Mutated manifest file prevents bundle loading

[CristianJena]

Short description

I'm working on a project that will use OPA (v0.35.0) for controlling access upon certain resources. For this we have policies, data and we sign our bundle (this is a strong requirement). Policies and data are coming from another source to our service that is in change with building the bundle. We write the policies and data to a folder and use OPA cli, like this:

opa build -b . --signing-key=opa-bundle-key.pem

We needed some information related to bundle itself (revision) because we build the bundle based on certain events (new policy coming in). This information was added in the .manifest file, file that is created in the same folder as policies and data before using the build command. In the same file, under metadata tag we have some additional informations useful for us.

The initial .manifest file looks like this:

{
    "metadata":
    {
        "buildContainerName": "service-container-id",
        "buildJobId": "job-id",
        "buildJobVersion": "my-version"
    }
}

and another version

{
    "metadata":
    {
        "buildContainerName": "service-container-id",
        "buildJobId": "job-id",
        "buildJobVersion": "my-version"
    },
    "revision": "1642085539338",
    "roots":[""]
}

but after bundle comand, the .manifest file is changed like this (metadata property is moved at the end).

{
    "revision": "1642085539338",
    "roots":[""],
    "metadata":
    {
        "buildContainerName":"service-container-id",
        "buildJobId":"job-id",
        "buildJobVersion":"my-version"
    }
}

The problem occurs when when OPA wants to load the bundle, we get a signature mismatch error for .manifest file.
We know that the properties of structured data (as JSON) have to be sorted alphabetically in order to have a corect hash calculated (as OPA will do the same when it verifies the bundle) but in this case the file is mutated after the signature is calculated I presume.

To bypass this "behaviour" we used --exclude-files-verifyflag for the .manifest file but this is more like an unexpected workaround.

Steps To Reproduce

1. Create a .manifest with a metadata property (example above) .
2. Create a bundle that contains policy, data etc. and sign the bundle.
3. Load the bundle with OPA server.

Expected behavior

OPA should load a signed bundle created with OPA cli and a provided .manifest file.

Additional context

[anderseknert]

Thanks for filing this @CristianJena! Looks like a bug indeed.