diff --git a/integration/copy_test.go b/integration/copy_test.go index bd15c2e4..34127737 100644 --- a/integration/copy_test.go +++ b/integration/copy_test.go @@ -137,14 +137,20 @@ func (s *CopySuite) TestCopySimple(c *check.C) { out := combinedOutputOfCommand(c, "diff", "-urN", dir1, dir2) c.Assert(out, check.Equals, "") - // docker v2s2 -> OCI image layout + // docker v2s2 -> OCI image layout with image name // ociDest will be created by oci: if it doesn't exist // so don't create it here to exercise auto-creation - ociDest := "busybox-latest" + ociDest := "busybox-latest-image" + ociImgName := "busybox" defer os.RemoveAll(ociDest) - assertSkopeoSucceeds(c, "", "copy", "docker://busybox:latest", "oci:"+ociDest) + assertSkopeoSucceeds(c, "", "copy", "docker://busybox:latest", "oci:"+ociDest+":"+ociImgName) _, err = os.Stat(ociDest) c.Assert(err, check.IsNil) + + // docker v2s2 -> OCI image layout without image name + ociDest = "busybox-latest-noimage" + defer os.RemoveAll(ociDest) + assertSkopeoFails(c, ".*Error initializing destination oci:busybox-latest-noimage:: cannot save image with empty image.ref.name.*", "copy", "docker://busybox:latest", "oci:"+ociDest) } // Check whether dir: images in dir1 and dir2 are equal, ignoring schema1 signatures. diff --git a/vendor/github.com/containers/image/docker/docker_client.go b/vendor/github.com/containers/image/docker/docker_client.go index 99102a6c..03737537 100644 --- a/vendor/github.com/containers/image/docker/docker_client.go +++ b/vendor/github.com/containers/image/docker/docker_client.go @@ -155,6 +155,10 @@ func setupCertificates(dir string, tlsc *tls.Config) error { if os.IsNotExist(err) { return nil } + if os.IsPermission(err) { + logrus.Debugf("Skipping scan of %s due to permission error: %v", dir, err) + return nil + } return err } diff --git a/vendor/github.com/containers/image/oci/layout/oci_dest.go b/vendor/github.com/containers/image/oci/layout/oci_dest.go index 05367309..2b789fc8 100644 --- a/vendor/github.com/containers/image/oci/layout/oci_dest.go +++ b/vendor/github.com/containers/image/oci/layout/oci_dest.go @@ -23,13 +23,16 @@ type ociImageDestination struct { } // newImageDestination returns an ImageDestination for writing to an existing directory. -func newImageDestination(ref ociReference) types.ImageDestination { +func newImageDestination(ref ociReference) (types.ImageDestination, error) { + if ref.image == "" { + return nil, errors.Errorf("cannot save image with empty image.ref.name") + } index := imgspecv1.Index{ Versioned: imgspec.Versioned{ SchemaVersion: 2, }, } - return &ociImageDestination{ref: ref, index: index} + return &ociImageDestination{ref: ref, index: index}, nil } // Reference returns the reference used to set up this destination. Note that this should directly correspond to user's intent, @@ -178,7 +181,7 @@ func (d *ociImageDestination) PutManifest(m []byte) error { } annotations := make(map[string]string) - annotations["org.opencontainers.image.ref.name"] = d.ref.tag + annotations["org.opencontainers.image.ref.name"] = d.ref.image desc.Annotations = annotations desc.Platform = &imgspecv1.Platform{ Architecture: runtime.GOARCH, diff --git a/vendor/github.com/containers/image/oci/layout/oci_transport.go b/vendor/github.com/containers/image/oci/layout/oci_transport.go index f1fc1071..1406dd18 100644 --- a/vendor/github.com/containers/image/oci/layout/oci_transport.go +++ b/vendor/github.com/containers/image/oci/layout/oci_transport.go @@ -36,7 +36,14 @@ func (t ociTransport) ParseReference(reference string) (types.ImageReference, er return ParseReference(reference) } -var refRegexp = regexp.MustCompile(`^([A-Za-z0-9._-]+)+$`) +// annotation spex from https://github.com/opencontainers/image-spec/blob/master/annotations.md#pre-defined-annotation-keys +const ( + separator = `(?:[-._:@+]|--)` + alphanum = `(?:[A-Za-z0-9]+)` + component = `(?:` + alphanum + `(?:` + separator + alphanum + `)*)` +) + +var refRegexp = regexp.MustCompile(`^` + component + `(?:/` + component + `)*$`) // ValidatePolicyConfigurationScope checks that scope is a valid name for a signature.PolicyTransportScopes keys // (i.e. a valid PolicyConfigurationIdentity() or PolicyConfigurationNamespaces() return value). @@ -44,19 +51,14 @@ var refRegexp = regexp.MustCompile(`^([A-Za-z0-9._-]+)+$`) // scope passed to this function will not be "", that value is always allowed. func (t ociTransport) ValidatePolicyConfigurationScope(scope string) error { var dir string - sep := strings.LastIndex(scope, ":") - if sep == -1 { - dir = scope - } else { - dir = scope[:sep] - tag := scope[sep+1:] - if !refRegexp.MatchString(tag) { - return errors.Errorf("Invalid tag %s", tag) - } - } + sep := strings.SplitN(scope, ":", 2) + dir = sep[0] - if strings.Contains(dir, ":") { - return errors.Errorf("Invalid OCI reference %s: path contains a colon", scope) + if len(sep) == 2 { + image := sep[1] + if !refRegexp.MatchString(image) { + return errors.Errorf("Invalid image %s", image) + } } if !strings.HasPrefix(dir, "/") { @@ -64,7 +66,7 @@ func (t ociTransport) ValidatePolicyConfigurationScope(scope string) error { } // Refuse also "/", otherwise "/" and "" would have the same semantics, // and "" could be unexpectedly shadowed by the "/" entry. - // (Note: we do allow "/:sometag", a bit ridiculous but why refuse it?) + // (Note: we do allow "/:someimage", a bit ridiculous but why refuse it?) if scope == "/" { return errors.New(`Invalid scope "/": Use the generic default scope ""`) } @@ -85,28 +87,26 @@ type ociReference struct { // (But in general, we make no attempt to be completely safe against concurrent hostile filesystem modifications.) dir string // As specified by the user. May be relative, contain symlinks, etc. resolvedDir string // Absolute path with no symlinks, at least at the time of its creation. Primarily used for policy namespaces. - tag string + image string // If image=="", it means the only image in the index.json is used } // ParseReference converts a string, which should not start with the ImageTransport.Name prefix, into an OCI ImageReference. func ParseReference(reference string) (types.ImageReference, error) { - var dir, tag string - sep := strings.LastIndex(reference, ":") - if sep == -1 { - dir = reference - tag = "latest" - } else { - dir = reference[:sep] - tag = reference[sep+1:] + var dir, image string + sep := strings.SplitN(reference, ":", 2) + dir = sep[0] + + if len(sep) == 2 { + image = sep[1] } - return NewReference(dir, tag) + return NewReference(dir, image) } -// NewReference returns an OCI reference for a directory and a tag. +// NewReference returns an OCI reference for a directory and a image. // // We do not expose an API supplying the resolvedDir; we could, but recomputing it // is generally cheap enough that we prefer being confident about the properties of resolvedDir. -func NewReference(dir, tag string) (types.ImageReference, error) { +func NewReference(dir, image string) (types.ImageReference, error) { resolved, err := explicitfilepath.ResolvePathToFullyExplicit(dir) if err != nil { return nil, err @@ -114,12 +114,12 @@ func NewReference(dir, tag string) (types.ImageReference, error) { // This is necessary to prevent directory paths returned by PolicyConfigurationNamespaces // from being ambiguous with values of PolicyConfigurationIdentity. if strings.Contains(resolved, ":") { - return nil, errors.Errorf("Invalid OCI reference %s:%s: path %s contains a colon", dir, tag, resolved) + return nil, errors.Errorf("Invalid OCI reference %s:%s: path %s contains a colon", dir, image, resolved) } - if !refRegexp.MatchString(tag) { - return nil, errors.Errorf("Invalid tag %s", tag) + if len(image) > 0 && !refRegexp.MatchString(image) { + return nil, errors.Errorf("Invalid image %s", image) } - return ociReference{dir: dir, resolvedDir: resolved, tag: tag}, nil + return ociReference{dir: dir, resolvedDir: resolved, image: image}, nil } func (ref ociReference) Transport() types.ImageTransport { @@ -132,7 +132,7 @@ func (ref ociReference) Transport() types.ImageTransport { // e.g. default attribute values omitted by the user may be filled in in the return value, or vice versa. // WARNING: Do not use the return value in the UI to describe an image, it does not contain the Transport().Name() prefix. func (ref ociReference) StringWithinTransport() string { - return fmt.Sprintf("%s:%s", ref.dir, ref.tag) + return fmt.Sprintf("%s:%s", ref.dir, ref.image) } // DockerReference returns a Docker reference associated with this reference @@ -150,7 +150,10 @@ func (ref ociReference) DockerReference() reference.Named { // not required/guaranteed that it will be a valid input to Transport().ParseReference(). // Returns "" if configuration identities for these references are not supported. func (ref ociReference) PolicyConfigurationIdentity() string { - return fmt.Sprintf("%s:%s", ref.resolvedDir, ref.tag) + // NOTE: ref.image is not a part of the image identity, because "$dir:$someimage" and "$dir:" may mean the + // same image and the two can’t be statically disambiguated. Using at least the repository directory is + // less granular but hopefully still useful. + return fmt.Sprintf("%s", ref.resolvedDir) } // PolicyConfigurationNamespaces returns a list of other policy configuration namespaces to search @@ -196,26 +199,48 @@ func (ref ociReference) getManifestDescriptor() (imgspecv1.Descriptor, error) { if err := json.NewDecoder(indexJSON).Decode(&index); err != nil { return imgspecv1.Descriptor{}, err } + var d *imgspecv1.Descriptor - for _, md := range index.Manifests { - if md.MediaType != imgspecv1.MediaTypeImageManifest { - continue + if ref.image == "" { + // return manifest if only one image is in the oci directory + if len(index.Manifests) == 1 { + d = &index.Manifests[0] + } else { + // ask user to choose image when more than one image in the oci directory + return imgspecv1.Descriptor{}, errors.Wrapf(err, "more than one image in oci, choose an image") } - refName, ok := md.Annotations["org.opencontainers.image.ref.name"] - if !ok { - continue - } - if refName == ref.tag { - d = &md - break + } else { + // if image specified, look through all manifests for a match + for _, md := range index.Manifests { + if md.MediaType != imgspecv1.MediaTypeImageManifest { + continue + } + refName, ok := md.Annotations["org.opencontainers.image.ref.name"] + if !ok { + continue + } + if refName == ref.image { + d = &md + break + } } } if d == nil { - return imgspecv1.Descriptor{}, fmt.Errorf("no descriptor found for reference %q", ref.tag) + return imgspecv1.Descriptor{}, fmt.Errorf("no descriptor found for reference %q", ref.image) } return *d, nil } +// LoadManifestDescriptor loads the manifest descriptor to be used to retrieve the image name +// when pulling an image +func LoadManifestDescriptor(imgRef types.ImageReference) (imgspecv1.Descriptor, error) { + ociRef, ok := imgRef.(ociReference) + if !ok { + return imgspecv1.Descriptor{}, errors.Errorf("error typecasting, need type ociRef") + } + return ociRef.getManifestDescriptor() +} + // NewImageSource returns a types.ImageSource for this reference, // asking the backend to use a manifest from requestedManifestMIMETypes if possible. // nil requestedManifestMIMETypes means manifest.DefaultRequestedManifestMIMETypes. @@ -227,7 +252,7 @@ func (ref ociReference) NewImageSource(ctx *types.SystemContext, requestedManife // NewImageDestination returns a types.ImageDestination for this reference. // The caller must call .Close() on the returned ImageDestination. func (ref ociReference) NewImageDestination(ctx *types.SystemContext) (types.ImageDestination, error) { - return newImageDestination(ref), nil + return newImageDestination(ref) } // DeleteImage deletes the named image from the registry, if supported. diff --git a/vendor/github.com/containers/image/vendor.conf b/vendor/github.com/containers/image/vendor.conf index d4725e12..669b5a76 100644 --- a/vendor/github.com/containers/image/vendor.conf +++ b/vendor/github.com/containers/image/vendor.conf @@ -1,9 +1,9 @@ github.com/sirupsen/logrus v1.0.0 -github.com/containers/storage 5d8c2f87387fa5be9fa526ae39fbd79b8bdf27be +github.com/containers/storage 47536c89fcc545a87745e1a1573addc439409165 github.com/davecgh/go-spew 346938d642f2ec3594ed81d874461961cd0faa76 -github.com/docker/distribution df5327f76fb6468b84a87771e361762b8be23fdb -github.com/docker/docker 75843d36aa5c3eaade50da005f9e0ff2602f3d5e -github.com/docker/go-connections 7da10c8c50cad14494ec818dcdfb6506265c0086 +github.com/docker/distribution 5f6282db7d65e6d72ad7c2cc66310724a57be716 +github.com/docker/docker 30eb4d8cdc422b023d5f11f29a82ecb73554183b +github.com/docker/go-connections 3ede32e2033de7505e6500d6c868c2b9ed9f169d github.com/docker/go-units 0dadbb0345b35ec7ef35e228dabb8de89a65bf52 github.com/docker/libtrust aabc10ec26b754e797f9028f4589c5b7bd90dc20 github.com/ghodss/yaml 04f313413ffd65ce25f2541bfd2b2ceec5c0908c @@ -24,7 +24,7 @@ github.com/stretchr/testify 4d4bfba8f1d1027c4fdbe371823030df51419987 github.com/vbatts/tar-split bd4c5d64c3e9297f410025a3b1bd0c58f659e721 golang.org/x/crypto 453249f01cfeb54c3d549ddb75ff152ca243f9d8 golang.org/x/net 6b27048ae5e6ad1ef927e72e437531493de612fe -golang.org/x/sys 075e574b89e4c2d22f2286a7e2b919519c6f3547 +golang.org/x/sys 43e60d72a8e2bd92ee98319ba9a384a0e9837c08 gopkg.in/cheggaaa/pb.v1 d7e6ca3010b6f084d8056847f55d7f572f180678 gopkg.in/yaml.v2 a3f3340b5840cee44f372bddb5880fcbc419b46a k8s.io/client-go bcde30fb7eaed76fd98a36b4120321b94995ffb6 @@ -35,3 +35,4 @@ github.com/tchap/go-patricia v2.2.6 github.com/opencontainers/selinux ba1aefe8057f1d0cfb8e88d0ec1dc85925ef987d github.com/BurntSushi/toml b26d9c308763d68093482582cea63d69be07a0f0 github.com/ostreedev/ostree-go aeb02c6b6aa2889db3ef62f7855650755befd460 +github.com/gogo/protobuf/proto fcdc5011193ff531a548e9b0301828d5a5b97fd8