2016-08-29 14:45:29 -04:00
|
|
|
package image
|
|
|
|
|
|
|
|
import (
|
2018-05-03 18:02:44 -07:00
|
|
|
"context"
|
2016-08-29 14:45:29 -04:00
|
|
|
"encoding/hex"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
|
2023-08-31 00:36:58 +02:00
|
|
|
"github.com/distribution/reference"
|
2017-04-17 18:07:56 -04:00
|
|
|
"github.com/docker/cli/cli/command"
|
2019-01-28 14:30:31 +01:00
|
|
|
"github.com/docker/cli/cli/streams"
|
2017-04-17 18:07:56 -04:00
|
|
|
"github.com/docker/cli/cli/trust"
|
2025-04-25 18:05:16 +02:00
|
|
|
"github.com/docker/cli/internal/jsonstream"
|
2024-01-24 14:32:07 +01:00
|
|
|
"github.com/docker/docker/api/types/image"
|
2017-09-26 12:53:21 -04:00
|
|
|
registrytypes "github.com/docker/docker/api/types/registry"
|
2016-08-29 14:45:29 -04:00
|
|
|
"github.com/docker/docker/registry"
|
2022-03-04 14:43:34 +01:00
|
|
|
"github.com/opencontainers/go-digest"
|
2017-03-09 13:23:45 -05:00
|
|
|
"github.com/pkg/errors"
|
2017-08-07 11:52:40 +02:00
|
|
|
"github.com/sirupsen/logrus"
|
2017-10-30 17:21:41 +01:00
|
|
|
"github.com/theupdateframework/notary/client"
|
|
|
|
"github.com/theupdateframework/notary/tuf/data"
|
2016-08-29 14:45:29 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
type target struct {
|
2016-12-06 11:27:27 -08:00
|
|
|
name string
|
|
|
|
digest digest.Digest
|
|
|
|
size int64
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
|
2025-03-01 01:34:23 +01:00
|
|
|
// notaryClientProvider is used in tests to provide a dummy notary client.
|
|
|
|
type notaryClientProvider interface {
|
|
|
|
NotaryClient(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client.Repository, error)
|
|
|
|
}
|
|
|
|
|
|
|
|
// newNotaryClient provides a Notary Repository to interact with signed metadata for an image.
|
|
|
|
func newNotaryClient(cli command.Streams, imgRefAndAuth trust.ImageRefAndAuth) (client.Repository, error) {
|
|
|
|
if ncp, ok := cli.(notaryClientProvider); ok {
|
|
|
|
// notaryClientProvider is used in tests to provide a dummy notary client.
|
|
|
|
return ncp.NotaryClient(imgRefAndAuth, []string{"pull"})
|
|
|
|
}
|
|
|
|
return trust.GetNotaryRepository(cli.In(), cli.Out(), command.UserAgent(), imgRefAndAuth.RepoInfo(), imgRefAndAuth.AuthConfig(), "pull")
|
|
|
|
}
|
|
|
|
|
2025-03-05 15:35:31 +01:00
|
|
|
// pushTrustedReference pushes a canonical reference to the trust server.
|
|
|
|
func pushTrustedReference(ctx context.Context, ioStreams command.Streams, repoInfo *registry.RepositoryInfo, ref reference.Named, authConfig registrytypes.AuthConfig, in io.Reader) error {
|
|
|
|
return trust.PushTrustedReference(ctx, ioStreams, repoInfo, ref, authConfig, in, command.UserAgent())
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// trustedPull handles content trust pulling of an image
|
2025-03-31 19:31:31 +02:00
|
|
|
func trustedPull(ctx context.Context, cli command.Cli, imgRefAndAuth trust.ImageRefAndAuth, opts pullOptions) error {
|
2017-09-26 12:53:21 -04:00
|
|
|
refs, err := getTrustedPullTargets(cli, imgRefAndAuth)
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-26 12:53:21 -04:00
|
|
|
ref := imgRefAndAuth.Reference()
|
2016-08-29 14:45:29 -04:00
|
|
|
for i, r := range refs {
|
2016-12-06 11:27:27 -08:00
|
|
|
displayTag := r.name
|
2016-08-29 14:45:29 -04:00
|
|
|
if displayTag != "" {
|
|
|
|
displayTag = ":" + displayTag
|
|
|
|
}
|
2025-02-01 22:35:20 +01:00
|
|
|
_, _ = fmt.Fprintf(cli.Out(), "Pull (%d of %d): %s%s@%s\n", i+1, len(refs), reference.FamiliarName(ref), displayTag, r.digest)
|
2016-08-29 14:45:29 -04:00
|
|
|
|
2017-01-11 13:54:52 -08:00
|
|
|
trustedRef, err := reference.WithDigest(reference.TrimNamed(ref), r.digest)
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2023-03-15 16:21:02 +01:00
|
|
|
updatedImgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), trustedRef.String())
|
2017-10-06 14:46:17 -07:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2025-03-31 19:31:31 +02:00
|
|
|
if err := imagePullPrivileged(ctx, cli, updatedImgRefAndAuth, pullOptions{
|
2018-12-19 13:48:41 +01:00
|
|
|
all: false,
|
|
|
|
platform: opts.platform,
|
|
|
|
quiet: opts.quiet,
|
|
|
|
remote: opts.remote,
|
|
|
|
}); err != nil {
|
2016-08-29 14:45:29 -04:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-01-11 13:54:52 -08:00
|
|
|
tagged, err := reference.WithTag(reference.TrimNamed(ref), r.name)
|
2016-12-06 11:27:27 -08:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-01-11 13:54:52 -08:00
|
|
|
|
2025-03-05 16:16:01 +01:00
|
|
|
// Use familiar references when interacting with client and output
|
|
|
|
familiarRef := reference.FamiliarString(tagged)
|
|
|
|
trustedFamiliarRef := reference.FamiliarString(trustedRef)
|
|
|
|
_, _ = fmt.Fprintf(cli.Err(), "Tagging %s as %s\n", trustedFamiliarRef, familiarRef)
|
|
|
|
if err := cli.Client().ImageTag(ctx, trustedFamiliarRef, familiarRef); err != nil {
|
2016-12-06 11:27:27 -08:00
|
|
|
return err
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-09-26 12:53:21 -04:00
|
|
|
func getTrustedPullTargets(cli command.Cli, imgRefAndAuth trust.ImageRefAndAuth) ([]target, error) {
|
2025-03-01 01:34:23 +01:00
|
|
|
notaryRepo, err := newNotaryClient(cli, imgRefAndAuth)
|
2017-09-26 12:53:21 -04:00
|
|
|
if err != nil {
|
2017-10-23 13:41:52 -04:00
|
|
|
return nil, errors.Wrap(err, "error establishing connection to trust repository")
|
2017-09-26 12:53:21 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
ref := imgRefAndAuth.Reference()
|
|
|
|
tagged, isTagged := ref.(reference.NamedTagged)
|
|
|
|
if !isTagged {
|
|
|
|
// List all targets
|
|
|
|
targets, err := notaryRepo.ListTargets(trust.ReleasesRole, data.CanonicalTargetsRole)
|
|
|
|
if err != nil {
|
|
|
|
return nil, trust.NotaryError(ref.Name(), err)
|
|
|
|
}
|
|
|
|
var refs []target
|
|
|
|
for _, tgt := range targets {
|
|
|
|
t, err := convertTarget(tgt.Target)
|
|
|
|
if err != nil {
|
2025-02-01 22:35:20 +01:00
|
|
|
_, _ = fmt.Fprintf(cli.Err(), "Skipping target for %q\n", reference.FamiliarName(ref))
|
2017-09-26 12:53:21 -04:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
// Only list tags in the top level targets role or the releases delegation role - ignore
|
|
|
|
// all other delegation roles
|
|
|
|
if tgt.Role != trust.ReleasesRole && tgt.Role != data.CanonicalTargetsRole {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
refs = append(refs, t)
|
|
|
|
}
|
|
|
|
if len(refs) == 0 {
|
|
|
|
return nil, trust.NotaryError(ref.Name(), errors.Errorf("No trusted tags for %s", ref.Name()))
|
|
|
|
}
|
|
|
|
return refs, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
t, err := notaryRepo.GetTargetByName(tagged.Tag(), trust.ReleasesRole, data.CanonicalTargetsRole)
|
|
|
|
if err != nil {
|
|
|
|
return nil, trust.NotaryError(ref.Name(), err)
|
|
|
|
}
|
|
|
|
// Only get the tag if it's in the top level targets role or the releases delegation role
|
|
|
|
// ignore it if it's in any other delegation roles
|
|
|
|
if t.Role != trust.ReleasesRole && t.Role != data.CanonicalTargetsRole {
|
|
|
|
return nil, trust.NotaryError(ref.Name(), errors.Errorf("No trust data for %s", tagged.Tag()))
|
|
|
|
}
|
|
|
|
|
2017-10-23 13:41:52 -04:00
|
|
|
logrus.Debugf("retrieving target for %s role", t.Role)
|
2017-09-26 12:53:21 -04:00
|
|
|
r, err := convertTarget(t.Target)
|
|
|
|
return []target{r}, err
|
|
|
|
}
|
|
|
|
|
2016-08-29 14:45:29 -04:00
|
|
|
// imagePullPrivileged pulls the image and displays it to the output
|
2025-03-31 19:31:31 +02:00
|
|
|
func imagePullPrivileged(ctx context.Context, cli command.Cli, imgRefAndAuth trust.ImageRefAndAuth, opts pullOptions) error {
|
2023-04-11 18:16:30 +02:00
|
|
|
encodedAuth, err := registrytypes.EncodeAuthConfig(*imgRefAndAuth.AuthConfig())
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-09-26 12:53:21 -04:00
|
|
|
requestPrivilege := command.RegistryAuthenticationPrivilegedFunc(cli, imgRefAndAuth.RepoInfo().Index, "pull")
|
2024-01-24 14:32:07 +01:00
|
|
|
responseBody, err := cli.Client().ImagePull(ctx, reference.FamiliarString(imgRefAndAuth.Reference()), image.PullOptions{
|
2016-08-29 14:45:29 -04:00
|
|
|
RegistryAuth: encodedAuth,
|
|
|
|
PrivilegeFunc: requestPrivilege,
|
2018-12-19 13:48:41 +01:00
|
|
|
All: opts.all,
|
|
|
|
Platform: opts.platform,
|
2023-04-11 20:19:17 +02:00
|
|
|
})
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer responseBody.Close()
|
|
|
|
|
2018-12-19 13:48:41 +01:00
|
|
|
out := cli.Out()
|
|
|
|
if opts.quiet {
|
2022-02-25 13:10:34 +01:00
|
|
|
out = streams.NewOut(io.Discard)
|
2018-12-19 13:48:41 +01:00
|
|
|
}
|
2024-12-02 15:35:39 +01:00
|
|
|
return jsonstream.Display(ctx, responseBody, out)
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// TrustedReference returns the canonical trusted reference for an image reference
|
2023-03-15 16:21:02 +01:00
|
|
|
func TrustedReference(ctx context.Context, cli command.Cli, ref reference.NamedTagged) (reference.Canonical, error) {
|
|
|
|
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), ref.String())
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2025-03-01 01:34:23 +01:00
|
|
|
notaryRepo, err := newNotaryClient(cli, imgRefAndAuth)
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
2017-10-23 13:41:52 -04:00
|
|
|
return nil, errors.Wrap(err, "error establishing connection to trust repository")
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
|
2016-12-05 16:06:29 -08:00
|
|
|
t, err := notaryRepo.GetTargetByName(ref.Tag(), trust.ReleasesRole, data.CanonicalTargetsRole)
|
2016-08-29 14:45:29 -04:00
|
|
|
if err != nil {
|
2018-03-06 11:15:18 +01:00
|
|
|
return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), err)
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
// Only list tags in the top level targets role or the releases delegation role - ignore
|
|
|
|
// all other delegation roles
|
2016-12-05 16:06:29 -08:00
|
|
|
if t.Role != trust.ReleasesRole && t.Role != data.CanonicalTargetsRole {
|
2018-03-06 11:15:18 +01:00
|
|
|
return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
r, err := convertTarget(t.Target)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2016-11-10 15:59:02 -08:00
|
|
|
return reference.WithDigest(reference.TrimNamed(ref), r.digest)
|
2016-08-29 14:45:29 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
func convertTarget(t client.Target) (target, error) {
|
|
|
|
h, ok := t.Hashes["sha256"]
|
|
|
|
if !ok {
|
|
|
|
return target{}, errors.New("no valid hash, expecting sha256")
|
|
|
|
}
|
|
|
|
return target{
|
2016-12-06 11:27:27 -08:00
|
|
|
name: t.Name,
|
|
|
|
digest: digest.NewDigestFromHex("sha256", hex.EncodeToString(h)),
|
|
|
|
size: t.Length,
|
2016-08-29 14:45:29 -04:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2017-09-26 12:53:21 -04:00
|
|
|
// AuthResolver returns an auth resolver function from a command.Cli
|
2023-02-08 02:31:59 +01:00
|
|
|
func AuthResolver(cli command.Cli) func(ctx context.Context, index *registrytypes.IndexInfo) registrytypes.AuthConfig {
|
|
|
|
return func(ctx context.Context, index *registrytypes.IndexInfo) registrytypes.AuthConfig {
|
2023-07-10 17:24:07 +02:00
|
|
|
return command.ResolveAuthConfig(cli.ConfigFile(), index)
|
2017-09-26 12:53:21 -04:00
|
|
|
}
|
|
|
|
}
|