github/skopeo
1
0
Fork 0
mirror of https://github.com/containers/skopeo.git synced 2025-08-28 11:03:19 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #2048 from mtrmac/proxy-policy

Browse Source 
Follow-up fixes to #2029
This commit is contained in:
Colin Walters 2023-07-19 06:25:58 -04:00 committed by GitHub
commit f2be411b7b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
cmd/skopeo/proxy.go
View File

@ -75,7 +75,6 @@ import (
"github.com/containers/image/v5/manifest" "github.com/containers/image/v5/manifest"
ocilayout "github.com/containers/image/v5/oci/layout" ocilayout "github.com/containers/image/v5/oci/layout"
"github.com/containers/image/v5/pkg/blobinfocache" "github.com/containers/image/v5/pkg/blobinfocache"
"github.com/containers/image/v5/signature"
"github.com/containers/image/v5/transports" "github.com/containers/image/v5/transports"
"github.com/containers/image/v5/transports/alltransports" "github.com/containers/image/v5/transports/alltransports"
"github.com/containers/image/v5/types" "github.com/containers/image/v5/types"
@ -239,7 +238,7 @@ func isNotFoundImageError(err error) bool {
errors.Is(err, ocilayout.ImageNotFoundError{}) errors.Is(err, ocilayout.ImageNotFoundError{})
} }
func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (replyBuf, error) { func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBuf replyBuf, retErr error) {
h.lock.Lock() h.lock.Lock()
defer h.lock.Unlock() defer h.lock.Unlock()
var ret replyBuf var ret replyBuf
@ -268,21 +267,23 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (replyBuf,
return ret, err return ret, err
} }
policyContext, err := h.opts.global.getPolicyContext()
if err != nil {
return ret, err
}
defer func() {
if err := policyContext.Destroy(); err != nil {
retErr = noteCloseFailure(retErr, "tearing down policy context", err)
}
}()
unparsedTopLevel := image.UnparsedInstance(imgsrc, nil) unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
policy, err := signature.DefaultPolicy(h.sysctx)
if err != nil {
return ret, err
}
policyContext, err := signature.NewPolicyContext(policy)
if err != nil {
return ret, err
}
allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel) allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel)
if !allowed || err != nil { if err != nil {
return ret, err return ret, err
} }
if !allowed && err == nil { if !allowed {
return ret, fmt.Errorf("policy verification failed unexpectedly") return ret, fmt.Errorf("internal inconsistency: policy verification failed without returning an error")
} }
// Note that we never return zero as an imageid; this code doesn't yet // Note that we never return zero as an imageid; this code doesn't yet