Validate the multi-repo map file before initializing any client

[rdimitrov]

Follow-up to #750, addressing the review findings on that PR.

#750 correctly fixed the out-of-bounds access on repoURL[0] when a repository is declared with no URL. This follow-up relocates and extends that check.

What changes

Validation moves into a single validateRepoMap helper that runs before initTUFClients.

New() already had a pre-flight loop calling validateRepoName; #750 put the URL check in a second place, inside the initialization loop. Consolidating them means:

• New becomes atomic. Map iteration order is randomized, so with the check inside initTUFClients an arbitrary number of repositories get EnsurePathsExist() and updater.New() run before the error surfaces — leaving cache directories on disk for a call that returns nil, err and gives the caller no handle to clean up.
• Errors become deterministic. Repository names are now checked in sorted order, so a map file with more than one defect reports the same error on every run.

This ordering problem is not hypothetical. Before the move, a map file whose mapping was malformed failed with:

mkdir : no such file or directory

because initialization began before validation finished, masking the real defect.

Bugs fixed beyond #750

A mapping referencing an undeclared repository panicked. Mapping.repositories was never cross-checked against the top-level repositories object. An unknown name leaves no entry in TUFClients, and GetTargetInfo indexes it without an ok check, unlike DownloadTarget which does guard this. Confirmed against the pre-fix code:

PANIC CONFIRMED: runtime error: invalid memory address or nil pointer dereference

It needs both a matching path pattern and a typo'd repository name in the same mapping to trigger, which is likely why it went unnoticed.

"mapping": [null] panicked. It unmarshals into a []*Mapping holding a nil element, dereferenced while walking mappings.

A MultiRepoConfig with no RepoMap panicked. The struct has exported fields, so callers can build one directly without going through NewConfig.

Other

• Empty-URL rejection now wraps an exported ErrMissingRepoURL sentinel, matching the existing ErrInvalidRepoName convention so callers can use errors.Is. Unknown mapping repositories get ErrUnknownMappingRepo.
• Fixes the trailing-tab whitespace on the two blank lines Ensure repository URL exists before initialization #750 added (the repo's .golangci.yml enables no formatters, so CI does not currently catch gofmt drift).

Compatibility

A map file with a mapping pointing at an undeclared repository is now rejected by New() rather than accepted and panicking later on a matching target lookup. That is a behaviour change, but it converts a latent runtime panic into an upfront configuration error. The shipped examples/multirepo/repository/targets/map.json was verified to pass validation unchanged.

Tests

#750 shipped without tests; this adds regression coverage for every case above — empty/null/empty-string URL lists, unknown mapping repository, null mapping entry, and missing repository map. Each was written first and watched fail before the fix.

$ go test ./...        # all packages ok
$ go vet ./...         # clean
$ gofmt -l ./metadata/ # clean
$ golangci-lint run ./metadata/multirepo/...
0 issues.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR consolidates multi-repo map validation into a single validateRepoMap helper that runs before any repository initialization, preventing partial initialization side effects and converting several panic cases into upfront configuration errors.

Changes:

• Added validateRepoMap to validate repository names, repository URLs, and mapping-referenced repositories before calling initTUFClients.
• Introduced exported sentinel errors (ErrMissingRepoURL, ErrUnknownMappingRepo) to support errors.Is checks by callers.
• Added regression tests covering missing/empty URLs, unknown mapping repositories, null mapping entries, and missing repo map config.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
metadata/multirepo/multirepo.go	Adds centralized pre-init map validation and new sentinel errors; removes URL validation from initialization loop.
metadata/multirepo/multirepo_test.go	Adds tests to ensure invalid maps/configs fail fast with the expected sentinel errors or non-nil errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kommendorkapten]

🚀