github/skopeo
1
0
Fork 0
mirror of https://github.com/containers/skopeo.git synced 2025-08-13 12:16:16 +00:00
Code Issues Projects Releases Wiki Activity

Use globalOptions.getPolicyContext instead of an image-targeted SystemContext

Browse Source 
This automatically the global --policy-path and --insecure-policy options,
which don't affect h.sysctx.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This commit is contained in:
Miloslav Trmač 2023-07-18 20:22:22 +02:00
parent 38650252d5
commit e90ad8614b
1 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/skopeo/proxy.go
View File

@ -75,7 +75,6 @@ import (
"github.com/containers/image/v5/manifest" "github.com/containers/image/v5/manifest"
ocilayout "github.com/containers/image/v5/oci/layout" ocilayout "github.com/containers/image/v5/oci/layout"
"github.com/containers/image/v5/pkg/blobinfocache" "github.com/containers/image/v5/pkg/blobinfocache"
"github.com/containers/image/v5/signature"
"github.com/containers/image/v5/transports" "github.com/containers/image/v5/transports"
"github.com/containers/image/v5/transports/alltransports" "github.com/containers/image/v5/transports/alltransports"
"github.com/containers/image/v5/types" "github.com/containers/image/v5/types"
@ -268,15 +267,11 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (replyBuf,
return ret, err return ret, err
} }
policyContext, err := h.opts.global.getPolicyContext()
if err != nil {
return ret, err
}
unparsedTopLevel := image.UnparsedInstance(imgsrc, nil) unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
policy, err := signature.DefaultPolicy(h.sysctx)
if err != nil {
return ret, err
}
policyContext, err := signature.NewPolicyContext(policy)
if err != nil {
return ret, err
}
allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel) allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel)
if !allowed || err != nil { if !allowed || err != nil {
return ret, err return ret, err