%v,%v", defaultBundleMode, deltaBundleMode)}
 
@@ -256,10 +258,12 @@ func (d *OCIDownloader) download(ctx context.Context, m metrics.Metrics) (*downl
 		}, nil
 	}
 	fileReader, err := os.Open(bundleFilePath)
+	tee := io.TeeReader(fileReader, &buf)
+
 	if err != nil {
 		return nil, err
 	}
-	loader := bundle.NewTarballLoaderWithBaseURL(fileReader, d.localStorePath)
+	loader := bundle.NewTarballLoaderWithBaseURL(tee, d.localStorePath)
 	reader := bundle.NewCustomReader(loader).
 		WithMetrics(m).
 		WithBundleVerificationConfig(d.bvc).
@@ -274,7 +278,7 @@ func (d *OCIDownloader) download(ctx context.Context, m metrics.Metrics) (*downl
 
 	return &downloaderResponse{
 		b:        &bundleInfo,
-		raw:      fileReader,
+		raw:      &buf,
 		etag:     etag,
 		longPoll: false,
 	}, nil