fwupdate: make content image verification generic

[tkatila]

ContentImageVerifier no longer speaks in API types nor knows anything about firmware. Its single method is VerifyImage(ctx, ImageVerifyRequest), where the request carries the image reference, pull secret, TLS setting and the expected files as plain fields, so any caller can use the verifier without owning a GPUFirmwareUpdate.

An empty Files list means "reachability only" and resolves the manifest with remote.Head instead of pulling every layer and streaming the export.

[Copilot]

Pull request overview

This PR generalizes content image verification so ContentImageVerifier no longer depends on GPU firmware API types, enabling any controller/component to verify an image’s reachability and (optionally) verify presence + SHA256 checksums for a set of files.

Changes:

• Replaced the verifier API with VerifyImage(ctx, ImageVerifyRequest) and introduced ImageVerifyRequest/ImageFile plain structs.
• Optimized “reachability-only” checks by resolving the manifest via remote.Head when no files are requested.
• Updated the GPUFirmwareUpdate controller and unit tests to use the new generic verifier request types.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
internal/controller/gpufirmwareupdate_controller.go	Converts firmware file specs into generic ImageFile entries and calls VerifyImage.
internal/controller/gpufirmwareupdate_controller_test.go	Updates tests and fakes to use VerifyImage / ImageFile.
internal/controller/contentimage_verifier.go	Implements generic request types, reachability-only fast path, and path normalization for tar vs request matching.

Suppressed comments (1)

internal/controller/contentimage_verifier.go:219

• When a file is requested with an empty checksum (existence-only), the current logic will treat any matching tar entry (including directories/symlinks) as satisfying the requirement. Given the API is named ImageFile and the comments say the file's existence is checked, it should consistently reject non-regular files regardless of whether a checksum is provided.

		if expected != "" {
			if hdr.Typeflag != tar.TypeReg {
				return fmt.Errorf("file %q found in image but is not a regular file", base)
			}

			h := sha256.New()
			if _, err := io.Copy(h, tr); err != nil {
				return fmt.Errorf("failed to hash %q from image: %w", base, err)
			}

			actual := fmt.Sprintf("sha256:%x", h.Sum(nil))
			if actual != expected {
				return fmt.Errorf("checksum mismatch for %q: expected %s, got %s", base, expected, actual)
			}

			klog.V(2).Infof("Verified checksum for %q: %s", base, actual)
		} else {
			klog.V(2).Infof("Verified existence for %q without checksum", base)
		}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pfl]

Would path.Clean() be a more efficient solution here?

[tkatila]

What do you mean? It's using path.Clean().