From 07d1ce532e3b80d356ab02c1fc51f8cd50dd3eaf Mon Sep 17 00:00:00 2001
From: Charlie Sharpsteen <charlie@overlookinfratech.com>
Date: Sat, 9 May 2026 09:18:54 -0500
Subject: [PATCH] Pass full options hashes from component.add_source

Prior to this commit, the `add_source` method of the would accept any
number of keyword arguments, but silently ignored any that were not
`ref` or `sum`. The Git and Http sources accept many options, critically
`sum_type` which allows checksums other than MD5 to be used.

This commit updates the logic in `lib/vanagon/component.rb` to ensure
all options are passed to the source constructor.

Signed-off-by: Charlie Sharpsteen <charlie@overlookinfratech.com>
---
 lib/vanagon/component.rb           | 10 ++++++----
 lib/vanagon/component/dsl.rb       |  6 +++---
 spec/lib/vanagon/component_spec.rb | 22 ++++++++++++++++++++++
 3 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/lib/vanagon/component.rb b/lib/vanagon/component.rb
index e918f2c4..4143e760 100644
--- a/lib/vanagon/component.rb
+++ b/lib/vanagon/component.rb
@@ -360,12 +360,14 @@ def get_dependency_hash
     # @param workdir [String] working directory to put the source into
     def get_sources(workdir) # rubocop:disable Metrics/AbcSize
       sources.each do |source|
-        src = Vanagon::Component::Source.source(
-          source.url, workdir: workdir, ref: source.ref, sum: source.sum
-        )
+        options = source.to_h # Copy OpenStruct to Hash.
+        url     = options.delete(:url)
+        erb     = options.delete(:erb)
+        options[:workdir] = workdir
+        src = Vanagon::Component::Source.source(url, **options)
         src.fetch
         src.verify
-        if source.erb
+        if erb
           erb_file(src.file, File.join(File.dirname(src.file), File.basename(src.file, ".erb")), true)
         end
         # set src.file to only be populated with the basename instead of entire file path
diff --git a/lib/vanagon/component/dsl.rb b/lib/vanagon/component/dsl.rb
index 1ec2904d..a87611ed 100644
--- a/lib/vanagon/component/dsl.rb
+++ b/lib/vanagon/component/dsl.rb
@@ -406,9 +406,9 @@ def dirname(path)
       # This will add a source to the project and put it in the workdir alongside the other sources
       #
       # @param uri [String] uri of the source
-      # @param [Hash] options optional keyword arguments used to instatiate a new source
-      #   @option opts [String] :sum
-      #   @option opts [String] :ref
+      # @param [Hash] options optional keyword arguments used to instatiate a new source.
+      #               See {Vanagon::Component::Source::Local}, {Vanagon::Component::Source::Git},
+      #               and {Vanagon::Component::Source::Http} for details.
       #   @option opts [Bool] :erb set to 'true' to specify that the source file should be
       #     translated by erb
       def add_source(uri, options = {})
diff --git a/spec/lib/vanagon/component_spec.rb b/spec/lib/vanagon/component_spec.rb
index 659a4cd7..dfac4abc 100644
--- a/spec/lib/vanagon/component_spec.rb
+++ b/spec/lib/vanagon/component_spec.rb
@@ -217,6 +217,28 @@
       expect(subject).to_not receive(:erb_file)
       subject.get_sources(@workdir)
     end
+
+    it "Allows checksum types to be specified" do
+      plat = Vanagon::Platform::DSL.new('el-10-x86_64')
+      plat.instance_eval("platform 'el-10-x86_64' do |plat| end")
+      @platform = plat._platform
+
+      comp = Vanagon::Component::DSL.new('build-dir-test', {}, @platform)
+      comp.add_source  @fake_file,
+                       # Checksum of spec/fixtures/files/fake_file.txt
+                       sum: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+                       sum_type: 'sha256'
+      subject = comp._component
+
+      # Not the best test as local files don't execute verification logic.
+      # However, properly mocking the download logic of a HTTP source would
+      # require a re-write of the class.
+      expect(Vanagon::Component::Source).to receive(:source)
+        .with(anything, hash_including(sum_type: 'sha256'))
+        .and_call_original
+
+      subject.get_sources(@workdir)
+    end
   end
 
   describe "#get_patches" do