Merge ~jslarraz/review-tools:add-component-support into review-tools:master

[Jorge Sancho Larraz]

components: add basic support for components

Add initial support for components.

Example commands:

# Run tests to validate the component.json schema
python3 -m pytest reviewtools/tests/test_schema_component.py

# Run tests to validate ReviewComponent checks
python3 -m pytest reviewtools/tests/test_sr_component.py

# Run a basic review and print the report
bin/component-review tests/test.comp tests/test.snap

[Alex Murray (alexmurray)]

Thanks @jslarraz - some initial comments - will do a more thorough review next week but so far this looks really good - just some minor things.

lpci is failing:

  :: ModuleNotFoundError: No module named 'jsonschema'

  - I think you can probably just add python3-jsonschema to the list of packages in the .launchpad.yaml to fix this

also see inline comments.

review: Needs Fixing

[Alex Murray (alexmurray)]

I took a more thorough look at this MR this morning - no additional comments at this time other than those previous - thanks @jslarraz.

9973adb... by Jorge Sancho Larraz on 2024-03-25

Add jsonschema to .launchpad.yaml and fix typos

[Jorge Sancho Larraz (jslarraz)]

New version released addressing your commentaries.

Regarding the idea of defining hooks inline in the main schema rather than using a separate file, my initial intention was to reuse the hook definition in the snap.yaml schema, so we only need to update it on one place in the future (if/when new attributes are defined for hooks). Also the validation is seamless as jsonschema follows the reference automatically.
That said, I would also be happy to include it in the main component schema if you think it would be better

5ca14a4... by Jorge Sancho Larraz on 2024-03-25

Remove test.snap and test.comp from tests/ as they trigger unintended functional tests. Updating test_cr_component.py accordingly

9172d08... by Jorge Sancho Larraz on 2024-03-25

Fix style for pylint and flake8

cc8ad0e... by Jorge Sancho Larraz on 2024-03-25

Fix check names

99a807c... by Jorge Sancho Larraz on 2024-04-05

Update hooks to support command_chain, environment and passthrough parameters

5d76be6... by Jorge Sancho Larraz on 2024-04-05

Fix format

a34173e... by Jorge Sancho Larraz on 2024-04-29

- Add `components` to snap optional parameters
- Change component layout check from `warn` to `info` as it is pending implementation
- Add `check_squashfs_resquash` test as a copy pasta from sr_security until `containers` are available

ae63f1b... by Jorge Sancho Larraz on 2024-04-29

- component-review output more similar to snap-review

09fd0b4... by Jorge Sancho Larraz on 2024-04-29

- simple check for file type

Unmerged commits

09fd0b4... by Jorge Sancho Larraz on 2024-04-29

- simple check for file type

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

ae63f1b... by Jorge Sancho Larraz on 2024-04-29

- component-review output more similar to snap-review

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

a34173e... by Jorge Sancho Larraz on 2024-04-29

- Add `components` to snap optional parameters
- Change component layout check from `warn` to `info` as it is pending implementation
- Add `check_squashfs_resquash` test as a copy pasta from sr_security until `containers` are available

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

5d76be6... by Jorge Sancho Larraz on 2024-04-05

Fix format

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

99a807c... by Jorge Sancho Larraz on 2024-04-05

Update hooks to support command_chain, environment and passthrough parameters

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

cc8ad0e... by Jorge Sancho Larraz on 2024-03-25

Fix check names

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

9172d08... by Jorge Sancho Larraz on 2024-03-25

Fix style for pylint and flake8

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

5ca14a4... by Jorge Sancho Larraz on 2024-03-25

Remove test.snap and test.comp from tests/ as they trigger unintended functional tests. Updating test_cr_component.py accordingly

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

9973adb... by Jorge Sancho Larraz on 2024-03-25

Add jsonschema to .launchpad.yaml and fix typos

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

d5aef76... by Jorge Sancho Larraz on 2024-03-14

components: add basic support for components

	test:0 (build)
	coverage:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

diff --git a/.launchpad.yaml b/.launchpad.yaml
index e2699a2..18fa969 100644
--- a/.launchpad.yaml
+++ b/.launchpad.yaml
@@ -16,6 +16,7 @@ jobs:
      - jq
      - pylint
      - python3-coverage
+     - python3-jsonschema
      - python3-magic
      - python3-requests
      - python3-ruamel.yaml
diff --git a/bin/component-review b/bin/component-review
 new file mode 100755
index 0000000..48a1504
--- /dev/null
+++ b/bin/component-review
@@ -0,0 +1,120 @@
+#!/usr/bin/python3
+# Author: Jorge Sancho Larraz <[e-mail]>
+# Copyright (C) 2024 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import argparse
+
+import sys
+import textwrap
+from reviewtools.cr_component import ComponentReview
+import json
+
+
+def print_findings(results, description):
+    """
+    Print a summary of the issues found.
+    """
+
+    if not description or not results:
+        return ""
+    print(description)
+    print("".center(len(description), "-"))
+    for key in sorted(results.keys()):
+        print(" - %s" % key)
+        print("\t%s" % results[key]["text"])
+        if "link" in results[key]:
+            print("\t%s" % results[key]["link"])
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="component-review",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        description="Check a component package for errors",
+        epilog=textwrap.dedent(
+            """\
+            RETURN CODES
+              0     found no errors or warnings
+              1     checks not run due to fatal error
+              2     found only errors or errors and warnings
+              3     found only warnings
+        """
+        ),
+    )
+    parser.add_argument("comp_fn", type=str, help="component file to be inspected")
+    parser.add_argument("snap_fn", type=str, help="snap file the component belongs to")
+    parser.add_argument(
+        "-v", "--verbose", help="increase output verbosity", action="store_true"
+    )
+    parser.add_argument("--json", help="print json output", action="store_true")
+    parser.add_argument(
+        "--sdk",
+        help="use output format suitable for the Ubuntu SDK",
+        action="store_true",
+    )
+    parser.add_argument(
+        "overrides",
+        type=str,
+        nargs="?",
+        help="overrides to apply (eg, framework, security " "policies, etc)",
+        default=None,
+    )
+
+    args = parser.parse_args()
+
+    rc = 0
+    componentReview = ComponentReview(args.comp_fn, args.snap_fn)
+    try:
+        componentReview.do_checks()
+        # componentReview.do_report()
+    except Exception:
+        rc = 1
+
+    if args.json:
+        print(
+            json.dumps(
+                componentReview.review_report, sort_keys=True, indent=2, separators=(",", ": ")
+            )
+        )
+    elif args.sdk:
+        print("= %s =" % "snap.v2_component")
+        print(
+            json.dumps(componentReview.review_report, sort_keys=True, indent=2, separators=(",", ": "))
+        )
+    else:
+        print_findings(componentReview.review_report["error"], "Errors")
+        print_findings(componentReview.review_report["warn"], "Warnings")
+        if args.verbose:
+            print_findings(componentReview.review_report["info"], "Info")
+        if rc == 1:
+            print("%s: RUNTIME ERROR" % args.comp_fn)
+        elif componentReview.review_report["warn"] or componentReview.review_report["error"]:
+            print("%s: FAIL" % args.comp_fn)
+        else:
+            print("%s: pass" % args.comp_fn)
+
+    if componentReview.review_report["error"]:
+        rc = 2
+    elif componentReview.review_report["warn"]:
+        rc = 3
+
+    sys.exit(rc)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except KeyboardInterrupt:
+        print("Aborted.")
+        sys.exit(1)
diff --git a/check-names.list b/check-names.list
index deb608f..251ccd1 100644
--- a/check-names.list
+++ b/check-names.list
@@ -1,3 +1,7 @@
+component-v2:component_hooks|
+component-v2:component_to_snap_relation|
+component-v2:snap_to_component_relation|
+component-v2:validate_component_schema|
 declaration-snap-v2:app_slot_known|
 declaration-snap-v2:interface-reference|
 declaration-snap-v2:plugs_connection|
diff --git a/reviewtools/cr_component.py b/reviewtools/cr_component.py
 new file mode 100644
index 0000000..f76121e
--- /dev/null
+++ b/reviewtools/cr_component.py
@@ -0,0 +1,487 @@
+# Author: Jorge Sancho Larraz <[e-mail]>
+# Copyright (C) 2024 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import json
+import jsonschema
+import ruamel.yaml
+
+from reviewtools.common import Review, ReviewException, error, open_file_read, cleanup_unpack
+from reviewtools.sr_common import SnapReview
+from reviewtools.sr_lint import SnapReviewLint
+
+# Repack test
+import re
+import sys
+import shutil
+import copy
+from reviewtools.common import (
+    set_lang,
+    restore_lang,
+    cmd,
+    cmdIgnoreErrorStrings,
+    create_tempdir,
+    MKSQUASHFS_DEFAULT_COMPRESSION,
+    MKSQUASHFS_OPTS,
+    UNSQUASHFS_IGNORED_ERRORS,
+    unsquashfs_supports_ignore_errors,
+    StatLLN,
+    SNAP_MINIMUM_SIZE,
+)
+from reviewtools.overrides import (
+    sec_mode_overrides,
+    sec_resquashfs_overrides,
+)
+
+
+#
+# Utility classes
+#
+class ComponentReviewException(ReviewException):
+    """This class represents ComponentReview exceptions"""
+
+
+class ComponentReview(SnapReview):
+    """This class represents component reviews"""
+
+    def __init__(self, comp_fn, snap_fn, overrides=None):
+
+        # Run checks for snap.yaml
+        self.snapReviewLint = SnapReviewLint(snap_fn)
+        self.snapReviewLint.do_checks()
+        self.snap_yaml = self.snapReviewLint.snap_yaml
+        cleanup_unpack()
+
+        # Check 'fn' file exists and extract it
+        Review.__init__(self, comp_fn, "component-v2", overrides=overrides)
+
+        # initialize ruamel.yaml loader
+        yaml = ruamel.yaml.YAML(typ="safe")
+        yaml.allow_duplicate_keys = False
+
+        # Load meta/component.yaml
+        component_yaml = self._extract_component_yaml()
+        try:
+            self.component_yaml = yaml.load(component_yaml)
+        except ruamel.yaml.constructor.DuplicateKeyError as e:
+            raise ComponentReviewException(e.problem)
+        except Exception:  # pragma: nocover
+            error("Could not load component.yaml. Does it exists?")
+        component_yaml.close()
+
+        # Load schema
+        with open("reviewtools/schemas/component.json") as fd:
+            self.component_schema = json.loads(fd.read())
+
+    # def check_component_file_name(self, fn):
+    #     # Check component file name is valid. Update it if regex gets approved
+    #     # ^(?=.{2,40}\+.{2,40}\_.*$)^((?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*)\+((?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*)\_\d\.comp)$
+    #     aux = fn.split('.')
+    #     if len(aux) != 2:
+    #         error("Wrong component file name. It must be '<snap name>+<component name>_<component revision>.comp'.")
+    #     if aux[1] != "comp":
+    #         error("Wrong component file name. Component file extension must be '.comp'.")
+    #     aux = aux[0].split('_')
+    #     if len(aux) != 2:
+    #         error("Wrong component file name. It must be '<snap name>+<component name>_<component revision>.comp'.")
+    #     if not aux[1].isnumeric():
+    #         error("Wrong component file name. Revision must be numeric")
+    #     aux = aux[0].split('+')
+    #     if len(aux) != 2:
+    #         error("Wrong component file name. It must be '<snap name>+<component name>_<component revision>.comp'.")
+    #     if not self._verify_pkgname(aux[1]):
+    #         error("Wrong component file name. Component name must be in format ^(?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*$.")
+    #     if not self._verify_pkgname(aux[0]):
+    #         error("Wrong component file name. Snap name must be in format ^(?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*$.")
+
+    # Since coverage is looked at via the testsuite and the testsuite mocks
+    # this out, don't cover this
+    def _extract_component_yaml(self):  # pragma: nocover
+        """Extract and read the component.yaml"""
+        y = os.path.join(self.unpack_dir, "meta/component.yaml")
+        if not os.path.isfile(y):
+            error("Could not find component.yaml.")
+        return open_file_read(y)
+
+    def check_component_schema(self):
+        # Load component schema and validate
+        t = "info"
+        n = self._get_check_name("validate_component_schema")
+        s = "OK"
+        try:
+            jsonschema.validate(self.component_yaml, self.component_schema)
+        except Exception as e:
+            t = "error"
+            s = e.message
+        self._add_result(t, n, s)
+
+    def check_component_to_snap_relation(self):
+        t = "info"
+        n = self._get_check_name("component_to_snap_relation")
+        s = "OK"
+        if not self.component_yaml["component"].startswith(self.snap_yaml["name"] + '+'):
+            t = "error"
+            s = ("'component' field in 'component.yaml' does not start with <snap name>. However, "
+                 "its format must be '<snap name>+<component name>'.")
+        self._add_result(t, n, s)
+
+    def check_snap_to_component_relation(self):
+        t = "info"
+        n = self._get_check_name("snap_to_component_relation")
+        s = "OK"
+        if "components" not in self.snap_yaml or \
+                not self.component_yaml["component"].split("+")[1] in self.snap_yaml["components"]:
+            t = "error"
+            s = "Missing component '%s' in snap.yaml:components" % self.component_yaml["component"].split("+")[1]
+        self._add_result(t, n, s)
+
+    def check_hooks(self):
+        # Verify only allowed hooks exist
+        if os.path.isdir(self.unpack_dir + "/meta/hooks"):
+            for hook in os.listdir(self.unpack_dir + "/meta/hooks"):
+                if hook not in self.component_schema["properties"]["hooks"]["propertyNames"]["enum"] + [".", ".."]:
+                    t = "error"
+                    n = self._get_check_name("component_hooks")
+                    s = "Unexpected hook '%s' found in /meta/hooks directory" % hook
+                    self._add_result(t, n, s)
+
+    def check_component_layout(self):
+        t = "info"
+        n = self._get_check_name("component_layout")
+        s = "this check is not implemented yet"
+        self._add_result(t, n, s)
+
+    def check_file_types(self):
+        # todo: simple check for file type, improve it once containers are merged
+        errors = []
+        unsquashfs_lln_hdr, unsquashfs_lln_entries = self._unsquashfs_lln(self.pkg_filename)
+        for (line, item) in unsquashfs_lln_entries:
+            if item is None:
+                continue
+
+            fname = item[StatLLN.FILENAME]
+            ftype = item[StatLLN.FILETYPE]
+            if ftype not in ["d", "-", "l"]:
+                errors.append("file type '%s' not allowed (%s)" % (ftype, fname))
+                continue
+
+        t = "info"
+        n = self._get_check_name("squashfs_files")
+        s = "OK"
+        if len(errors) > 0:
+            t = "error"
+            s = "found errors in file output: %s" % ", ".join(errors)
+        self._add_result(t, n, s)
+
+    def _unsquashfs_stat(self, snap_pkg):
+        """Run unsquashfs -stat on a snap package"""
+        (origLANG, origLC_ALL) = set_lang("C.UTF-8", "C.UTF-8")
+        (rc, out) = cmd(["unsquashfs", "-stat", snap_pkg])
+        restore_lang(origLANG, origLC_ALL)
+        return rc, out
+
+    def check_squashfs_resquash(self):
+        """Check resquash of squashfs"""
+        fn = os.path.abspath(self.pkg_filename)
+
+        # Verify squashfs has no fragments. If it does, it will not resquash
+        # properly (LP: #1576763). This stat output for fragments has been
+        # stable for at least the last 7 years, so just parse it. If it changes
+        # we can consider examing the superblock directly.
+        (rc, out) = self._unsquashfs_stat(fn)
+        if rc != 0:
+            t = "error"
+            n = self._get_check_name("squashfs_stat")
+            s = "could not stat squashfs"
+            self._add_result(t, n, s)
+            return
+
+        comp = None
+        comp_pat = re.compile(r"^Compression [a-z0-9]+$")
+        for line in out.splitlines():
+            if comp_pat.search(line):
+                comp = line.split()[1]
+        if comp is None:
+            t = "error"
+            n = self._get_check_name("squashfs_compression")
+            s = "could not determine compression algorithm"
+            self._add_result(t, n, s)
+            return
+        elif comp not in self.supported_compression_algorithms:
+            t = "error"
+            n = self._get_check_name("squashfs_compression")
+            s = "unsupported compression algorithm '%s'" % comp
+            self._add_result(t, n, s)
+            return
+
+        if "\nNumber of fragments 0\n" not in out and (
+                "SNAP_ENFORCE_RESQUASHFS" not in os.environ
+                or (
+                    "SNAP_ENFORCE_RESQUASHFS" in os.environ
+                    and os.environ["SNAP_ENFORCE_RESQUASHFS"] != "0"
+                )
+        ):
+            link = "https://forum.snapcraft.io/t/automated-reviews-and-snapcraft-2-38/4982/17"
+            t = "error"
+            n = self._get_check_name("squashfs_fragments")
+            s = (
+                "The squashfs was built without '-no-fragments'. Please "
+                + "ensure the snap is created with either 'snapcraft pack "
+                + "<DIR>' (using snapcraft >= 2.38) or 'mksquashfs <dir> "
+                + "<snap> %s'" % " ".join(MKSQUASHFS_OPTS)
+                + ". If using electron-builder, "
+                "please upgrade to latest stable (>= 20.14.7). See %s "
+                "for details." % link
+            )
+
+            if self.snap_yaml["name"] in sec_resquashfs_overrides:
+                t = "info"
+                s = "OK (check not enforced for this snap): %s" % s
+
+            self._add_result(t, n, s)
+            return
+
+        # Verify squashfs supports the -fstime option, if not, warn (which
+        # blocks in store)
+        (rc, out) = cmd(["unsquashfs", "-fstime", fn])
+        if rc != 0:
+            t = "warn"
+            n = self._get_check_name("squashfs_supports_fstime")
+            s = "could not determine fstime of squashfs"
+            self._add_result(t, n, s)
+            return
+        fstime = out.strip()
+
+        if (
+                "SNAP_ENFORCE_RESQUASHFS" in os.environ
+                and os.environ["SNAP_ENFORCE_RESQUASHFS"] == "0"
+        ):
+            t = "info"
+            n = self._get_check_name("squashfs_repack_checksum")
+            s = "OK (check not enforced)"
+            self._add_result(t, n, s)
+            return
+
+        tmpdir = create_tempdir()  # this is autocleaned
+        tmp_unpack = os.path.join(tmpdir, "squashfs-root")
+        tmp_repack = os.path.join(tmpdir, "repack.snap")
+        fakeroot_env = os.path.join(tmpdir, "fakeroot.env")
+
+        # Don't use -all-root since the snap might have other users in it
+        # NOTE: adding -no-xattrs here causes resquashfs to fail (unsquashfs
+        # and mksquash use -xattrs by default. By specifying -no-xattrs to
+        # unsquashfs/mksquashfs, we enforce not supportinging them since the
+        # checksums will always be different because the original squash would
+        # have them but the repack would not). If we ever decide to support
+        # xattrs in snaps, would have to see why thre requash fails with
+        # -xattrs.
+        mksquashfs_ignore_opts = ["-all-root"]
+
+        curdir = os.getcwd()
+        os.chdir(tmpdir)
+        # ensure we don't alter the permissions from the unsquashfs
+        old_umask = os.umask(000)
+
+        fakeroot_cmd = []
+        if "SNAP_FAKEROOT_RESQUASHFS" in os.environ:
+            # We could use -l $SNAP/usr/lib/... --faked $SNAP/usr/bin/faked if
+            # os.environ['SNAP'] is set, but instead we let the snap packaging
+            # make fakeroot work correctly and keep this simple.
+            fakeroot_cmd = ["fakeroot", "--unknown-is-real"]
+
+            if shutil.which(fakeroot_cmd[0]) is None:  # pragma: nocover
+                t = "error"
+                n = self._get_check_name("has_fakeroot")
+                s = "Could not find 'fakeroot' command"
+                self._add_result(t, n, s)
+                return
+
+        try:
+            fakeroot_args = []
+            mksquash_opts = copy.copy(MKSQUASHFS_OPTS)
+            if comp != MKSQUASHFS_DEFAULT_COMPRESSION:
+                idx = mksquash_opts.index(MKSQUASHFS_DEFAULT_COMPRESSION)
+                mksquash_opts[idx] = comp
+
+            if "SNAP_FAKEROOT_RESQUASHFS" in os.environ:
+                # run unsquashfs under fakeroot, saving the session to be
+                # reused by mksquashfs and thus preserving
+                # uids/gids/devices/etc
+                fakeroot_args = ["-s", fakeroot_env]
+
+                mksquash_opts = []
+                for i in MKSQUASHFS_OPTS:
+                    if i not in mksquashfs_ignore_opts:
+                        mksquash_opts.append(i)
+
+            cmdline = (
+                fakeroot_cmd
+                + fakeroot_args
+                + ["unsquashfs", "-no-progress", "-d", tmp_unpack]
+            )
+            if unsquashfs_supports_ignore_errors():
+                cmdline.append("-ignore-errors")
+                cmdline.append("-quiet")
+            cmdline.append(fn)
+
+            (rc, out) = cmdIgnoreErrorStrings(cmdline, UNSQUASHFS_IGNORED_ERRORS)
+            if rc != 0:
+                raise ReviewException(
+                    "could not unsquash '%s': %s" % (os.path.basename(fn), out)
+                )
+
+            fakeroot_args = []
+            if "SNAP_FAKEROOT_RESQUASHFS" in os.environ:
+                fakeroot_args = ["-i", fakeroot_env]
+
+            cmdline = (
+                fakeroot_cmd
+                + fakeroot_args
+                + ["mksquashfs", tmp_unpack, tmp_repack, "-fstime", fstime]
+                + mksquash_opts
+            )
+
+            (rc, out) = cmd(cmdline)
+            if rc != 0:
+                raise ReviewException(
+                    "could not mksquashfs '%s': %s"
+                    % (os.path.relpath(tmp_unpack, tmpdir), out)
+                )
+        except ReviewException as e:
+            t = "error"
+            n = self._get_check_name("squashfs_resquash")
+            self._add_result(t, n, str(e))
+            return
+        finally:
+            os.umask(old_umask)
+            os.chdir(curdir)
+
+        # Now calculate the hashes
+        t = "info"
+        n = self._get_check_name("squashfs_repack_checksum")
+        s = "OK"
+        link = None
+
+        (rc, out) = cmd(["sha512sum", fn])
+        if rc != 0:
+            t = "error"
+            s = "could not determine checksum of '%s'" % os.path.basename(fn)
+            self._add_result(t, n, s)
+            return
+        orig_sum = out.split()[0]
+
+        # If repacked package is smaller then original one, that means it's
+        # truncated with the minimum size.
+        if os.stat(fn).st_size == SNAP_MINIMUM_SIZE and (
+                os.stat(tmp_repack).st_size < os.stat(fn).st_size):
+            with open(tmp_repack, 'ab') as f:
+                f.truncate(SNAP_MINIMUM_SIZE)
+
+        (rc, out) = cmd(["sha512sum", tmp_repack])
+        if rc != 0:
+            t = "error"
+            s = "could not determine checksum of '%s'" % os.path.relpath(
+                tmp_repack, tmpdir
+            )
+            self._add_result(t, n, s)
+            return
+        repack_sum = out.split()[0]
+
+        if orig_sum != repack_sum:
+            if "SNAP_DEBUG_RESQUASHFS" in os.environ:
+                print(self._debug_resquashfs(tmpdir, fn, tmp_repack), file=sys.stderr)
+
+                if os.environ["SNAP_DEBUG_RESQUASHFS"] == "2":  # pragma: nocover
+                    import subprocess
+
+                    print(
+                        "\nIn debug shell. tmpdir=%s, orig=%s, repack=%s"
+                        % (tmpdir, fn, tmp_repack)
+                    )
+                    subprocess.call(["bash"])
+
+            if "type" in self.snap_yaml and (
+                    self.snap_yaml["type"] == "base" or self.snap_yaml["type"] == "os"
+            ):
+                mksquash_opts = []
+                for i in MKSQUASHFS_OPTS:
+                    if i not in mksquashfs_ignore_opts:
+                        mksquash_opts.append(i)
+            else:
+                mksquash_opts = MKSQUASHFS_OPTS
+
+            link = "https://forum.snapcraft.io/t/automated-reviews-and-snapcraft-2-38/4982/17"
+            t = "error"
+            s = (
+                "checksums do not match. Please ensure the snap is "
+                + "created with either 'snapcraft pack <DIR>' (using "
+                + "snapcraft >= 2.38) or 'mksquashfs <dir> <snap> %s'"
+                % " ".join(mksquash_opts)
+                + " (using squashfs-tools >= 4.3). If using electron-builder, "
+                "please upgrade to latest stable (>= 20.14.7). See %s "
+                "for details." % link
+            )
+
+            pkgname = self.snap_yaml["name"]
+            if pkgname in sec_resquashfs_overrides:
+                t = "info"
+                s = "OK (check not enforced for this snap): %s" % s
+
+            # FIXME: fakeroot sporadically fails and saves the wrong
+            # uid/gid/mode into its save file, thus causing the mksquashfs to
+            # create the wrong file/perms/ownership. We want to not ignore this
+            # error when using fakeroot. We need fakeroot or something like it
+            # for unsquashfs to create devices, perms and ownership as
+            # non-root, but only base and os snaps are allowed to have devices
+            # and not use -all-root. Certain app snaps may also have
+            # sec_mode_overrides for setuid/setgid files. Therefore, when not
+            # using fakeroot, only enforce resquash for non-os/base snaps
+            # and other snaps without sec_mode_overrides that specify
+            # setuid/setgid. Eventually we'll fix fakeroot or do something else
+            # so we can use this for all snaps, with or without -all-root.
+            if "SNAP_FAKEROOT_RESQUASHFS" not in os.environ:
+                if self.snap_yaml["type"] in ["base", "os"]:
+                    t = "info"
+                    s = "OK (check not enforced for base and os snaps)"
+                    link = None
+                elif pkgname in sec_mode_overrides:
+                    has_sugid_override = False
+                    setugid_pat = re.compile(r"[sS]")
+                    for k in sec_mode_overrides[pkgname]:
+                        if isinstance(sec_mode_overrides[pkgname][k], list):
+                            for m in sec_mode_overrides[pkgname][k]:
+                                if setugid_pat.search(m):
+                                    has_sugid_override = True
+                                    break
+                            if has_sugid_override:
+                                break
+                        elif setugid_pat.search(sec_mode_overrides[pkgname][k]):
+                            has_sugid_override = True
+                            break
+                    if has_sugid_override:
+                        t = "info"
+                        s = (
+                            "OK (check not enforced for app snaps with "
+                            + "setuid/setgid overrides)"
+                        )
+                        link = None
+
+        self._add_result(t, n, s, link)
+
+
+if __name__ == "__main__":
+    # ComponentReview("tests/sample.comp", "tests/busybox-static-mvo_2.snap", None)
+    componentReview = ComponentReview("tests/wrong_arch.comp", "tests/busybox-static-mvo_2.snap", None)
+    print(componentReview.snap_yaml)
diff --git a/reviewtools/schemas/component.json b/reviewtools/schemas/component.json
 new file mode 100644
index 0000000..6822244
--- /dev/null
+++ b/reviewtools/schemas/component.json
@@ -0,0 +1,63 @@
+{
+  "type": "object",
+  "properties": {
+    "component": {
+      "type": "string",
+      "pattern": "^(?=.{2,40}\\+.{2,40}$)^((?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*)\\+((?:[a-z0-9]+-?)*[a-z](?:-?[a-z0-9])*)$"
+    },
+    "type": {
+      "type": "string",
+      "enum": ["kernel-modules", "test"]
+    },
+    "architectures": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["all", "amd64", "arm64", "armhf", "i386", "powerpc", "ppc64el", "riscv64", "s390x"],
+        "minLength": 1
+      },
+      "minContains": 1
+    },
+    "summary": {
+      "type": "string",
+      "maxLength": 128
+    },
+    "description": {
+      "type": "string",
+      "maxLength": 4096
+    },
+    "version": {
+      "type": "string",
+      "description": "Snap version according to https://forum.snapcraft.io/t/snapd-enforcing-snap-versions/3974",
+      "pattern": "^[a-zA-Z0-9](?:[a-zA-Z0-9:.+~-]{0,30}[a-zA-Z0-9+~])?$"
+    },
+    "hooks": {
+      "type": "object",
+      "propertyNames": {
+        "enum": ["install", "pre-refresh", "post-refresh", "remove"]
+      },
+      "additionalProperties": {
+        "$ref": "file:reviewtools/schemas/hook.json"
+      }
+    }
+  },
+  "additionalProperties": false,
+
+  "if": {
+    "properties": {
+      "type": {
+        "const": "kernel-modules"
+      }
+    },
+    "required": ["type"]
+  },
+  "then": {
+    "required": ["component", "type", "summary", "description", "architectures"]
+  },
+  "else": {
+    "required": ["component", "type", "summary", "description"]
+  }
+}
+
+
diff --git a/reviewtools/schemas/hook.json b/reviewtools/schemas/hook.json
 new file mode 100644
index 0000000..f2e21c8
--- /dev/null
+++ b/reviewtools/schemas/hook.json
@@ -0,0 +1,50 @@
+{
+  "type": "object",
+  "properties": {
+    "plugs": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": ["string", "object"],
+        "minLength": 1
+      },
+      "minItems": 1
+    },
+    "command_chain": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "minItems": 1
+    },
+    "environment": {
+      "$comment": "See https://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap08.html",
+      "type": "object",
+      "patternProperties": {
+        "^[a-zA-Z_][a-zA-Z0-9_]*$": {
+          "type": "string",
+          "pattern": "^[^\\0]*$",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": false,
+      "minProperties": 1
+    },
+    "passthrough": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "uniqueItems": true,
+        "items": {
+          "type": "string",
+          "minLength": 1
+        },
+        "minItems": 1
+      },
+      "minProperties": 1
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/reviewtools/sr_common.py b/reviewtools/sr_common.py
index 4d33459..dc445bf 100644
--- a/reviewtools/sr_common.py
+++ b/reviewtools/sr_common.py
@@ -68,6 +68,7 @@ class SnapReview(Review):
         "slots",
         "system-usernames",
         "links",
+        "components",
     ]
 
     snap_manifest_required = {"build-packages": []}
diff --git a/reviewtools/tests/test_cr_component.py b/reviewtools/tests/test_cr_component.py
 new file mode 100644
index 0000000..4cfdd7c
--- /dev/null
+++ b/reviewtools/tests/test_cr_component.py
@@ -0,0 +1,159 @@
+# Author: Jorge Sancho Larraz <[e-mail]>
+# Copyright (C) 2024 Canonical Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import tempfile
+import shutil
+import yaml
+from reviewtools.cr_component import ComponentReview
+from reviewtools.common import cleanup_unpack
+from reviewtools.sr_tests import TestSnapReview
+from subprocess import run
+
+
+class TestComponent(TestSnapReview):
+
+    def setUp(self):
+
+        # Ensure YAMLs are properly initialized on each test
+        self.snap_yaml = {
+            "name": "test-snap",
+            "version": "0.1",
+            "description": "Test description",
+            "summary": "Test summary",
+            "architectures": ["all"],
+            "apps": {
+                "bar": {
+                    "command": "bin/bar"
+                }
+            }
+        }
+
+        self.component_yaml = {
+            "component": "test-snap+test-component",
+            "type": "test",
+            "architectures": ["all"],
+            "summary": "Test summary",
+            "description": "Test description",
+            "version": "0.1",
+        }
+
+        self.tmp_dir = tempfile.mkdtemp()
+        self._create_snap(self.snap_yaml)
+        self._create_component(self.component_yaml)
+
+    def tearDown(self):
+        cleanup_unpack()
+        shutil.rmtree(self.tmp_dir)
+
+    def _create_snap(self, snap_yaml, hooks=[]):
+        if os.path.exists(os.path.join(self.tmp_dir, "snap")):
+            shutil.rmtree(os.path.join(self.tmp_dir, "snap"))
+        os.makedirs(os.path.join(self.tmp_dir, "snap/meta"))
+        with open(os.path.join(self.tmp_dir, "snap/meta/snap.yaml"), "w+") as fd:
+            fd.write(yaml.dump(snap_yaml))
+        os.makedirs(os.path.join(self.tmp_dir, "snap/meta/hooks"))
+        for hook in hooks:
+            with open(os.path.join(self.tmp_dir, "component/meta/hooks/", hook), "w+") as fd:
+                fd.write("#!/bin/bash\n")
+        if os.path.exists(os.path.join(self.tmp_dir, "test.snap")):
+            os.unlink(os.path.join(self.tmp_dir, "test.snap"))
+        run(["mksquashfs", os.path.join(self.tmp_dir, "snap"), os.path.join(self.tmp_dir, "test.snap")])
+
+    def _create_component(self, component_yaml, hooks=[]):
+        if os.path.exists(os.path.join(self.tmp_dir, "component")):
+            shutil.rmtree(os.path.join(self.tmp_dir, "component"))
+        os.makedirs(os.path.join(self.tmp_dir, "component/meta"))
+        with open(os.path.join(self.tmp_dir, "component/meta/component.yaml"), "w+") as fd:
+            fd.write(yaml.dump(component_yaml))
+        os.makedirs(os.path.join(self.tmp_dir, "component/meta/hooks"))
+        for hook in hooks:
+            with open(os.path.join(self.tmp_dir, "component/meta/hooks/", hook), "w+") as fd:
+                fd.write("#!/bin/bash\n")
+        if os.path.exists(os.path.join(self.tmp_dir, "test.comp")):
+            os.unlink(os.path.join(self.tmp_dir, "test.comp"))
+        run(["mksquashfs", os.path.join(self.tmp_dir, "component"), os.path.join(self.tmp_dir, "test.comp")])
+
+    def test_component_schema__happy(self):
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_component_schema()
+        r = c.review_report
+        expected_counts = {"info": 1, "warn": 0, "error": 0}
+        self.check_results(r, expected_counts)
+
+    def test_component_schema__invalid_title(self):
+        self.component_yaml["title"] = "a" * 41
+        self._create_component(self.snap_yaml)
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_component_schema()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 1}
+        self.check_results(r, expected_counts)
+
+    def test_component_to_snap_relation__happy(self):
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_component_to_snap_relation()
+        r = c.review_report
+        expected_counts = {"info": 1, "warn": 0, "error": 0}
+        self.check_results(r, expected_counts)
+
+    def test_component_to_snap_relation__invalid(self):
+        self.snap_yaml["name"] = "invalid-name"
+        self._create_snap(self.snap_yaml)
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_component_to_snap_relation()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 1}
+        self.check_results(r, expected_counts)
+
+    def test_snap_to_component_relation__happy(self):
+        self.snap_yaml["components"] = {}
+        self.snap_yaml["components"]["test-component"] = self.component_yaml
+        self._create_snap(self.snap_yaml)
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_snap_to_component_relation()
+        r = c.review_report
+        expected_counts = {"info": 1, "warn": 0, "error": 0}
+        self.check_results(r, expected_counts)
+
+    def test_snap_to_component_relation__missing(self):
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_snap_to_component_relation()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 1}
+        self.check_results(r, expected_counts)
+
+    def test_hooks__no_hook(self):
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_hooks()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 0}
+        self.check_results(r, expected_counts)
+
+    def test_hooks__good_hook(self):
+        self._create_component(self.component_yaml, hooks=["install"])
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_hooks()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 0}
+        self.check_results(r, expected_counts)
+
+    def test_hooks__invalid_hook(self):
+        self._create_component(self.component_yaml, hooks=["invalid_hook"])
+        c = ComponentReview(os.path.join(self.tmp_dir, "test.comp"), os.path.join(self.tmp_dir, "test.snap"))
+        c.check_hooks()
+        r = c.review_report
+        expected_counts = {"info": 0, "warn": 0, "error": 1}
+        self.check_results(r, expected_counts)
diff --git a/reviewtools/tests/test_schema_base.py b/reviewtools/tests/test_schema_base.py
 new file mode 100644
index 0000000..ed5b7a3
--- /dev/null
+++ b/reviewtools/tests/test_schema_base.py
@@ -0,0 +1,44 @@
+import json
+import jsonschema
+import copy
+import unittest
+
+
+class SafeDict(dict):
+    def __missing__(self, key):
+        return '{' + key + '}'
+
+
+class TestSchemaBase(unittest.TestCase):
+
+    yaml = {}
+    schema_file = "reviewtools/schemas/****.json"
+
+    def setUp(self):
+
+        with open(self.schema_file) as fd:
+            self.schema = json.loads(fd.read())
+
+    def _validate(self, yaml, schema):
+        try:
+            jsonschema.validate(yaml, schema)
+            return None
+        except jsonschema.ValidationError as e:
+            return e.message
+
+    def _test_base(self):
+        error = self._validate(self.yaml, self.schema)
+        self.assertEqual(None, error)
+
+    def _test_value(self, key, value, expected_error):
+        yaml = copy.deepcopy(self.yaml)
+        if value is None:
+            if key in yaml:
+                del yaml[key]
+        else:
+            yaml[key] = value
+        error = self._validate(yaml, self.schema)
+        if expected_error is None:
+            self.assertIsNone(error)
+        else:
+            self.assertIn(expected_error, error)
diff --git a/reviewtools/tests/test_schema_component.py b/reviewtools/tests/test_schema_component.py
 new file mode 100644
index 0000000..ee2280f
--- /dev/null
+++ b/reviewtools/tests/test_schema_component.py
@@ -0,0 +1,145 @@
+
+from reviewtools.tests.test_schema_base import TestSchemaBase, SafeDict
+import copy
+
+
+class TestSchemaComponent(TestSchemaBase):
+
+    required_properties = ["component", "type", "summary", "description"]
+    optional_properties = ["architectures", "version", "hooks"]
+
+    schema_file = "reviewtools/schemas/component.json"
+    yaml = {
+        "component": "snap+component",
+        "type": "test",
+        "architectures": ["amd64", "arm64"],
+        "summary": "The super cat generator",
+        "description": "A more in-depth look at what your snap does and who may find it most useful.",
+        "version": "2.01",
+        "hooks": {
+            "install": {
+                "plugs": ["test_plug"]
+            },
+            "remove": {
+                "plugs": ["test_plug"]
+            }
+        }
+    }
+
+    def test_base(self):
+        self._test_base()
+
+    def test_component(self):
+        for value, error in [
+            ("test-snap+test-component", None),
+            ("a", "'{value}' does not match "),
+            ("a" * 41, "'{value}' does not match "),
+            ("-aaa", "'{value}' does not match "),
+            ("aaa-", "'{value}' does not match "),
+            ("000", "'{value}' does not match "),
+            ("aa--aa", "'{value}' does not match "),
+            ("aa%a", "'{value}' does not match "),
+            (2, "{value} is not of type 'string'"),
+            ([], "{value} is not of type 'string'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("component", value, error)
+
+    def test_type(self):
+        for value, error in [
+            ("kernel-modules", None),
+            ("invalid_type", "'{value}' is not one of "),
+            (2, "{value} is not of type 'string'"),
+            ([], "{value} is not of type 'string'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("type", value, error)
+
+    def test_architectures(self):
+        for value, error in [
+            (["amd64"], None),
+            (["invalid_architecture"], "'{value}' is not one of "),
+            ([2], "{value} is not of type 'string'"),
+            ([[]], "{value} is not of type 'string'"),
+            (2, "{value} is not of type 'array'"),
+            # ([], "{value} is not of type 'array'")  # Should we allow empty lists?
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value[0] if isinstance(value, list) and len(value) == 1 else value)) if error else None
+                self._test_value("architectures", value, error)
+
+    def test_summary(self):
+        for value, error in [
+            ("My good summary", None),
+            ("a" * 129, "'{value}' is too long"),
+            (2, "{value} is not of type 'string'"),
+            ([], "{value} is not of type 'string'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("summary", value, error)
+
+    def test_description(self):
+        for value, error in [
+            ("My good description", None),
+            ("a" * 4097, "'{value}' is too long"),
+            (2, "{value} is not of type 'string'"),
+            ([], "{value} is not of type 'string'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("description", value, error)
+
+    def test_version(self):
+        for value, error in [
+            ("2.0", None),
+            ("~2.90", "'{value}' does not match "),
+            (2, "{value} is not of type 'string'"),
+            ([], "{value} is not of type 'string'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("version", value, error)
+
+    def test_hook(self):
+        for value, error in [
+            ({"install": {"plugs": ["test_plug"]}}, None),
+            ({"invalid-hook": {"plugs": ["test_plug"]}}, "'invalid-hook' is not one of "),
+            ({"install": {"invalid-attribute": ["test_plug"]}}, "Additional properties are not allowed ('invalid-attribute' was unexpected)"),
+            (2, "{value} is not of type 'object'"),
+            ([], "{value} is not of type 'object'")
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("hooks", value, error)
+
+    def test_required_properties(self):
+        for property in self.required_properties:
+            with self.subTest(property=property):
+                yaml = copy.deepcopy(self.yaml)
+                del yaml[property]
+                error = self._validate(yaml, self.schema)
+                self.assertEqual("'%s' is a required property" % property, error)
+
+    def test_optional_properties(self):
+        for property in self.optional_properties:
+            with self.subTest(property=property):
+                yaml = copy.deepcopy(self.yaml)
+                del yaml[property]
+                error = self._validate(yaml, self.schema)
+                self.assertEqual(None, error)
+
+    def test_unsupported_properties(self):
+        yaml = copy.deepcopy(self.yaml)
+        yaml["wrong_property"] = "wrong_property"
+        error = self._validate(yaml, self.schema)
+        self.assertEqual("Additional properties are not allowed ('wrong_property' was unexpected)", error)
+
+    def test_missing_architectures_on_kernel_modules(self):
+        yaml = copy.deepcopy(self.yaml)
+        yaml["type"] = "kernel-modules"
+        del yaml["architectures"]
+        error = self._validate(yaml, self.schema)
+        self.assertEqual("'architectures' is a required property", error)
diff --git a/reviewtools/tests/test_schema_hook.py b/reviewtools/tests/test_schema_hook.py
 new file mode 100644
index 0000000..c98b2ad
--- /dev/null
+++ b/reviewtools/tests/test_schema_hook.py
@@ -0,0 +1,71 @@
+from reviewtools.tests.test_schema_base import TestSchemaBase, SafeDict
+
+
+class TestSchemaHook(TestSchemaBase):
+
+    schema_file = "reviewtools/schemas/hook.json"
+    schema = {}
+    yaml = {}
+
+    def test_base(self):
+        self._test_base()
+
+    # TDOO: Tests plugs better when interfaces schema will be implemented
+    def test_plugs(self):
+        for value, error in [
+            (["foo"], None),
+            ([{}], None),
+            ([], "{value} is too short"),
+            (2, "{value} is not of type 'array'"),
+            ([2], "{value} is not of type 'string', 'object'"),
+            (None, None),
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value[0] if isinstance(value, list) and len(value) == 1 else value)) if error else None
+                self._test_value("plugs", value, error)
+
+    def test_command_chain(self):
+        for value, error in [
+            (["foo"], None),
+            ([], "{value} is too short"),
+            (2, "{value} is not of type 'array'"),
+            ([2], "{value} is not of type 'string'"),
+            (None, None),
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value[0] if isinstance(value, list) and len(value) == 1 else value)) if error else None
+                self._test_value("command_chain", value, error)
+
+    def test_environment(self):
+        for value, error in [
+            ({}, "{value} does not have enough properties"),
+            ({"ENV_NAME": ""}, "'' is too short"),
+            ({"ENV-NAME": ""}, "'ENV-NAME' does not match any of the regexes: '^[a-zA-Z_][a-zA-Z0-9_]*$'"),
+            ({"ENV_NAME": "value"}, None),
+            ({"ENV_NAME": "val\0ue"}, "'val\\x00ue' does not match '^[^\\\\0]*$'"),
+            ([], "{value} is not of type 'object'"),
+            (2, "{value} is not of type 'object'"),
+            ([2], "{value} is not of type 'object'"),
+            (None, None),
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("environment", value, error)
+
+    def test_passthrough(self):
+        for value, error in [
+            ({}, "{value} does not have enough properties"),
+            ({"test": ''}, "'' is not of type 'array'"),
+            ({"test": []}, "[] is too short"),
+            ({"test": ['']}, "'' is too short"),
+            ({"test": ["value"]}, None),
+            ({"te%st": ["value"]}, None),
+            ({"test": ["val\0ue"]}, None),
+            ([], "{value} is not of type 'object'"),
+            (2, "{value} is not of type 'object'"),
+            ([2], "{value} is not of type 'object'"),
+            (None, None),
+        ]:
+            with self.subTest(value=value):
+                error = error.format_map(SafeDict(value=value)) if error else None
+                self._test_value("passthrough", value, error)