{"action":"closed","issue":{"url":"https://api.github.com/repos/appc/spec/issues/542","labels_url":"https://api.github.com/repos/appc/spec/issues/542/labels{/name}","comments_url":"https://api.github.com/repos/appc/spec/issues/542/comments","events_url":"https://api.github.com/repos/appc/spec/issues/542/events","html_url":"https://github.com/appc/spec/issues/542","id":119052705,"number":542,"title":"\"actool patch-manifest --capability\" broken in v0.7.2","user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-26T14:13:47Z","updated_at":"2015-11-26T18:45:50Z","closed_at":"2015-11-26T18:45:50Z","body":"`actool patch-manifest` breaks the ACI in version v0.7.2. To reproduce:\r\n\r\n```\r\n$ wget https://github.com/coreos/etcd/releases/download/v2.2.2/etcd-v2.2.2-linux-amd64.aci\r\n$ actool validate ./etcd-v2.2.2-linux-amd64.aci \r\n$ echo $?\r\n0\r\n$ actool patch-manifest --replace --capability=CAP_NET_ADMIN ./etcd-v2.2.2-linux-amd64.aci\r\n$ actool validate ./etcd-v2.2.2-linux-amd64.aci \r\n./etcd-v2.2.2-linux-amd64.aci: error validating: image manifest validation failed: set must be non-empty\r\n```\r\n\r\nIt generates the following broken manifest:\r\n```\r\n      \"isolators\" : [\r\n         {\r\n            \"value\" : {},\r\n            \"name\" : \"os/linux/capabilities-retain-set\"\r\n         }\r\n      ],\r\n```\r\n\r\nIt should have generated the following:\r\n```\r\n      \"isolators\" : [\r\n         {\r\n            \"value\" : {\r\n               \"set\" : [\r\n                  \"CAP_NET_ADMIN\"\r\n               ]\r\n            },\r\n            \"name\" : \"os/linux/capabilities-retain-set\"\r\n         }\r\n      ],\r\n```\r\nBut the set is empty instead of containing `CAP_NET_ADMIN`.\r\n\r\nI suspect it is a regression from https://github.com/appc/spec/pull/517. When adding debugging code in [AsIsolator](https://github.com/appc/spec/blob/master/schema/types/isolator_linux_specific.go#L98), I see that `json.Marshal()` returns the empty set `{}` instead of the correct set.\r\n\r\nThis breaks rkt test `TestPodManifest` because it relies on `actool patch-manifest`: https://github.com/coreos/rkt/pull/1800\r\n\r\n"}}