Images within Image Archives should be found when using `zarf dev find-images`

[AustinAbro321]

Is your feature request related to a problem? Please describe.

Currently images in Image Archives do not show up in zarf dev find-images. Assuming there is a valid path to a tar file, Zarf should show all of the images in it in the output of zarf dev find-images.

Describe the behavior you'd like

• Given a component with an image archive. The image archive was made with the image kiwix-data:local

  - name: kiwix-serve
    imageArchives:
      - path: kiwix-data.tar

• When I run zarf dev find-images
• Then I receive an output that looks like this:

components:
 - name: kiwix-serve
    imageArchives:
      - path: kiwix-data.tar
        images:
          - kiwix-data:local

Additional context

The implementor of this will run into a problem where imageArchives.images is required by the schema. In order to achieve this we may have to arbitrarily set the images field if it empty before loading the definition in packager.FindImages()

[chaospuppy]

In my reading of how things currently work, we will need to update PackageDefinition to set images: [] before we get to validation. Is this what you had in mind, or is there somewhere earlier that I can set imageArchives.images if empty?

[AustinAbro321]

@chaospuppy find-images is really the only scenario where we'd want this field to be empty (because a user might still be figuring out using this command). We'd want to localize setting the field in packager.FindImages(). In that function when imageArchives.Images is empty then we could add a single entry in the list called placeholder to allow it to pass the schema check.

[chaospuppy]

@AustinAbro321 Would that then necessitate loading the zarf.yaml twice? Once to check for and set-if-missing imageArchives.images in FindImages, and again in load.PackageDefinition?

[AustinAbro321]

Ah yeah, I forgot that loading and validating happens at the same time. While we could make a temporary zarf.yaml and change that, probably the best way to go about this would be to introduce a new public function load.PackageDefinitionWithoutValidate() and then also make the currently private function load.validate() public. Then update the struct between those calls.

[chaospuppy]

Perfect, that makes sense to me. Thanks!

[chaospuppy]

For some background, why is images required for imageArchives in the schema? Would it not also make sense for users to want all images in an archive to be added, and to have that be the default behavior if no images are specified?

[AustinAbro321]

That was actually the initial design, but we decided to require explicitly defining images. This does make the UX less convenient, but improves security posture somewhat. It makes it more likely for the creator to know what's going into their environment, in the event someone tried to sneak in a malicious image in a compromised docker save pipeline.

Also makes traceability easier. Someone evaluating the images in a zarf.yaml could see all the images in a package immediately, rather than requiring the package to be built to see the images field populated.