generate: replace duplicate env entries

If a given environment variable has already been set, replace the
variable rather than appending it to the environment list. This avoids
issues with POSIX (which doesn't define what to do with duplicate
values).

This required a change in the signature of AddProcessEnv, because doing
the check by splitting around "=" is just not safe (and brings up
questions about variables without "=" in their names that I'd rather
punt on). The check if two variables is the same is if they have the
same NAME= prefix.

Signed-off-by: Aleksa Sarai <asarai@suse.de>

Author: cyphar

cmd/oci-runtime-tool/generate.go

@@ -208,7 +208,11 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
 		}
 
 		for _, env := range envs {
-			g.AddProcessEnv(env)
+			name, value, err := parseEnv(env)
+			if err != nil {
+				return err
+			}
+			g.AddProcessEnv(name, value)
 		}
 	}
 
@@ -740,6 +744,22 @@ func readKVStrings(files []string, override []string) ([]string, error) {
 	return envVariables, nil
 }
 
+// parseEnv splits a given environment variable (of the form name=value) into
+// (name, value). An error is returned if there is no "=" in the line or if the
+// name is empty.
+func parseEnv(env string) (string, string, error) {
+	parts := strings.SplitN(env, "=", 2)
+	if len(parts) != 2 {
+		return "", "", fmt.Errorf("environment variable must contain '=': %s", env)
+	}
+
+	name, value := parts[0], parts[1]
+	if name == "" {
+		return "", "", fmt.Errorf("environment variable must have non-empty name: %s", env)
+	}
+	return name, value, nil
+}
+
 // parseEnvFile reads a file with environment variables enumerated by lines
 //
 // ``Environment variable names used by the utilities in the Shell and

generate/generate.go

@@ -331,9 +331,18 @@ func (g *Generator) ClearProcessEnv() {
 	g.spec.Process.Env = []string{}
 }
 
-// AddProcessEnv adds env into g.spec.Process.Env.
-func (g *Generator) AddProcessEnv(env string) {
+// AddProcessEnv adds name=value into g.spec.Process.Env, or replaces an
+// existing entry with the given name.
+func (g *Generator) AddProcessEnv(name, value string) {
 	g.initSpec()
+
+	env := fmt.Sprintf("%s=%s", name, value)
+	for idx := range g.spec.Process.Env {
+		if strings.HasPrefix(g.spec.Process.Env[idx], name+"=") {
+			g.spec.Process.Env[idx] = env
+			return
+		}
+	}
 	g.spec.Process.Env = append(g.spec.Process.Env, env)
 }