func TestStage1LoadingFromConfigNoDiscovery(t *testing.T) {
	// We shouldn't be using discovery in this setup, but enable
	// it, just in case.
	setup := newStubStage1Setup(t, taas.GetDefaultServerSetup())
	defer setup.cleanup()

	cfg := &config.Stage1Data{
		Name:     setup.name,
		Version:  setup.version,
		Location: setup.getLocation(stubStage1PathAbs),
	}
	setup.generateStage1Config(cfg)
	cmd := fmt.Sprintf("%s --insecure-options=image,tls --debug run %s", setup.ctx.Cmd(), getInspectImagePath())
	child := spawnOrFail(setup.t, cmd)
	defer waitOrFail(setup.t, child, 0)
	discoveringStr := fmt.Sprintf("searching for app image %s", setup.name)
	for {
		matches, output, err := expectRegexWithOutput(child, `(?m)^image:.+$`)
		if err != nil {
			if strings.Index(output, stubStage1Output) < 0 {
				t.Fatalf("got no success notice from stub stage1, output:\n%s", output)
			}
			break
		}
		if strings.Index(matches[0], discoveringStr) >= 0 {
			t.Fatalf("rkt performs discovery for stage1 image, but it should not")
		}
	}
}

func TestFetchNoStoreCacheControl(t *testing.T) {
	imageName := "rkt-inspect-fetch-nostore-cachecontrol"
	imageFileName := fmt.Sprintf("%s.aci", imageName)
	// no spaces between words, because of an actool limitation
	successMsg := "deferredSignatureDownloadWasSuccessful"

	args := []string{
		fmt.Sprintf("--exec=/inspect --print-msg='%s'", successMsg),
		fmt.Sprintf("--name=%s", imageName),
	}
	image := patchTestACI(imageFileName, args...)
	defer os.Remove(image)

	asc := runSignImage(t, image, 1)
	defer os.Remove(asc)
	ascBase := filepath.Base(asc)

	setup := taas.GetDefaultServerSetup()
	setup.Server = taas.ServerQuay
	server := runServer(t, setup)
	defer server.Close()
	fileSet := make(map[string]string, 2)
	fileSet[imageFileName] = image
	fileSet[ascBase] = asc
	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}

	ctx := testutils.NewRktRunCtx()
	defer ctx.Cleanup()

	runRktTrust(t, ctx, "", 1)

	tests := []struct {
		imageArg string
		imageURL string
	}{
		{"https://127.0.0.1/" + imageFileName, "https://127.0.0.1/" + imageFileName},
		{"localhost/" + imageName, "https://127.0.0.1:443/localhost/" + imageFileName},
	}

	for _, tt := range tests {
		cmd := fmt.Sprintf("%s --no-store --debug --insecure-options=tls,image fetch %s", ctx.Cmd(), tt.imageArg)
		expectedMessage := fmt.Sprintf("fetching image from %s", tt.imageURL)
		runRktAndCheckRegexOutput(t, cmd, expectedMessage)

		cmd = fmt.Sprintf("%s --no-store --debug --insecure-options=tls,image fetch %s", ctx.Cmd(), tt.imageArg)
		expectedMessage = fmt.Sprintf("image for %s isn't expired, not fetching.", tt.imageURL)
		runRktAndCheckRegexOutput(t, cmd, expectedMessage)

		ctx.Reset()
	}
}

func runAuthServer(t *testing.T, auth taas.AuthType) (*taas.Server, string) {
	setup := taas.GetDefaultServerSetup()
	setup.Auth = auth
	setup.Port = taas.PortRandom
	server := runServer(t, setup)
	image := patchTestACI(authACIName, fmt.Sprintf("--exec=/inspect --print-msg='%s'", authSuccessfulDownload))
	fileSet := make(map[string]string, 1)
	fileSet[authACIName] = image
	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}
	return server, image
}

func TestDifferentDiscoveryLabels(t *testing.T) {
	manifestTemplate := `{"acKind":"ImageManifest","acVersion":"0.8.6","name":"IMG_NAME","labels":[{"name":"version","value":"1.2.0"},{"name":"arch","value":"amd64"},{"name":"os","value":"linux"}]}`
	emptyImage := getEmptyImagePath()
	imageName := "localhost/rkt-test-different-discovery-labels-image"
	manifest := strings.Replace(manifestTemplate, "IMG_NAME", imageName, -1)
	tmpDir := createTempDirOrPanic("rkt-TestDifferentDiscoveryLabels-")
	defer os.RemoveAll(tmpDir)

	tmpManifest, err := ioutil.TempFile(tmpDir, "manifest")
	if err != nil {
		panic(fmt.Sprintf("Cannot create temp manifest: %v", err))
	}
	if err := ioutil.WriteFile(tmpManifest.Name(), []byte(manifest), 0600); err != nil {
		panic(fmt.Sprintf("Cannot write to temp manifest: %v", err))
	}
	defer os.Remove(tmpManifest.Name())

	image := patchACI(emptyImage, "rkt-test-different-discovery-labels-image.aci", "--manifest", tmpManifest.Name())
	imageFileName := fmt.Sprintf("%s.aci", filepath.Base(imageName))
	defer os.Remove(image)

	asc := runSignImage(t, image, 1)
	defer os.Remove(asc)
	ascBase := filepath.Base(asc)

	setup := taas.GetDefaultServerSetup()
	server := runServer(t, setup)
	defer server.Close()
	fileSet := make(map[string]string, 2)
	fileSet[imageFileName] = image
	fileSet[ascBase] = asc
	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}

	tests := []struct {
		imageName       string
		expectedMessage string
	}{
		{imageName + ":2.0", fmt.Sprintf("requested value for label %q: %q differs from fetched aci label value: %q", "version", "2.0", "1.2.0")},
		{imageName + ":latest", fmt.Sprintf("requested value for label %q: %q differs from fetched aci label value: %q", "version", "latest", "1.2.0")},
		{imageName + ",arch=armv7b", fmt.Sprintf("requested value for label %q: %q differs from fetched aci label value: %q", "arch", "armv7b", "amd64")},
		{imageName + ",unexistinglabel=bla", fmt.Sprintf("requested label %q not provided by the image manifest", "unexistinglabel")},
	}

	for _, tt := range tests {
		testDifferentDiscoveryNameLabels(t, tt.imageName, tt.expectedMessage)
	}
}

func TestStage1LoadingFromFlagsHttp(t *testing.T) {
	// We need no discovery, so use random port.
	serverSetup := taas.GetDefaultServerSetup()
	serverSetup.Protocol = taas.ProtocolHttp
	serverSetup.Port = taas.PortRandom
	setup := newStubStage1Setup(t, serverSetup)
	defer setup.cleanup()

	flag := fmt.Sprintf("--stage1-url=%q", setup.getLocation(stubStage1UrlHttp))
	expectedFirstRun := fmt.Sprintf("image: remote fetching from URL %q", setup.getLocation(stubStage1UrlHttp))
	expectedSecondRun := fmt.Sprintf("image: using image from local store for url %s", setup.getLocation(stubStage1UrlHttp))

	setup.check(flag, expectedFirstRun)
	setup.check(flag, expectedSecondRun)
}

func TestRenderOnFetch(t *testing.T) {
	// If overlayfs is not supported, we don't render images on fetch
	if !common.SupportsOverlay() {
		t.Skip("Overlay fs not supported.")
	}
	ctx := testutils.NewRktRunCtx()
	defer ctx.Cleanup()

	server := runServer(t, taas.GetDefaultServerSetup())
	defer server.Close()

	fileSet, imageList := generateComplexDependencyTree(t, ctx)
	for _, img := range imageList {
		defer os.Remove(img.fileName)
	}

	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}

	for i := len(imageList) - 1; i >= 0; i-- {
		img := imageList[i]
		if img.prefetch {
			t.Logf("Importing image %q: %q", img.imageName, img.fileName)
			testImageShortHash, err := importImageAndFetchHash(t, ctx, "", img.fileName)
			if err != nil {
				t.Fatalf("%v", err)
			}
			t.Logf("Imported image %q: %s", img.imageName, testImageShortHash)
		}
	}

	fetchCmd := fmt.Sprintf("%s --debug --insecure-options=image,tls fetch %s", ctx.Cmd(), topImage)
	child := spawnOrFail(t, fetchCmd)

	treeStoreDir := filepath.Join(ctx.DataDir(), "cas", "tree")
	trees, err := ioutil.ReadDir(treeStoreDir)
	if err != nil {
		panic(fmt.Sprintf("Cannot read tree store dir: %v", err))
	}

	// We expect 2 trees: stage1 and the image
	if len(trees) != 2 {
		t.Fatalf("Expected 2 trees but found %d", len(trees))
	}

	waitOrFail(t, child, 0)
}

// TestImageDependencies generates ACIs with a complex dependency tree and
// fetches them via the discovery mechanism. Some dependencies are already
// cached in the CAS, and some dependencies are fetched via the discovery
// mechanism. This is to reproduce the scenario in explained in:
// https://github.com/coreos/rkt/issues/1752#issue-117121841
func TestImageDependencies(t *testing.T) {
	ctx := testutils.NewRktRunCtx()
	defer ctx.Cleanup()

	server := runServer(t, taas.GetDefaultServerSetup())
	defer server.Close()

	fileSet, imageList := generateComplexDependencyTree(t, ctx)
	for _, img := range imageList {
		defer os.Remove(img.fileName)
	}

	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}

	for i := len(imageList) - 1; i >= 0; i-- {
		img := imageList[i]
		if img.prefetch {
			t.Logf("Importing image %q: %q", img.imageName, img.fileName)
			testImageShortHash, err := importImageAndFetchHash(t, ctx, "", img.fileName)
			if err != nil {
				t.Fatalf("%v", err)
			}
			t.Logf("Imported image %q: %s", img.imageName, testImageShortHash)
		}
	}

	runCmd := fmt.Sprintf("%s --debug --insecure-options=image,tls run %s", ctx.Cmd(), topImage)
	child := spawnOrFail(t, runCmd)

	expectedList := []string{
		fmt.Sprintf("image: fetching image from %s/localhost/image-a.aci", server.URL),
		"image: using image from local store for image name localhost/image-b",
		fmt.Sprintf("image: fetching image from %s/localhost/image-c.aci", server.URL),
		fmt.Sprintf("image: fetching image from %s/localhost/image-d.aci", server.URL),
		"image: using image from local store for image name coreos.com/rkt-inspect",
		"HelloDependencies",
	}

	for _, expected := range expectedList {
		if err := expectWithOutput(child, expected); err != nil {
			t.Fatalf("Expected %q but not found: %v", expected, err)
		}
	}

	waitOrFail(t, child, 0)
}

func TestDeferredSignatureDownload(t *testing.T) {
	imageName := "localhost/rkt-inspect-deferred-signature-download"
	imageFileName := fmt.Sprintf("%s.aci", filepath.Base(imageName))
	// no spaces between words, because of an actool limitation
	successMsg := "deferredSignatureDownloadWasSuccessful"

	args := []string{
		fmt.Sprintf("--exec=/inspect --print-msg='%s'", successMsg),
		fmt.Sprintf("--name=%s", imageName),
	}
	image := patchTestACI(imageFileName, args...)
	defer os.Remove(image)

	asc := runSignImage(t, image, 1)
	defer os.Remove(asc)
	ascBase := filepath.Base(asc)

	setup := taas.GetDefaultServerSetup()
	setup.Server = taas.ServerQuay
	server := runServer(t, setup)
	defer server.Close()
	fileSet := make(map[string]string, 2)
	fileSet[imageFileName] = image
	fileSet[ascBase] = asc
	if err := server.UpdateFileSet(fileSet); err != nil {
		t.Fatalf("Failed to populate a file list in test aci server: %v", err)
	}

	ctx := testutils.NewRktRunCtx()
	defer ctx.Cleanup()

	runRktTrust(t, ctx, "", 1)

	runCmd := fmt.Sprintf("%s --debug --insecure-options=tls run %s", ctx.Cmd(), imageName)
	child := spawnOrFail(t, runCmd)
	defer waitOrFail(t, child, 0)

	expectedMessages := []string{
		"server requested deferring the signature download",
		successMsg,
	}
	for _, msg := range expectedMessages {
		if err := expectWithOutput(child, msg); err != nil {
			t.Fatalf("Could not find expected msg %q, output follows:\n%v", msg, err)
		}
	}
}

func TestStage1LoadingFromConfigHttp(t *testing.T) {
	// We don't need discovery in this test, so get random port.
	serverSetup := taas.GetDefaultServerSetup()
	serverSetup.Protocol = taas.ProtocolHttp
	serverSetup.Port = taas.PortRandom
	setup := newStubStage1Setup(t, serverSetup)
	defer setup.cleanup()
	expectedFirstRun := fmt.Sprintf("image: remote fetching from URL %q", setup.getLocation(stubStage1UrlHttp))
	expectedSecondRun := fmt.Sprintf("image: using image from local store for image name %s:%s", setup.name, setup.version)
	cfg := &config.Stage1Data{
		Name:     setup.name,
		Version:  setup.version,
		Location: setup.getLocation(stubStage1UrlHttp),
	}

	t.Logf("Generating stage1 configuration file with name %q, version %q and location %q", setup.name, setup.version, setup.getLocation(stubStage1UrlHttp))
	setup.generateStage1Config(cfg)
	setup.check("", expectedFirstRun)
	setup.check("", expectedSecondRun)
}

func TestStage1LoadingFromConfig(t *testing.T) {
	// We don't need discovery in this test, so get random port,
	// but keep https.
	serverSetup := taas.GetDefaultServerSetup()
	serverSetup.Port = taas.PortRandom
	setup := newStubStage1Setup(t, serverSetup)
	defer setup.cleanup()

	tests := []struct {
		name              string
		version           string
		location          string
		expectedFirstRun  string
		expectedSecondRun string
		skipReason        string
	}{
		// typical scenario - config file with correct name,
		// version and location, we expect the stage1 image to
		// be taken from file in the first run, and then from
		// store on subsequent runs
		{
			name:              setup.name,
			version:           setup.version,
			location:          setup.getLocation(stubStage1PathAbs),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from local store for image name %s:%s", setup.name, setup.version),
		},

		// wrong name, resulting in always loading the stage1
		// image from disk
		{
			name:              "example.com/stage1",
			version:           setup.version,
			location:          setup.getLocation(stubStage1PathAbs),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
		},

		// wrong version, resulting in always loading the stage1
		// image from disk
		{
			name:              setup.name,
			version:           "3.2.1",
			location:          setup.getLocation(stubStage1PathAbs),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
		},

		// loading stage1 from http URL
		{
			name:       setup.name,
			version:    setup.version,
			location:   setup.getLocation(stubStage1UrlHttp),
			skipReason: "tested in TestStage1LoadingFromConfigHttp",
		},

		// loading stage1 from docker URL
		{
			name:       setup.name,
			version:    setup.version,
			location:   setup.getLocation(stubStage1UrlDocker),
			skipReason: "tested in TestStage1LoadingFromConfigDocker",
		},

		// loading stage1 from https URL
		{
			name:              setup.name,
			version:           setup.version,
			location:          setup.getLocation(stubStage1UrlHttps),
			expectedFirstRun:  fmt.Sprintf("image: remote fetching from URL %q", setup.getLocation(stubStage1UrlHttps)),
			expectedSecondRun: fmt.Sprintf("image: using image from local store for image name %s:%s", setup.name, setup.version),
		},

		// loading stage1 from file URL
		{
			name:              setup.name,
			version:           setup.version,
			location:          setup.getLocation(stubStage1UrlFile),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from local store for image name %s:%s", setup.name, setup.version),
		},
	}

	for _, tt := range tests {
		if tt.skipReason != "" {
			t.Logf("skipping the testcase with name %q, version %q and location %q, reason - %s", tt.name, tt.version, tt.location, tt.skipReason)
			continue
		}
		cfg := &config.Stage1Data{
			Name:     tt.name,
			Version:  tt.version,
			Location: tt.location,
		}
		t.Logf("Generating stage1 configuration file with name %q, version %q and location %q", tt.name, tt.version, tt.location)
		setup.generateStage1Config(cfg)
		setup.check("", tt.expectedFirstRun)
		setup.check("", tt.expectedSecondRun)
		setup.ctx.Reset()
	}
}

func TestStage1LoadingFromFlags(t *testing.T) {
	// We use discovery in this test.
	setup := newStubStage1Setup(t, taas.GetDefaultServerSetup())
	defer setup.cleanup()

	tests := []struct {
		flag              string
		expectedFirstRun  string
		expectedSecondRun string
		skipReason        string
	}{
		// --stage1-path with a relative path
		{
			flag:              fmt.Sprintf("--stage1-path=%q", setup.getLocation(stubStage1PathRel)),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathRel)),
			expectedSecondRun: fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathRel)),
		},

		// --stage1-path with an absolute path
		{
			flag:              fmt.Sprintf("--stage1-path=%q", setup.getLocation(stubStage1PathAbs)),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
		},

		// --stage1-url with an http URL
		{
			flag:       "--stage1-url=http://...",
			skipReason: "tested in TestStage1LoadingFromFlagsHttp",
		},

		// --stage1-url with an docker URL
		{
			flag:       "--stage1-url=docker://...",
			skipReason: "tested in TestStage1LoadingFromFlagsDocker",
		},

		// --stage1-url with an https URL
		{
			flag:              fmt.Sprintf("--stage1-url=%q", setup.getLocation(stubStage1UrlHttps)),
			expectedFirstRun:  fmt.Sprintf("image: remote fetching from URL %q", setup.getLocation(stubStage1UrlHttps)),
			expectedSecondRun: fmt.Sprintf("image: using image from local store for url %s", setup.getLocation(stubStage1UrlHttps)),
		},

		// --stage1-url with an file URL
		{
			flag:              fmt.Sprintf("--stage1-url=%q", setup.getLocation(stubStage1UrlFile)),
			expectedFirstRun:  fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
			expectedSecondRun: fmt.Sprintf("image: using image from file %s", setup.getLocation(stubStage1PathAbs)),
		},

		// --stage1-name
		{
			flag:              fmt.Sprintf("--stage1-name=%s", setup.getLocation(stubStage1Name)),
			expectedFirstRun:  fmt.Sprintf("image: searching for app image %s", setup.name),
			expectedSecondRun: fmt.Sprintf("image: using image from local store for image name %s", setup.getLocation(stubStage1Name)),
		},

		// --stage1-hash
		{
			flag:       "--stage1-hash=...",
			skipReason: "tested in TestStage1LoadingFromFlagsHash",
		},

		// --stage1-from-dir
		{
			flag:       "--stage1-from-dir=...",
			skipReason: "tested in TestStage1LoadingFromFlagsFromDir",
		},
	}

	for _, tt := range tests {
		if tt.skipReason != "" {
			t.Logf("skipping the testcase with the flag %s, reason - %s", tt.flag, tt.skipReason)
			continue
		}
		setup.check(tt.flag, tt.expectedFirstRun)
		setup.check(tt.flag, tt.expectedSecondRun)
		setup.ctx.Reset()
	}
}

// TestImageDependencies generates ACIs with a complex dependency tree and
// fetches them via the discovery mechanism. Some dependencies are already
// cached in the CAS, and some dependencies are fetched via the discovery
// mechanism. This is to reproduce the scenario in explained in:
// https://github.com/coreos/rkt/issues/1752#issue-117121841
func TestImageDependencies(t *testing.T) {
	tmpDir := createTempDirOrPanic("rkt-TestImageDeps-")
	defer os.RemoveAll(tmpDir)

	ctx := testutils.NewRktRunCtx()
	defer ctx.Cleanup()

	server := runServer(t, taas.GetDefaultServerSetup())
	defer server.Close()

	baseImage := getInspectImagePath()
	_ = importImageAndFetchHash(t, ctx, "", baseImage)
	emptyImage := getEmptyImagePath()
	fileSet := make(map[string]string)

	// Scenario from https://github.com/coreos/rkt/issues/1752#issue-117121841
	//
	// A->B
	// A->C
	// A->D
	//
	// B: prefetched
	//
	// C->B
	// C->E
	//
	// D->B
	// D->E

	topImage := "localhost/image-a"
	imageList := []struct {
		shortName string
		imageName string
		deps      string
		version   string
		prefetch  bool

		manifest string
		fileName string
	}{
		{
			shortName: "a",
			imageName: topImage,
			deps:      `{"imageName":"localhost/image-b"}, {"imageName":"localhost/image-c"}, {"imageName":"localhost/image-d"}`,
			version:   "1",
		},
		{
			shortName: "b",
			imageName: "localhost/image-b",
			deps:      ``,
			version:   "1",
			prefetch:  true,
		},
		{
			shortName: "c",
			imageName: "localhost/image-c",
			deps:      `{"imageName":"localhost/image-b"}, {"imageName":"localhost/image-e", "labels": [{"name": "version", "value": "1"}]}`,
			version:   "1",
		},
		{
			shortName: "d",
			imageName: "localhost/image-d",
			deps:      `{"imageName":"localhost/image-b"}, {"imageName":"localhost/image-e", "labels": [{"name": "version", "value": "1"}]}`,
			version:   "1",
		},
		{
			shortName: "e",
			imageName: "localhost/image-e",
			deps:      `{"imageName":"coreos.com/rkt-inspect"}`,
			version:   "1",
		},
	}

	for i, _ := range imageList {
		// We need a reference rather than a new copy from "range"
		// because we modify the content
		img := &imageList[i]

		img.manifest = manifestDepsTemplate
		img.manifest = strings.Replace(img.manifest, "IMG_NAME", img.imageName, -1)
		img.manifest = strings.Replace(img.manifest, "DEPENDENCIES", img.deps, -1)
		img.manifest = strings.Replace(img.manifest, "VERSION", img.version, -1)

		tmpManifest, err := ioutil.TempFile(tmpDir, "manifest-"+img.shortName+"-")
		if err != nil {
			panic(fmt.Sprintf("Cannot create temp manifest: %v", err))
		}
		defer os.Remove(tmpManifest.Name())
		if err := ioutil.WriteFile(tmpManifest.Name(), []byte(img.manifest), 0600); err != nil {
			panic(fmt.Sprintf("Cannot write to temp manifest: %v", err))
		}

		baseName := "image-" + img.shortName + ".aci"
		img.fileName = patchACI(emptyImage, baseName, "--manifest", tmpManifest.Name())
		defer os.Remove(img.fileName)
//.........这里部分代码省略.........