... at Fedora 38 because the tests are assuming a v2s2
image, but as of Fedora 39, the image uses the OCI format.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Given the big changes in c/common, c/image and c/storage, I think
it makes sense to create Skopeo v1.15.0 now to go out with Podman v5.0
and Buildah v1.35.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Move docs under "Building without a container".
Check instead of setting env variable.
Provide alternative approach.
Signed-off-by: Miltiadis Kallianis <miltiadis.kallianis@asml.com>
... and c/image/v5 to main
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
As the title says. Bumping to v1.15.0-dev. We'll be using 1.14 in
RHEL 8.10/9.4, and v1.15 of Skopeo will be targeted for a later RHEL
version.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
As the title says. Bumping now in preparation for RHEL 8.10/9.4.
Once merged, I will create release-1.14 branch based on this commit.
[NO NEW TESTS NEEDED]
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
ENTRYPOINT was incorrectly documented to be set to /
(which doesn't even make sense).
Stop mentioning PATH and WORKDIR in the top-level README,
typical users of the container shouldn't need to care,
and it's already somewhat implied by "built using the latest Fedora".
Fixes#2134.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Some other containers/* repos use these values in test names;
we don't, so remove them so that we don't have to worry
about keeping them up to date.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
These jobs have been failing since early August due to
technical/scripting problems. Disable/remove entirely since a fix
is unlikely to be implemented anytime soon.
Signed-off-by: Chris Evich <cevich@redhat.com>
The lowercase `and` in the License field isn't compatible with spdx
license format.
This commit replaces all `and` with `AND` in the License field in spec.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Building all PRs of all container projects into the same COPR does not
properly isolate PRs from each other.
To avoid that, change the copr_build configuration to use the packit
default COPRs, which are specific to the particular PR, and disappear
after a few weeks. Depending projects should only run against what
landed in skopeo/main i.e. the podman-next COPR.
Signed-off-by: Martin Pitt <mpitt@redhat.com>
We already require it, because docker/credential-helpers uses Go 1.19
os/exec.Cmd.Environ(). So make that official.
> go mod tidy -go=1.19
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
> go get github.com/containers/image/v5@main
> go mod tidy && go mod vendor
This updates c/image with a new version of x/exp.
That package has changed API in an incompatible way,
so just bumping x/exp (as in https://github.com/containers/skopeo/pull/2060 )
would break Skopeo builds.
This updates both c/image and x/exp in lockstep (and nothing
needs updating in Skopeo itself for the x/exp breakage).
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This automatically the global --policy-path and --insecure-policy options,
which don't affect h.sysctx.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The pre-sync action constantly breaks and is currently not possible to
reliably test until the subsequent upstream release due to limitations
in packit.
The lines being added by the action script to the downstream Fedora spec
were only meant to keep Fedora happy. But given that they provide
no tangible benefit as github notifies us of security
issues in libraries mentioned in go.mod and go.sum, along with redhat
prodsec's own magic for creating security alerts, there's absolutely
no point to having the pre-sync action run and add a layer of uncertainty.
This commit removes the pre-sync action and
`rpm/update-spec-provides.sh`.
Ref: https://github.com/containers/podman/issues/19232
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
In PR review for a different issue, the question of what happens
if we hit overflow for the imageid serial was hit. This feels
pretty unlikely; if I did the math right, it'd require opening
an average of 136 images per second to overflow it in a year.
Nevertheless, in practice what we're sending on the wire is just a JSON
number, and if we extend this to the "max safe JSON number" of 2^53,
it'd take 285,616,414 images per second to overflow in a year, going
from implausible to probably impossible.
With a bit more work of course, we could make this a sparse mapping
and reuse freed numbers, but eh.
Signed-off-by: Colin Walters <walters@verbum.org>
The default Packit sandbox environment that runs Packit tasks for
downstream Fedora does not have golist installed by default and can't
run superuser tasks.
This commit will download and extract the golist binary from the Fedora
rpm and use it to provide golist.
The GOPATH mention in `rpm/update-spec-provides.sh` is only required for
golist to generate the gopaths and doesn't affect upstream or the rpm spec.
Currently, the only way to reliably test this is on an open github issue by running
`/packit propose-downstream`. This can't be run on an open PR.
The job-specific packit actions can only be tested via the packit
service and not via packit cli.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Distro conditionals have been rewritten in a cleaner
and easier to read way.
All `bcond` macros have been replaced with friendlier alternatives.
Also removed macros related to `import_path` as they are no longer
necessary.
update-spec-provides.sh has been updated to account for possible build
issues in downstream tasks which won't be noticed until a downstream
release.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
It's a bit cumbersome to manage a tooling version buried deep in a
command, let alone one also buried deep in a `Makefile`. Add a
variable to hold the version number so renovate can easily manage it.
This happens via a `regex` manager in the shared configuration
include `containers/automation//renovate/defaults.json5`. Also add a
helpful note/reminder to humans who may want to manually change the
version for some reason.
Depends on: https://github.com/containers/automation/pull/145
Signed-off-by: Chris Evich <cevich@redhat.com>
Assigning to a group isn't supported in github. Renove this section and
the golang section (all options moved into defaults.json5).
Signed-off-by: Chris Evich <cevich@redhat.com>
Get rid of `skopeo.spec.rpkg` in favour of
`rpm/skopeo.spec` which gets synced with fedora dist-git on every
upstream release. The version in the new spec file is set to `0` by
default and gets updated by packit automatically on every packit task.
Packit will automatically create a PR on fedora dist-git on every new
upstream release. A sample PR will look like:
https://src.fedoraproject.org/rpms/container-selinux/pull-request/10#
A dry run for this can be triggered using:
`$ packit propose-downstream --local-content`
To run this command locally, you would need to have your packit
user-configuration-file set.
Ref: https://packit.dev/docs/configuration/#user-configuration-file
along with a fedora api key created at:
https://src.fedoraproject.org/settings#nav-api-tab with sufficient ACLs.
This patch incurs zero additional cost to upstream as the downstream
tasks occur only after upstream release and do not block anything
upstream.
[NO NEW TESTS NEEDED]
Co-authored-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Currently it uses golang-1.18.7-1.fc36.x86_64 ; we need 1.19,
and the current version of the base image has golang-1.20.3-1.fc38.x86_64
.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Accurately document the effect of GO_DYN_FLAGS
- Fix a typo
- Remove a shell script example; removes a docker command,
we don't care to maintain it to run correctly,
and anyone knowledgeable enough to understand the
trade-offs of static linking can almost certainly create that from scratch.
Fixes#1700
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
More template functions available in (skopeo inspect --format)
Adds new ways to supply trusted keys to (skopeo standalone-verify).
Now requires Go 1.18.
- [CI:DOCS] Fix up language in README
- Add unit tests for tlsVerifyConfig's yaml.Unmarshaler
- Cirrus: Use human-readable CI VM Images
- [CI:BUILD] copr: fix el8 build and enable debuginfo
- [CI:BUILD] enable debuginfo for el8 copr builds
- Update to use, and benefit from, Go 1.18
- [CI:DOCS] Disable dependabot
- Renovate: c/common rule moved to defaults
- [CI:BUILD] Packit: initial enablement
- Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/
- Corrected typo in skopeo-sync and updated description
- Fix tabelating output in (skopeo inspect --format)
- Use common library reporter
- Fix formatting of inspect examples
- Use io.WriteString
- Factor out the output of data in (skopeo inspect)
- Simplify inspectOptions.writeOutput a bit more
- Cirrus: Update CI VM images
- Make the installation instructions more prominent in README.md
- [CI:BUILD] Packit: trigger builds on commit to main branch
- systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR
- Verify signatures from a trust store
- Rename argument. Only use any with public key file. Double check fingerprint is in public key file.
- Use multiple fingerprint function Allow comma separated fingerprint list
- Avoid use of a deprecated capability.NewPid
- Fix error handling of signature.NewEphemeralGPGSigningMechanism
- Cross-link the top-level and subcommand option lists
- Use golangci-lint instead of golint
- Add (make tools) to install (for now only) golangci-lint, use it in Cirrus
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The only thing hack/make.sh is now really doing is the
warning + sleep without SKOPEO_CONTAINER_TESTS .
So, make that a separate script, and eliminate the
hack/make directory.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This is simpler to do, cheap enough for our repo size, and it
does not require a network access to see which files to check.
And it's the last user of hack/make/.validate, which I wanted to
remove in the first place.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Always lint everything, not just changed files;
that means that if we upgrade the linter, we will
need to clean everything up, but that's a good thing
for contributors who come after that linter upgrade.
- Don't skip linting the integration tests, there's no
good reason to skip them.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
We now require Go 1.18. As of that version:
- GO111MODULE=on is implied by having a go.mod file
- -mod=vendor is implied by having a vendor directory
so just remove both options everywhere
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
signature.NewEphemeralGPGSigningMechanism is called in an if branch
where the previous err := introduces a "new" err variable, which means
the failure isn't visible after the if.
So, do the dumb thing and just check on both branches explicitly.
(We still need to worry about correctly setting "mech" and
"publicKeyfingerprints" to persist after the if.)
How I hate Go sometimes. And this shows we really should update
the linter.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Add the ability to use an on-disk trust store to verify signatures. Also allow the user to trust any known fingerprint instead of having to specify one.
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
This commit lets packit trigger builds on
`rhcontainerbot/podman-next` copr after a commit to the main branch
instead of the current github webhook trigger.
The builds triggered via packit also provide more information in their
`version-release`:
Current webhook triggered build:
`101:0.0.git.2460.cfd6f20f-1`.
Ref: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/package/skopeo/
Packit triggered build for another package (netavark) on podman-next:
101:1.6.0~dev-1.20230321121647013339.main.61.gd6f0352
Ref: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/package/netavark/
The packit triggered build correctly shows the upstream branch name,
commit id, timestamp as well as the upstream version.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
... mostly so that I get practice and remember this exists in the future.
(This saves one allocation & copy when the target implements
io.StringWriter. And that makes absolutely no relevant difference
on this path.)
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
tabwriter buffers lines that contain \t in memory, and only
writes them out on a .Flush(). So actually call that.
Without this, things like
> --format 'name\tdigest\tlabels\n{{.Name}}\t{{.Digest}}\t{{.Labels}}\n'
result in no output at all.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
gopkg.in/check.v1 hasn't had any commit since Nov 2020.
That's not a immediate issue for a test-only dependency, but
because it hides access to the standard library *testing.T,
eventually it will become limiting.
Also, using the same framework for unit and integration tests
seems practical.
This is mostly a batch copy&paste job, with a fairly high risk
of unexpected breakage.
Also, I didn't take much time at all to carefully choose between
assert.* and require.*; we can tune that as failures show up.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This commit will run COPR builds on every PR against all active
releases of CentOS Stream and Fedora, thus allowing buildability checks before the
PR merges.
Builds are done on a custom COPR project:
`rhcontainerbot/packit-builds`.
Ref: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/packit-builds/
The build targets are set in the copr itself, so we don't need to
explicitly mention them in `.packit.yaml`, making upstream configuration
a lot simpler.
The `spec.rpkg` file meant for rpm builds post-pr-merge at
`rhcontainerbot/podman-next` copr gets reused for packit builds, so the
packit jobs are independent of Fedora / CentOS dist-git.
NOTE: The Packit copr_build tasks help to check if every commit builds on
supported Fedora and CentOS Stream arches. They do not block the current
Cirrus-based workflow.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Fedora 35 builds are disabled, so remove fedora 35
conditionals while we're at it.
Bump containers-common dependency to match with that in
podman.spec.rpkg.
TODO: fix debuginfo for rhel8
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Image content hasn't changed much, the biggest thing here is the
`$IMAGE_SUFFIX` value. This new schema is also fully manageable
by renovate. Allowing a tag-push to c/automation_images to create image
update PRs in all repos automatically.
Signed-off-by: Chris Evich <cevich@redhat.com>
- Add a prompt to the skopeo commands.
- Add a "console" identifier to fenced code
blocks which has a prompt, not "sh".
Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
Use (podman unshare) as already suggested, it is necessary for an unprivileged
user to remove the temporary c/storage state. OTOH it doesn't work with Docker at all.
Don't use the - prefix, it only works at the _start_ of a rule, not in the middle of
a multi-line shell script.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Don't do it at all for the CI VM: We can use the
VM's global Podman configuration, and use faster overlay
instead of vfs, so let's do that.
- For the developer-run (make test-system):
- Add graphroot and runroot paths to make the configuration minimally valid
- Explicitly point CONTAINERS_STORAGE_CONF at the configutation
to be certain it will get used.
Then drop the (podman pull ...) in runner.sh:_podman_reset that seemed to
previously workaround the invalid /etc/containers/storage.conf .
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The containers/image CI setup reuses the runner script from this repo to
execute the skopeo tests. However, an env. var. is being taken out of
context in that environment, leading to failure. Fix this by
hard-coding an image-name which will always be available in both
environments.
Signed-off-by: Chris Evich <cevich@redhat.com>
This is necessary, since running the skopeo tests modifies the host
environment. This can result in some warning messages the first time
a container is started. These messages can interfere with tests which
are sensitive to stdout/stderr. Since many/most tests require a local
image registry, launch it with `/bin/true` after doing a system reset
to clear away any pesky warning messages.
Signed-off-by: Chris Evich <cevich@redhat.com>
For whatever reasons, the podman configuration in CI results in the
inspect test throwing the following error:
```
not ok 4 inspect: image manifest list w/ diff platform
125
configuration is unset - using hardcoded default graph root
\"/var/lib/containers/storage\""
configuration is unset - using hardcoded default graph root
\"/var/lib/containers/storage\""
StoreOptions
```
Fix this by not using `podman`. It's unnecessary, since all the test
needs is the golang-flavor of the current system's architecture name.
That can easily be obtained by asking the go tool directly.
Signed-off-by: Chris Evich <cevich@redhat.com>
These are already present in the VM images. These instructions only
cause the DNF cache to be refreshed, wasting precious developer time.
Signed-off-by: Chris Evich <cevich@redhat.com>
(skopeo copy) and (skopeo sync) now support --sign-by-sigstore=param-file,
using the containers-sigstore-signing-params.yaml(5) file format.
That notably adds support for Fulcio and Rekor signing.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This task does not make sense to maintain long-term on release
branches. Its intent is always/only to test the latest/greatest code
and environment. After release, it's simply too difficult to maintain
functioning CI with a constantly changing (Cirrus-managed) OSX environment.
Ensure the task only runs for PRs targeted at the default branch, or if
the current branch is the default branch.
Signed-off-by: Chris Evich <cevich@redhat.com>
Should not change behavior - it would matter for unit tests
which don't exist.
Also, promptForPassphrase must continue to hard-code "real" os.Stdin and os.Stdout.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Missing `.Close()` on the blob currently leaks a temporary
file. Noticed this when doing repeated pulls.
Signed-off-by: Colin Walters <walters@verbum.org>
Fairly universally, the last Cirrus-Cron job is set to fire off at
22:22 UTC. However, the re-run of failed jobs GHA workflow was
scheduled for 22:05, meaning it will never re-run the last cirrus-cron
job should it fail.
Re-arrange the execution order so as to give plenty of time between the
last cirrus-cron job starting, the auto-re-run attempt, and the final
failure-check e-mail.
Signed-off-by: Chris Evich <cevich@redhat.com>
Patch created by re-running the two example commands and manually
abbreviating long lists in the output.
Fixes#1766.
Signed-off-by: Fabian P. Schmidt <kerel@mailbox.org>
Since d9dfc44 the 'skopeo inspect' command exposes the LayerData
which often contains the layer size. This is a very useful feature
so we mentioned it in the README now.
Signed-off-by: Fabian P. Schmidt <kerel@mailbox.org>
This does reverse-dependency testing, verifying `proxy.go` using
the ostree-rs-ext Rust code's unit tests.
Based on #1781 by @cgwalters
Signed-off-by: Chris Evich <cevich@redhat.com>
The `behind-base-branch` setting means:
Renovate will rebase whenever the branch falls 1 or more
commit behind its base branch
Signed-off-by: Chris Evich <cevich@redhat.com>
> go get github.com/containers/image/v5@main
> make vendor
... to make sure that we don't regress against Skopeo 1.9.3.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
In some code I'm writing I want to be able to cleanly test if an
image exists, as distinguished from other errors like authentication
problems, network flakes etc.
As best I can tell, the containers/image abstraction doesn't
offer a clean way to do this.
For now, I chose the route of adding the ugly string error matching
here for the two cases I care about (docker v2s2 registry and oci
directories), so my Rust code can operate in terms of clean
`Option<Image>`.
Signed-off-by: Colin Walters <walters@verbum.org>
FIXME: This is not actually tested against a representative
error; we basically assume generic "scope is not sufficient" handling.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
AFAICT, “IBM Bluemix” has become “IBM Cloud”, and the “Bluemix” registry
is now (somehow related to?) icr.io; e.g.
https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview
lists bluemix.net and icr.io host names.
Randomly looking for a public image hosted on that registry, at least
> skopeo list-tags docker://icr.io/codeengine/firstjob
now succeeds.
So I’m assuming that at least the current cloud deployment now allows
listing tags, and does not need special handling. (It's unclear if
that is true for all existing deployments.)
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- It's unclear why it exists in the first place
- Looking at callers of imagesToCopyFromRepo, the only caller of this:
either the input is a single repo, in which case the failure to
list tags clearly results in a no-op and a "No images to sync" fatal
failure ...
- ... or the input is YAML, and in that case the caller is already
skipping the repo on a failure.
Either way, it's unclear why we would have a special "Registry disallows
tag retrieval" error special case instead of the generic text.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
They were useful before assertSkopeoSucceeds/assertSkopeoFails,
when they were used multiple times. Now, they don't
make the code any shorter.
Should not change (test) behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
(skopeo inspect) now provides more information about individual layers.
The default /etc/containers/registries.d/default.yaml now has all entries
commented-out, to use built-in defaults; that can change the default for lookaside-staging
to use an unprivileged users' home directory instead of a path in /var/.
- GHA: Re-use identical workflow from buildah repo
- Optimize upstream skopeo container image build
- Fix running tests on macOS
- Reformat with Go 1.19's gofmt
- Fix a comment
- Fix looking for commands with GNU make 4.2.1
- Talk about "registry repositories" in (skopeo sync) documentation
- Point at --all in the --preserve-digests option documentation
- Remove unused GIT_BRANCH definition
- Don't include git commit from a parent directory in the --version output
- Update for c/image's update of github.com/gobuffalo/pop
- Merge pull request #1737 from mtrmac/pop-v5-override
- Stop using docker/docker/pkg/homedir in tests
- add inspect layersData
- Don't abort sync if the registry returns invalid tags
- warn users about --dest-compress and --dest-decompress misuse
- document imageDestOptions.warnAboutIneffectiveOptions()
- warn about ineffective destination opts in sync cmd
- default.yaml should have all options commented
- Fix documentation in the default registries.d content.
- [CI:DOCS] Add quay-description update reminder
- Revert addition of -compat=1.17 to (go mod tidy)
- Update for https://github.com/klauspost/pgzip/pull/50
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... to fix reads of compressed data by docker-archive:
> go get github.com/klauspost/pgzip@master
> make vendor
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Typically, the compat with earlier versions causes us to use
newer versions of dependencies, which can only be a good thing.
Over time, the 1.17 version reference is just going to become obsolete.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The user is not very likely to be able to do anything about that,
and we have no other way to read those images - so just skip them;
we already skip image copies in much more directly user-caused
situations, including invalid user-provided strings.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
> go get github.com/containers/image/v5@main
> go mod tidy -go=1.16 && go mod tidy -go=1.17
> make vendor
The (go mod tidy) pair is necessary to keep c/image CI working.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This can happen when building RPMs out of tarballs (which don't contain
the .git repository).
To test:
> make -n /bin/skopeo; mv .git ../.git ; make -n bin/skopeo
Fixes#1707 .
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Running cross-platform compiles using emulation is a painfully
slow process. Since CI-runtime is limited, improve image build time
by leveraging the automatic RPM builds occurring for the podman-next
COPR repo. This adds build-time efficiency by offloading the
compilation task. Note: These RPMs are built any time the 'main'
branch changes, so they'll still be very recent.
https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/
Signed-off-by: Chris Evich <cevich@redhat.com>
It's a PITA to maintain duplicate code across repos. Relatively
github-actions added a feature that allows re-using workflows
from other repos. Use that here to reduce duplication.
Signed-off-by: Chris Evich <cevich@redhat.com>
- [CI:DOCS] Cirrus: Use the latest imgts container
- Cirrus: Update CI VM images to match podman CI
- Bump github.com/containers/common from 0.49.0 to 0.49.1
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Note: Removed disused `PRIOR_FEDORA*` and `UBUNTU_*` references since
they're not actually used in this CI. Further, F35 VM images were not
built as part of `c6013173500215296` due to a missing golang 1.18
requirement for podman.
Signed-off-by: Chris Evich <cevich@redhat.com>
- Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0
- Bump github.com/containers/storage from 1.41.0 to 1.42.0
- Update to github.com/containers/image/v5 v5.22.0
- Update to github.com/containers/common v0.49.0
- Stop using deprecated names from c/common/pkg/retry
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Adds support for copying non-image OCI artifacts, and for
creating and enforcing sigstore signatures.
Shell autocompletions are now auto-generated, adding support
for zsh, fish and PowerShell.
Now requires Go 1.17.
- Bump github.com/docker/docker
- Config files live in /usr/local/etc on FreeBSD
- Avoid hard-coding the location of bash
- Bump github.com/containers/storage from 1.40.2 to 1.41.0
- Bump github.com/docker/docker
- add completion command to generate shell completion scripts
- Remove cgo_pthread_ordering_workaround.go
- Update c/image
- Stop calling gpgme-config
- shell completion: add Makefile target
- shell completion: add install instructions docs
- shell completion: add completion for transports names
- [CI:DOCS] Pin actions to a full length commit SHA
- Updated skopeo logo with new artwork
- Update to gopkg.in/yaml.v3 v3.0.0
- fix make completions for all POSIX shells
- Update to github.com/opencontainers/runc >= 1.1.2
- Cirrus: use Ubuntu 22.04 LTS
- Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5
- Bump github.com/stretchr/testify from 1.7.1 to 1.7.2
- Bump github.com/docker/docker
- Update go.mod to Go 1.17
- Use testing.T.Setenv instead of os.Setenv in tests
- Change a repo used for sync tests
- Use an updated CI image
- Update for docker/distribution CLI change
- Enable schema1 support on the test registries
- CoPR: Autobuild rpm on rhcontainerbot/podman-next
- [CI:DOCS] Makefile: include cautionary note for rpm target
- [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting
- Bump github.com/spf13/cobra from 1.4.0 to 1.5.0
- Bump github.com/stretchr/testify from 1.7.2 to 1.7.4
- Bump github.com/stretchr/testify from 1.7.4 to 1.7.5
- Cirrus: Migrate multiarch build off github actions
- Update & fix skopeo multiarch image Containerfiles
- Use bytes.ReplaceAll instead of bytes.Replace(..., -1)
- Update IRC information
- Bump github.com/stretchr/testify from 1.7.5 to 1.8.0
- Introduce noteCloseFailure, use it for reporting of cleanup errors
- Modify error messages on failures to close
- Remove uses of pkg/errors
- Use errors.As() instead of direct type checks
- Vendor unreleased c/image with OCI artifact support
- Revert "Change a repo used for sync tests"
- Vendor in c/image with sigstore support
- Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync)
- Update for the renames of sigstore to lookaside
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
If a passphrase is not provided, prompt for one.
Outstanding:
- Should have integration tests.
- The signing options shared between copy and sync should live in utils.go.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... to be a bit more robust against unexpected error wrapping.
Also be a little more idiomatic on the sync error handling path.
Should not change behavior, assuming the previous code was correct.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This is clearly safe because the changes are
mostly top-level CLI where nothing is checking
the type of the error.
Even in that case, use %w for idiomatic consistency
(and to make it easier to possibly move some code into a Go library.)
Mostly mechanical, but note the changes to error handling of .Close():
we use %w for the primary error, not for the close error.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Use a wrapping wording similar to c/image; it's slightly
awkward at the start of the error message, but those should
hopefully be rare.
- Notably, distinguish the three failure paths in (skopeo layers).
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Note that this is a behavior change: we used to do
retErr = errors.Wrapf(retErr, ..., closeErr)
which doesn't record closeErr if retErr was nil.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
These changes substantially mirror similar updates made recently to both
podman and buildah. Besides renaming `Dockerfile` -> `Containerfile`,
there are much needed updates to docs, and the build instructions.
Signed-off-by: Chris Evich <cevich@redhat.com>
The github actions workflow for this operation is complex and difficult
to maintain. For several months now a replacement has been running well
in the podman repository. It's scripts/components are centralized,
versioned, unit, and integration tested. Add cirrus tasks to run the
build, and another task to allow test builds in a PR.
This also adds support for a new magic CI string: `[CI:BUILD]`.
With this string in the PR title, automation will only do basic build
verification, and enable testing of the multi-arch build process.
Otherwise, many tasks were updated to not be created when running the
cirrus-cron multi-arch image builds, since this would simply be a waste
of time and invitation for flakes.
Lastly, since only native tooling is used in the new build process,
rename all the recipes to `Containerfile`.
Signed-off-by: Chris Evich <cevich@redhat.com>
For whatever reason, the comment rearrangement is
required for vim rpm synatx highlighting to work.
Also added a comment pointing out where additional comments
should go. :)
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
The new file `skopeo.spec.rpkg` along with a webhook will automatically
build rpms on every PR merge on the main branch.
Run `rpkg local` or `make rpm` to generate the rpm.
Known issue: Doesn't yet build for EL8 environments.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
We expect schema1 images to work. Also, docker/distribution
doesn't provide useful errors for rejected schema1 images
( https://github.com/distribution/distribution/issues/2925 ),
which makes it impractical for Skopeo to automatically convert
schema1 to schema2.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The k8s.gcr.io/coredns/coredns repo now contains an OCI
artifact, which we can't copy; so, use a different
repo to test syncing.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... to silence Dependabot alerts about CVE-2022-29162 = GHSA-f3fp-gc8g-vw66.
Note that the vulnerable code is not actually included in Skopeo at all,
this is purely to silence imprecise vulnerability checkers.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The {a,b} syntax is not POSIX compatible. The Makefile should run with
all POSIX shells so we cannot use shell specific features like this.
Fixes#1657
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
... to include a fix for CVE-2022-28948 = GHSA-hp87-p4gw-j4gq .
Note that the package is only used for Skopeo's tests, so
Skopeo's users can't reach the vulnerable code.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Make sure skopeo copy/inspect/delete show the transport names when shell
completion is used to not regress compared to the old bash completion
script.
In theory I would highly recommend to set completion functions for
every flag and command. This can be ensured with a test like this:
https://github.com/containers/podman/blob/main/cmd/podman/shell_completion_test.go
But this is a lot of work to get right and I am neither a skopeo user or
maintainer so I am missing a lot of context for most options. I think
this would be better handled by a person who knows skopeo better.
Normally options should either use AutocompleteNone() or
AutocompleteDefault() from c/common/pkg/completion.
Even better would be to add custom completion functions for arguments
that only accept fixed values, see AutocompleteSupportedTransports() in
this commit.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
As of the just-updated github.com/proglottis/gpgme 0.1.2,
the gpgme subpackage uses CGo's native #cgo pkg-config support
to find the relevant libraries, and we no longer need to manually set
CGO_CFLAGS and CGO_LDFLAGS. So stop doing that.
Note that the proglottis/gpgme update (implied by vendoring c/image)
means the minimal supported version of GPGME is 1.13.0.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Use the cobra lib to automatically generate shell completion scripts.
We can use the completion command which is automatically added, since it
is not importent for most users we hide it.
To test the new script on bash you can use `source <(bin/skopeo completion bash)`
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
On FreeBSD, bash lives in /usr/local/bin/bash. These scripts don't
really depend on bash so could be changed to /bin/sh.
Signed-off-by: Doug Rabson <dfr@rabson.org>
Mostly just name changes that should not change behavior, apart
from ioutil.ReadDir -> os.ReadDir avoiding per-item lstat(2) in
one case.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This enables pushing to registries where the push and pull uris may be
different, for example where pushed images are mirrored to a read only
replica for distribution.
Closes#1588
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
skopeo list-tags docker-archive:... is now available.
- Improve a comment in the 010-inspect.bats test
- do not recommend upgrading all packages
- Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0
- Update github.com/containerd/containerd
- Bump github.com/docker/docker
- Bump github.com/spf13/cobra from 1.3.0 to 1.4.0
- Add support for docker-archive: to skopeo list-tags
- Rename "self" receiver
- Remove assignments to an unused variable
- Add various missing error handling
- Simplify the proxy server a bit
- Bump github.com/stretchr/testify from 1.7.0 to 1.7.1
- Use assert.ErrorContains
- Update to Go 1.14 and revendor
- Use check.C.MkDir() instead of manual ioutil.TempDir() calls
- Formally record that we require Go 1.15
- Update the command to install golint
- Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3
- Bump github.com/docker/docker
- Bump github.com/containers/storage from 1.38.2 to 1.39.0
- Bump github.com/containers/common from 0.47.4 to 0.47.5
- Bump github.com/prometheus/client_golang to v1.11.1
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Resolves: CVE-2022-21698
Skopeo isn't actually impacted by the CVE unless a Prometheus listener
is set up, which is not a part of Skopeo's default behavior.
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Actually add a DESCRIPTION heading.
Warn about deleting by digest - it affects an unknown set of tags.
Warn about deleting by tag - it currently works by the resolved digest.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
We already do in practice:
> vendor/golang.org/x/net/http2/transport.go:417:45: undefined: os.ErrDeadlineExceeded
so make that official.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This saves us at least 2 lines (error check, and cleanup) on every
instance, or in some cases adds cleanup that we forgot.
This is inspired by, but not directly related to, Go 1.15's addition of
Testing.T.TempDir.
NOTE: This might significantly increase the tests' disk space requirements;
AFAICS the temporary directories are only cleaned up when a whole "suite
finishes running.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Move JSON parsing into the request processing handler
so that we can consolidate the two instances of the response sending code.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... as found by (golangci-lint run).
Note: this does not add (golangci-lint run) to the Makefile
to ensure the coding standard.
(BTW golangci-lint currently fails on structcheck, which doesn't
handle embedded structs, and that's a years-long known unfixed
limitation.)
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
> receiver name should be a reflection of its identity; don't use generic names such as "this" or "self" (ST1006)
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The command to install skopeo for Ubuntu 20.04 includes a forced upgrade step for all packages.
Installing skopeo does not require the upgrade step, and it could lead to possible issues completely unrelated to the project.
Signed-off-by: Werner Robitza <werner.robitza@gmail.com>
Mainly this is to confirm some changes needed for the podman-py CI
setup don't disrupt operations here. Ref:
https://github.com/containers/automation_images/pull/111
Note: Glibc resolver configuration has changed from previous images. An
additional setup command was added to remove systemd-resolved from the
chain.
Signed-off-by: Chris Evich <cevich@redhat.com>
Highlights:
- A new sif: transport
- New options --multi-arch, --preserve-digests, --sign-passphrase-file
- Use a dynamic temp dir for test
- Add an option to allow copying image indexes alone
- proxy: Add a GetFullConfig method
- proxy: Also bump compatible semver
- Add option to preserve digests on copy
- Run codespell on code
- prompt-less signing via passphrase file
- add a SIF systemtest
- Merge pull request #1550 from vrothberg/sif-test
- Improve the documentation of the argument to (skopeo inspect)
- Document where various fields of (skopeo inspect) come from
- Improve the documentation of boolean flags
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The Go behavior of boolean flags is as follows:
Accepted values are --flag, which is the same as --flag=true, and --flag=false,
which is the default (except for OptionalBoolFlag).
--flag {false,true} is parsed as --flag=true with a non-option {false,true} argument.
So, for almost all flags, document them just as --flag, not
mentioning the [={false,true}] part, because users can just
omit =true, or the whole flag instead of =false.
OTOH, for tls-verify, document only the tls-verify={true,false}
variant, because the primary use is tls-verify=false, and because
tls-verify is not "the default", but equivalent to an explicit
tls-verify=true (overriding registries.conf).
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
To support signing images without prompting the user, add CLI flags for
providing a passphrase file.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
> go get github.com/containerd/containerd@latest
> make vendor
... because 1.5.9 contains a vulnerability fix, and we
want to silence scanners.
NOTE: Skopeo DOES NOT use the vulnerable code that
was fixed in containerd 1.5.9, so it is NOT vulnerable to
GHSA-mvff-h3cj-wj9c .
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
> go get github.com/opencontainers/image-spec@a5463b7f9c8451553af3adcba2cab538469df00c
> make vendor
Primarily we want to use a 1.0.3-0... version rather than 1.0.2-0..., so that
dependencies on 1.0.2 don't cause Skopeo to use 1.0.2 instead of
the later main-branch code.
Go has some logic to prevent using pseudo-version that don't follow
a released version (which is the case here, where 1.0.2 is on a branch,
and we want to use a main-branch commit instead); luckily some later
PRs on the main branch include the full contents of the 1.0.2 branch.
So, update a bit further along the main branch.
This particular commit corresponds to the choice in
https://github.com/containers/image/pull/1433 .
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... to silence warnings about CVE-2021-43784
/ GHSA-v95c-p5hm-xq8f .
NOTE: The vulnerable code was not used in this package,
so Skopeo is has not been vulnerable to this issue.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Sadly...I swear I had tested this at one point, but it was
*definitely* not the intention that we just return the container
runtime configuration.
I need a method to return the full image configuration. At some point
I must have accidentally added a redundant `.Config`.
This whole new method `GetFullConfig` is like `GetConfig` but
returns the whole image configuration. A specific motivation
here is that it's only in the image configuration that we can
stick arbitrary metadata (labels) that will survive a round trip through
docker schema v2.
just to keep various dependency checkers happy.
> go get github.com/containerd/containerd@v1.5.8
NOTE: This is NOT a fix for CVE-2021-41190 / GHSA-77vh-xpmg-72qh ,
that was fixed in Skopeo 1.5.2.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... to a version past 1.0.2, just to keep various
dependency checkers happy.
> go get github.com/opencontainers/image-spec@v1.0.2-0.20211123152302-43a7dee1ec31
The commit is intended to match https://github.com/containers/image/pull/1419
to minimize churn.
NOTE: This is NOT a fix for CVE-2021-41190 / GHSA-77vh-xpmg-72qh ,
that was fixed in Skopeo 1.5.2.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The new --multi-arch option allows the user to select between copying the
image associated with the system platform, all images in the index, or
just the index itself without attempting to copy the images.
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
This test was incorrectly assuming that nothing would be made on disk,
but it was putting files into the source directory.
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
Includes a fix for CVE-2021-41190 / GHSA-77vh-xpmg-72qh .
- use fedora:latest in contrib/skopeoimage/*/Dockerfile
- Fix test bug that prevented useful diagnostics on registry fail
- proxy: Add an API to fetch the config upconverted to OCI
- proxy: Add support for manifest lists
- proxy: Uncapitalize all errors
- Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10
- Update to c/image v5.17.0
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The Fedora 35 cloud images have switched to UEFI boot with a GPT
partition. Formerly, all Fedora images included support for runtime
re-partitioning. However, the requirement to test alternate storage
has since been dropped/removed. Rather than maintain a disused
feature, and supporting scripts, these Fedora VM images have reverted
to the default: Automatically resize to 100% on boot.
Signed-off-by: Chris Evich <cevich@redhat.com>
To fix compilation on MacOS.
I think actually we want to use this pervasively in our tests
on Linux; it doesn't really matter when run inside a transient
container, but `PDEATHSIG` is useful for persistent containers (e.g.)
toolbox and when running outside of a pid namespace, e.g. on a host
system shell directly or in systemd.
Signed-off-by: Colin Walters <walters@verbum.org>
We need to support manifest lists. I'm not sure how I missed this
originally. At least now we have integration tests that cover this.
The issue here is fairly subtle - the way c/image works right now,
`image.FromUnparsedImage` does pick a matching image from a list
by default. But it also overrides `GetManifest()` to return the
original manifest list, which defeats our goal here.
Handle this by adding explicit manifest list support code. We'll
want this anyways for future support for `GetRawManifest` or so
which exposes OCI manifest lists to the client.
Signed-off-by: Colin Walters <walters@verbum.org>
I debated adding "reverse dependency testing" using
https://crates.io/crates/containers-image-proxy
but I think it's easier to reuse the test infrastructure here.
This also starts fleshing out a Go client for the proxy (not
that this is going to be something most Go projects would want
versus vendoring c/image...but hey, maybe it'll be useful).
Now what I hit in trying to use the main test images is currently
the proxy fails on manifest lists, so I'll need to fix that.
Signed-off-by: Colin Walters <walters@verbum.org>
While the caller could fetch this today as a blob, it'd be in
either docker or oci schema. In keeping with the model of having
this proxy only expose OCI, add an API which uses the c/image logic
to do the conversion.
This is necessary for callers to get the diffIDs, and in general
to implement something like an external `skopeo copy`.
Signed-off-by: Colin Walters <walters@verbum.org>
Sigh. 'expr 1 - 1' yields 0 (correctly) but also exits 1. This
is even documented in the man page, but I didn't know it. And
thus, on the final iteration, when timeout reached 0, BATS
errored out on the expr instead of continuing to the 'podman logs'
or the 'die' message.
Solution is super trivial: use $(( ... )) instead of expr.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Surprisingly, the spf13/cobra CLI parsing logic, when presented
with an unknown subcommand outputs usage to stdout
and *exits successfully*.
This is bad for both users and scripts. Cargo cult some code
I found in podman to handle this.
Motivated by https://github.com/containers/containers-image-proxy-rs/pull/1
Signed-off-by: Colin Walters <walters@verbum.org>
This ensures layers are not uploaded that already exist on the
destination registry, in exchange for streaming layers to temporary
files when digests are unknown (ex. compressing "on the fly").
Signed-off-by: Paul Fisher <pfisher@lyft.com>
Following the discussion in #1478, we don't want to provide
(and maintain) static binaries, but giving instructions to
produce such builds (with appropriate warnings around these
instructions) was considered acceptable, so - here we go!
This imports the code from https://github.com/cgwalters/container-image-proxy
First, assume one is operating on a codebase that isn't Go, but wants
to interact with container images - we can't just include the Go containers/image
library.
The primary intended use case of this is for things like
[ostree-containers](https://github.com/ostreedev/ostree-rs-ext/issues/18)
where we're using container images to encapsulate host operating system
updates, but we don't want to involve the [containers/image](github.com/containers/image/)
storage layer.
Vendoring the containers/image stack in another project is a large lift; the stripped
binary for this proxy standalone weighs in at 16M (I'm sure the lack
of LTO and the overall simplicity of the Go compiler is a large factor).
Anyways, I'd like to avoid shipping another copy.
This command is marked as experimental, and hidden. The goal is
just to use it from the ostree stack for now, ideally shipping at least
in CentOS 9 Stream relatively soon. We can (and IMO should)
change and improve it later.
A lot more discussion in https://github.com/cgwalters/container-image-proxy/issues/1
By default skopeo checks to see if the user actually uses one of the
--*tls-verify flags. Their initial value is ignored. Setting the
initial value to false causes Cobra to not display the default value on
the screen when the user runs a `skopeo --help` command.
If the user does not specify a --*tls-verify option, it falls back to
using the value specified in the registries.conf file.
Fixes: https://github.com/containers/skopeo/issues/1383
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Go 1.17 introduces a much more reasonable build constraint format, and gofmt now fails without using it.
Sadly we still need the old format as well, to support <1.17 builds.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Dependabot was apparently not picking these up (and
several haven't had a release for a long time anyway).
Also move from github.com/go-check/check to its newly
declared (and go.mod-enforced) name gopkg.in/check.v1.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
the 'signing' test is flaking; symptom is that we can never
connect to the port on the registry:
https://api.cirrus-ci.com/v1/task/6208385738604544/logs/system.log
By all indications, the registry is up, i.e., the 'podman rm -f reg'
in teardown() succeeds, as shown by the 53c (CID) in the log. (It
bothers me that the FAIL message from die() does not appear in the
log, and I can't figure out why).
To try to diagnose this, run 'podman logs' on the registry upon
failure.
Signed-off-by: Ed Santiago <santiago@redhat.com>
In order to meet achievable deadlines converting from Travis to Cirrus
CI, one significant artifact was carried forward (instead of fixing):
Depending on a `--privileged` container to execute all/most automated
checks/tests.
Prior attempts to remove this aspect resulted in several test failures.
Fixing the problems was viewed as more time-consuming than simply
preserving this runtime environment.
Time has passed, and the code has since moved on. This commit removes
the legacy need to execute CI operations in a `--privileged`
container, instead running them directly on the host. At the same time,
the necessary test binaries are obtained from the same container used
for development/local testing purposes. This ensures the two
experiences are virtually always identical.
Signed-off-by: Chris Evich <cevich@redhat.com>
The Cirrus-CI configuration for this repository is setup to execute test
builds on certain important release branches. There is no built-in way
to monitor these for success or failure. This commit adds a
Github-Actions Workflow to e-mail the podman-monitor list if any fail.
Otherwise it will take no action if everything is successful.
Note: This duplicates 99.999% of the same YAML used for the Buildah
repository. The only changes were for the settings URL and
mentioning "skopeo" in a comment. A similar workflow is also in use
on the Podman repository.
Signed-off-by: Chris Evich <cevich@redhat.com>
We now synchronize the behavior with Podman and accept repositories
during login and logout per default.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
... so that we terminate with the full context and pointing at
the relevant code, instead of relying
on the overall test suite timeout.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Differentiate, again, between (skopeo --tls-verify subcommand)
and (skope subcommand --tls-verify), by
- using a "local" Corba flag for the (skopeo --tls-verify ...) variant
- adding separate --tls-verify flags to subcommands that only accept
them as legacy, available through deprecatedTLSVerifyFlags
(unlike the non-legacy path of dockerImageFlags());
- using TraverseChildren: true; this causes the global and
per-subcommand flags to be treated separately by Corba,
i.e. they no longer happen to share the "Hidden" flag
and Corba actually sets the right flag variable now.
So, we can now warn on (skopeo --tls-verify command) again,
and --help lists the flag correctly (it is hidden at the
global level, and in subcommands like copy that deprecated it,
but visible in subcommands like inspect where it's not deprecated).
NOTE: This removes --tls-verify from (skopeo manifest-digest) and
the three signing commands; it never made sense there. This change
could, in principle, break some users.
Also update man pages to match.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
It will get bigger, and we will also want to test imageDestOptions
for extra confidence.
Only moves the code, should not change (test) behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The current implementation can actually contact the registry (if
logout fails with "not logged in" but there are .docker/config.json
credentials present), so provide a non-deprecated way to disable TLS.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
The necessary images have been manually copied over to quay. Code was
updated with centralized constants for the utilized images. Tests then
all reference the constants (in case the image locations need to change
again).
Signed-off-by: Chris Evich <cevich@redhat.com>
This is the script that runs 'skopeo COMMAND --help' and
cross-checks that all the option flags are documented
in man pages, and vice-versa (all options listed in man
pages appear in COMMAND's --help message).
Copied from podman, with changes for skopeo-land (removing
the rst checks, and conforming to skopeo conventions).
Signed-off-by: Ed Santiago <santiago@redhat.com>
This duplicates the change from
https://github.com/containers/buildah/pull/3385
Since this workflow is duplicated across three repositories, maintaining
changes becomes onerous if the item contents vary between
implementations in any way. Improve this situation by encoding the
repository-specific details into env. vars. then referencing those vars
throughout. This way, a meaningful diff can be worked with to compare
the contents across repositories.
Also included are abstractions for the specific command used to obtain
the project version, and needed details for filtering the output. Both
of these vary across the Buildah, Skopeo, and Podman repos.
NOTE: This change requires the names of two github action secrets
to be updated: SKOPEO_QUAY_USERNAME -> REPONAME_QUAY_USERNAME
(and *PASSWORD).
Signed-off-by: Chris Evich <cevich@redhat.com>
... because our unit tests use createApp, so the current
main()-only edit is not visible to unit tests.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Add new script, hack/man-page-checker, copied from podman. Run it
in 'make validate-local' target.
This is NOT the checker requested in #1332 (verify that flags
listed in 'skopeo foo --help' are documented in man pages and
vice-versa). This is a much simpler script that merely looks
for very basic typos or discrepancies between skopeo.1.md
and skopeo-foo.1.md.
The next part (cross-checking flags) is in progress but will
require a huge number of changes to the man pages. I'm submitting
this now because it's easy to review.
Signed-off-by: Ed Santiago <santiago@redhat.com>
This partially reverts commit a81cd74734
so that most path variables like PREFIX and BINDIR refer to paths on
the installed system, and DESTDIR is used only in (make install), following
the philosophy of the GNU coding standards for path variables. (But not precisely
the variable names, which are lowercase in the standard, nor the principle that
even SYSCONFDIR should be under $PREFIX.
Keep the use of ?= instead of = because it somewhat better expresses the idea
that the values can be overridden.
Use ${DESTDIR}${BINDIR} instead of ${DESTDIR}/${BINDIR} etc, so that a plain
(make install) does not use paths like //usr/bin/... ; strictly speaking they
are IIRC reserved by POSIX, and more importantly it just looks untidy :)
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Normally it's a best-practice to only use short-names in Dockerfiles.
However, this image is really only ever used for testing/CI purposes.
Side-step the docker hub rate limits entirely by simply hard-coding the
FQIN and hope that's also "okay" for non-CI usage.
Signed-off-by: Chris Evich <cevich@redhat.com>
Bump up the global timeout due to some (possibly) temporary failures in
the 'cross' task. Also fix build-failure in Dockerfile related to use
of pre-module golang packages.
Signed-off-by: Chris Evich <cevich@redhat.com>
This was copy-pasted from buildah and podman, unfortunately the
Dockerfile entrypoint is different for skopeo. Fix it.
Signed-off-by: Chris Evich <cevich@redhat.com>
- Bugfix `make nixpkgs` which pin with branch `nixos-21.05`
- Code lint with `nixpkgs-fmt`
- Code sync between x86\_64 and aarch64
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
Github checks the `workflows` sub-directory for github actions workflow
files. Since it was called `workflow`, nothing was running. Fix this
by renaming the directory.
Signed-off-by: Chris Evich <cevich@redhat.com>
This is a port from the podman and buildah repository workflows.
It's purpose is to build and push multi-arch images containing the
latest upstream, testing, and stable versions of skopeo. It fully
replaces the last remaining use of Travis in this repo, for
substantially the same purpose.
In a future commit, I intend to de-duplicate this workflow from
podman and buildah, such that all three share a common set of details.
Until then, any changes will need to be manually duplicated across
all three repos.
Signed-off-by: Chris Evich <cevich@redhat.com>
This commit removes installation steps for older distros:
1. Amazon Linux 2
2. CentOS 7
3. Debian 10
4. Raspbian 10
5. Raspberry Pi OS armhf
We're no longer building new packages for these distros and the
installation steps for older packages are no longer guaranteed to work.
So, these are best removed from the official docs.
Related blog post (also applies to skopeo):
https://podman.io/blogs/2021/03/02/podman-support-for-older-distros.html
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
The `test_skopeo_task` must be substantially duplicated between this
repository and containers/image. Make this easier to maintain by
implementing a runner script to contain any/all differences. This
allows the `test_skopeo_task` definition to remain 100%
identical across the two repositories.
Signed-off-by: Chris Evich <cevich@redhat.com>
In 18e6c6f17b there where changes to
better handle PREFIX and DESTDIR in the Makefile. "CONTAINERSCONFIGDIR"
was renamed to "CONTAINERSCONFDIR" without ensuring it was correct in
the install block. This results in policy.json being isntalled into
"${DESTDIR}/" which is "/policy.json" for Linux distros.
Signed-off-by: Morten Linderud <morten@linderud.pw>
This won't be useful unless/until there are `.cirrus.yml` tasks which
actually utilize VMs. Once there are, or to support their development,
this script may be helpful.
Signed-off-by: Chris Evich <cevich@redhat.com>
- Bugfix `make nixpkgs` which pin with branch `nixos-20.09`
- Code lint with `nixpkgs-fmt`
- Code sync between x86\_64 and aarch64
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
The Skopeo images set `REGISTRY_AUTH_FILE=/auth.json` which is breaking
non-root users inside the container from logging in (`/` is writable by
root only). Setting it to `/tmp/auth.json` will support running
non-root users inside the container.
Fixes: #1233
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
This updates the indirect dependency we have on dsnet/compress (via
opencontainer/image-tools) to the latest master commit, which includes
an update to a non-vulnerable version of xz.
Without this env. var. being set from hack/make.sh, many/most
integration tests will `SKIP`. Fix this by notifying the user
and setting the magic `SKOPEO_CONTAINER_TESTS` variable.
Signed-off-by: Chris Evich <cevich@redhat.com>
These tests need to operate as part of the c/image repository CI to
verify downstream-usage. That environment is already inside the
container built from the Dockerfile (here). Support this use-case by
adding 'local' targets which bypass the container build. Also,
simplify the "in-container" check to more specifically verify the exact
container image it's operating under.
Signed-off-by: Chris Evich <cevich@redhat.com>
The quay.io/skopeo/testing:latest image was showing v1.2.0 for a version when it
should have been showing at least v1.2.1. The issue was the Fedora tag in the
Dockerfiles used to build the images was set to 32 and not the later 33.
Addresses: #1204
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
By popular demand, add the stale bot which we'are already using at
Podman. The bot will remind us every 30 days of inactivity on specific
issues or pull requests and has turned into a useful tool to keep things
on the radar.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
When copying to an OCI layout destination, forcing zstd compression,
check that the manifest correctly describes the type of the layer blob.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Prior to this, the User-Agent used by containers/image would default to
the default User-Agent for golang, which makes it difficult to
distinguish skopeo from any other golang binaries in registry logs.
Signed-off-by: Jon Johnson <jonjohnson@google.com>
Switch to using images from quay.io/libpod instead, where
we're not (yet) subject to rate limiting.
Completely rewrite one unclear test. The purpose of the
test was to test #708, in which 'skopeo inspect --raw'
was fixed to be able to inspect images that do not
match the current host's os+arch. We now use a fixed
test image on quay.io, generated by a new script,
whose manifest is pretty unlikely to match our host.
Signed-off-by: Ed Santiago <santiago@redhat.com>
PREFIX should default to /usr/local according to GNU coding standards.
DESTDIR should just be used for install
This will allow us to specify
make PREFIX=/usr DESTDIR=/tmp/build/ install
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Do repository synchronization tests using k8s.gcr.io/pause and
k8s.gcr.io/coredns/coredns instead of docker.io/alpine.
The k8s.gcr.io/pause repository includes multiple tags, at least one of
which is a single image ("1.0"), and at least one of which is a manifest
list ("3.2", "3.3"), and includes a "latest" tag.
The k8s.gcr.io/coredns/coredns repository includes multiple tags, at
least one of which is a single image ("v1.6.6"), and at least one of which
is a manifest list ("v1.8.0").
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Switch most of our tests that exercise reading, copying from, and
inspecting tags that point to manifest lists from using
docker.io/estesp/busybox to using
registry.fedoraproject.org/fedora-minimal, which doesn't limit how often
we can pull the images.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
We are preparing for RHEL 8.4 release and want to make
sure all container tools have the same containers suppackages.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Pass down the creds from yaml file only if the values are not empty.
Enables to use credentials from other authfiles alternatively.
Signed-off-by: Qi Wang <qiwan@redhat.com>
Homebrew:
> Warning: You are using macOS 10.13.
> We (and Apple) do not provide support for this old version.
> You will encounter build failures with some formulae.
So, update to the 10.14 major version, fully-updated.
Also remove the Xcode update attempt, it was added before
Homebrew was warning about the Xcode version, but updating only
after running Homebrew does not help, and anyway it does not
complain anymore after the update.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Also update to the correct one information about required env variables
for multi-arch build
Signed-off-by: Yulia Gaponenko <yulia.gaponenko1@de.ibm.com>
Service accounts (a.k.a. robots) in `quay.io` are forcably namespaced
to the user or orginization under which they are created. Therefore,
it is impossible to use a common login/password to push images for
both `skopeo` and `containers` namespaces. Worse, because the
authentication is recorded against `quay.io`, multiple login sessions
are required.
Fix this by adding a function definition which verifies non-empty
username/password arguments, before logging in. Call this function
as needed from relevant targets, prior to pushing images.
Signed-off-by: Chris Evich <cevich@redhat.com>
This replicates the --all copy flag to sync to perform the same
behavior. Namely, the default is CopySystemImage unless --all is passed
which changes the behavior to CopyAllImages. While it is probably
desirable for --all to be the default as there is no option to override
ones architecture with the sync command, --all can potentially break
existing sync incantations depending on registry support. Hence
CopySystemImage remains the default.
Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>
Travis is used, as it has native hardware to run the build for many
architectures (amd64, s390x, ppc64le). Docker is used as build and
manifest tool. `quay.io/skopeo/upstream:master`, `quay.io/skopeo/stable:v1.2.0`
and `quay.io/containers/skopeo:v1.2.0` are specified as target multi-arch
upstream image.
Travis config file has 3 stages:
- local-build to do the local test for linux/amd64 and osx, as it was in
the initial code
- image-build-push to build and push images for specific architectures
(amd64, s390x, ppc64le)
- manifest-multiarch-push to create and push manifest for multi-arch
image - `quay.io/skopeo/upstream:master`, `quay.io/skopeo/stable:v1.2.0`
and `quay.io/containers/skopeo:v1.2.0`
last stage amnd image push step are not done for pull request.
2 env variables specified in Travis settings are expected - QUAY_USERNAME and
QUAY_PASSWORD to push the images to quay.io.
As a result multi-arch images for 3 architectures are published.
README about build setup id prepared
Signed-off-by: Yulia Gaponenko <yulia.gaponenko1@de.ibm.com>
For yet unknown reasons, Travis throws permission errors when trying to
recursively list the contents of a temp directory. It passes locally,
so disable the logs to unblock CI. Note, the reasons for the error are
yet to be revealed.
Related-issue: https://github.com/containers/skopeo/issues/1093
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
We now use the osusergo build tag to not use the glibc functions which
occur in the warnings but them from golang the os/user package.
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
By default we should build bin/skopeo locally
and build docs locally.
Show output when doing make docs.
Add description in `make help` to explain default
behaviour.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Go 1.15 deprecates checking CN; this broke gating tests:
Get "https://localhost:5000/v2/": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
Easy two-line solution in the 'openssl' invocation. Huge
thanks to Nalin for tracking down and fixing while I was
still getting started:
https://github.com/containers/buildah/pull/2595
Copied from 0f2892a5b021de3b1cf273f5679fda8298b57c02 in buildah
Signed-off-by: Ed Santiago <santiago@redhat.com>
Add a make target that cross-compiles for a handful of the possible
targets that `go tool dist list` can tell us about.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
... which no longer works after #932.
This does not add documentation for the current static build approach,
nor does it add any other place where DISABLE_CGO is documented;
both are not tested by CI, and discouraged due to bad integration
with the rest of the system.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
because that's what users are looking for, and instead of using
a containers-storage: source, which might not even work all that
well with all the automatic defaults Podman sets up.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Enables to retry skopeo inspect. Add `--retry-times` to set the number of times to retry. Use exponential backoff and 1s as default initial retry delay.
Signed-off-by: Qi Wang <qiwan@redhat.com>
... which are currently failing with
> Error: The `brew link` step did not complete successfully
> The formula built, but is not symlinked into /usr/local
> Could not symlink Frameworks/Python.framework/Headers
> Target /usr/local/Frameworks/Python.framework/Headers
> is a symlink belonging to python@2. You can unlink it:
> brew unlink python@2
because the Travis-installed machine apparently has quite a few
Homebrew formulae installed, with an old version of Homebrew,
including a now-removed python@2, and that prevents updates of
python@3.
Remove the obsolete motivation for running (brew update), and replace it
with a similarly-good motivation that the Travis images are just too old
to be relevant to users.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
registry:2 no longer contains htpasswd.
Also don't use log_and_run ... >> $file
because that will cause the command to be logged to $file.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Add `-y` options to yum clean all
Only delete below /var/cache/dnf so that I can use the
-v /var/cache/dnf:/var/cache/dnf:O option when building
to speed up builds.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Say that the regex is the cause, include it in the error message,
and don't continue as if the compilation succeeded.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... instead of manually parsing strings.
Should not change behavior, except maybe error messages if the
registry returns invalid tags.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This removes another string formatting use, and removes the
last recently introduced docker.Reference->reference.Named
redundancy.
Should not change behavior, apart from error messages.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Right now that only complicates code by going through a
types.ImageReference->reference.Named->types.ImageReference sequence,
but that will change as we modify the callers as well.
Should not change behavior.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
It is redundant, only used to form a tagged reference,
which can be done more safely using reference.WithTag.
Also move the *types.SystemContext parameter to the front,
as is usual.
Should not change behavior, apart from a few error messages.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
- Improve the language
- Be consistent with the previous example about a trailing slash
- Don't unnecessarily quote :, it is not a shell metacharacter.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Fields that magically change their behavior depending on type of the value
are too much hassle for no benefit.
For now, this just copies&pastes the full loop in imagesToCopyFromRegistry
to create another loop handling the new ImagesByTagRegex field. Simplifications
to reduce duplication will follow.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This PR adds the Dockerfiles necessary to create the upstream
and testing variants of the Skopeo container images that will
reside in quay.io/skopeo/upstream and quay.io/skopeo/testing
repositories. The only difference in the Dockerfile between
the stable and testing image is the option `--enablerepo updates-testing`
was added. The testing variant is relatively the same, but
I'd to clone and install Skopeo in the container.
I've also added a README.md which explains all of the varities
of images and includes some sample usage.
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Adds the Dockerfile for building the Skopeo container
image on quay.io. Once merged, this image will be
built automatically upon any merge into the master
branch. The images will live at:
quay.io/containers/skopeo:latest
quay.io/skopeo/stable:latest
I've built an image using this Dockerfile and have pushed
it to both repositories if you want to play with that.
Once merged, I'll create similar Dockerfiles for
quay.io/skopeo/testing and quay.io/skopeo/upstream.
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Only bumps the version number after the recent vendoring
from master, but Dependabot seems to be confused by that;
so, update to the final release to hopefully un-confuse it.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This is an unreleased version of c/image, but it is important to
to have the test added in in the next commit enforcing as soon as
possible.
> go get github.com/containers/image/v5@HEAD
> make vendor
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Use cobra in skopeo can help share code with podman/buildah(code for skopeo login/logout CLI).
(libpod issue #839)
Signed-off-by: Qi Wang <qiwan@redhat.com>
@@ -117,37 +117,39 @@ commit automatically with `git commit -s`.
### Dependencies management
Make sure [`vndr`](https://github.com/LK4D4/vndr) is installed.
Dependencies are managed via [standard go modules](https://golang.org/ref/mod).
In order to add a new dependency to this project:
-add a new line to `vendor.conf`according to `vndr` rules (e.g. `github.com/pkg/errors master`)
-use `go get -d path/to/dep@version`to add a new line to `go.mod`
- run `make vendor`
In order to update an existing dependency:
- update the relevant dependency line in `vendor.conf`
- use `go get -d -u path/to/dep@version` to update the relevant dependency line in `go.mod`
- run `make vendor`
When new PRs for [containers/image](https://github.com/containers/image) break `skopeo` (i.e. `containers/image` tests fail in `make test-skopeo`):
- create out a new branch in your `skopeo` checkout and switch to it
-update `vendor.conf`. Find out the `containers/image`dependency; update it to vendor from your own branch and your own repository fork (e.g. `github.com/containers/image my-branch https://github.com/runcom/image`)
-find out the version of `containers/image`you want to use and note its commit ID. You might also want to use a fork of `containers/image`, in that case note its repo
- use `go get -d github.com/$REPO/image/v5@$COMMIT_ID` to download the right version. The command will fetch the dependency and then fail because of a conflict in `go.mod`, this is expected. Note the pseudo-version (eg. `v5.13.1-0.20210707123201-50afbf0a326`)
- use `go mod edit -replace=github.com/containers/image/v5=github.com/$REPO/image/v5@$PSEUDO_VERSION` to add a replacement line to `go.mod` (e.g. `replace github.com/containers/image/v5 => github.com/moio/image/v5 v5.13.1-0.20210707123201-50afbf0a3262`)
- run `make vendor`
- make any other necessary changes in the skopeo repo (e.g. add other dependencies now requied by `containers/image`, or update skopeo for changed `containers/image` API)
- make any other necessary changes in the skopeo repo (e.g. add other dependencies now required by `containers/image`, or update skopeo for changed `containers/image` API)
- optionally add new integration tests to the skopeo repo
- submit the resulting branch as a skopeo PR, marked “DO NOT MERGE”
- iterate until tests pass and the PR is reviewed
- then the original `containers/image` PR can be merged, disregarding its `make test-skopeo` failure
- as soon as possible after that, in the skopeo PR, restore the `containers/image` line in `vendor.conf` to use `containers/image:master`
- as soon as possible after that, in the skopeo PR, use `go mod edit -dropreplace=github.com/containers/image` to remove the `replace` line in `go.mod`
- run `make vendor`
- update the skopeo PR with the result, drop the “DO NOT MERGE” marking
- after tests complete succcesfully again, merge the skopeo PR
- after tests complete successfully again, merge the skopeo PR
## Communications
For general questions, or discussions, please use the
IRC group on `irc.freenode.net` called `container-projects`
IRC channel on `irc.libera.chat` called `#container-projects`
that has been setup.
For discussions around issues/bugs and features, you can use the github
`skopeo` is a command line utility that performs various operations on container images and image repositories.
`skopeo` does not require the user to be running as root to do most of its operations.
`skopeo` does not require a daemon to be running to perform its operations.
`skopeo` can work with [OCI images](https://github.com/opencontainers/image-spec) as well as the original Docker v2 images.
Skopeo works with API V2 registries such as Docker registries, the Atomic registry, private registries, local directories and local OCI-layout directories. Skopeo does not require a daemon to be running to perform these operations which consist of:
Skopeo works with API V2 container image registries such as [docker.io](https://docker.io) and [quay.io](https://quay.io) registries, private registries, local directories and local OCI-layout directories. Skopeo can perform operations which consist of:
* Copying an image from and to various storage mechanisms.
For example you can copy images from one registry to another, without requiring privilege.
* Inspecting a remote image showing its properties including its layers, without requiring you to pull the image to the host.
* Deleting an image from an image repository.
* Syncing an external image repository to an internal registry for air-gapped deployments.
* When required by the repository, skopeo can pass the appropriate credentials and certificates for authentication.
Skopeo operates on the following image and repository types:
* containers-storage:docker-reference
An image located in a local containers/storage image store. Location and image store specified in /etc/containers/storage.conf
An image located in a local containers/storage image store. Both the location and image store are specified in /etc/containers/storage.conf. (This is the backend for [Podman](https://podman.io), [CRI-O](https://cri-o.io), [Buildah](https://buildah.io) and friends)
* dir:path
An existing local directory path storing the manifest, layer tarballs and signatures as individual files. This is a non-standardized format, primarily useful for debugging or noninvasive container inspection.
* docker://docker-reference
An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in $HOME/.docker/config.json, which is set e.g. using (docker login).
An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `skopeo login`.
* docker-archive:path[:docker-reference]
An image is stored in the`docker save`formated file. docker-reference is only used when creating such a file, and it must not contain a digest.
An image is stored in a`docker save`-formatted file. docker-reference is only used when creating such a file, and it must not contain a digest.
* docker-daemon:docker-reference
An image docker-reference stored in the docker daemon internal storage. docker-reference must contain either a tag or a digest. Alternatively, when reading images, the format can also be docker-daemon:algo:digest (an image ID).
@@ -37,138 +39,182 @@ Skopeo works with API V2 registries such as Docker registries, the Atomic regist
* oci:path:tag
An image tag in a directory compliant with "Open Container Image Layout Specification" at path.
Inspecting a repository
-
`skopeo` is able to _inspect_ a repository on a Docker registry and fetch images layers.
The _inspect_ command fetches the repository's manifest and it is able to show you a `docker inspect`-like
json output about a whole repository or a tag. This tool, in contrast to `docker inspect`, helps you gather useful information about
a repository or a tag before pulling it (using disk space). The inspect command can show you which tags are available for the given
repository, the labels the image has, the creation date and operating system of the image and more.
When interacting with private registries, `skopeo` first looks for `--creds` (for `skopeo inspect|delete`) or `--src-creds|--dest-creds` (for `skopeo copy`) flags. If those aren't provided, it looks for the Docker's cli config file (usually located at `$HOME/.docker/config.json`) to get the credentials needed to authenticate. The ultimate fallback, as Docker does, is to provide an empty authentication when interacting with those registries.
Examples:
```sh
$ cat /home/runcom/.docker/config.json
{
"auths": {
"myregistrydomain.com:5000": {
"auth": "dGVzdHVzZXI6dGVzdHBhc3N3b3Jk",
"email": "stuf@ex.cm"
}
}
}
# we can see I'm already authenticated via docker login so everything will be fine
`skopeo` can copy container images between various storage mechanisms, including:
* Container registries
- The Quay, Docker Hub, OpenShift, GCR, Artifactory ...
* Container Storage backends
- [github.com/containers/storage](https://github.com/containers/storage) (Backend for [Podman](https://podman.io), [CRI-O](https://cri-o.io), [Buildah](https://buildah.io) and friends)
$ skopeo sync --src docker --dest dir registry.example.com/busybox /media/usb
```
## Authenticating to a registry
#### Private registries with authentication
skopeo uses credentials from the --creds (for skopeo inspect|delete) or --src-creds|--dest-creds (for skopeo copy) flags, if set; otherwise it uses configuration set by skopeo login, podman login, buildah login, or docker login.
```console
$ skopeo login --username USER myregistrydomain.com:5000
## Security and Disclosure Information Policy for the skopeo Project
The skopeo Project follows the [Security and Disclosure Information Policy](https://github.com/containers/common/blob/main/SECURITY.md) for the Containers Projects.
flags.BoolVarP(&opts.quiet,"quiet","q",false,"Suppress output information when copying images")
flags.BoolVarP(&opts.all,"all","a",false,"Copy all images if SOURCE-IMAGE is a list")
flags.Var(commonFlag.NewOptionalStringValue(&opts.multiArch),"multi-arch",`How to handle multi-architecture images (system, all, or index-only)`)
flags.BoolVar(&opts.preserveDigests,"preserve-digests",false,"Preserve digests of images and lists")
flags.BoolVar(&opts.removeSignatures,"remove-signatures",false,"Do not copy signatures from SOURCE-IMAGE")
flags.StringVar(&opts.signByFingerprint,"sign-by","","Sign the image using a GPG key with the specified `FINGERPRINT`")
flags.StringVar(&opts.signBySigstoreParamFile,"sign-by-sigstore","","Sign the image using a sigstore parameter file at `PATH`")
flags.StringVar(&opts.signBySigstorePrivateKey,"sign-by-sigstore-private-key","","Sign the image using a sigstore private key at `PATH`")
flags.StringVar(&opts.signPassphraseFile,"sign-passphrase-file","","Read a passphrase for signing an image from `PATH`")
flags.StringVar(&opts.signIdentity,"sign-identity","","Identity of signed image, must be a fully specified docker reference. Defaults to the target docker reference.")
flags.StringVar(&opts.digestFile,"digestfile","","Write the digest of the pushed image to the specified file")
flags.VarP(commonFlag.NewOptionalStringValue(&opts.format),"format","f",`MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default is manifest type of source, with fallbacks)`)
flags.StringSliceVar(&opts.encryptionKeys,"encryption-key",[]string{},"*Experimental* key with the encryption protocol to use needed to encrypt the image (e.g. jwe:/path/to/key.pem)")
flags.IntSliceVar(&opts.encryptLayer,"encrypt-layer",[]int{},"*Experimental* the 0-indexed layer indices, with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer)")
flags.StringSliceVar(&opts.decryptionKeys,"decryption-key",[]string{},"*Experimental* key needed to decrypt the image")
returncmd
}
Supported transports:
%s
See skopeo(1) section "IMAGE NAMES" for the expected format
}// opts.signByFingerprint triggers a GPG-agent passphrase prompt, possibly using a more secure channel, so we usually shouldn’t prompt ourselves if no passphrase was explicitly provided.
returnfmt.Errorf("Unrecognized command `%[1]s %[2]s`\nTry '%[1]s --help' for more information",cmd.CommandPath(),args[0])
}
returnfmt.Errorf("Unrecognized command `%[1]s %[2]s`\n\nDid you mean this?\n\t%[3]s\n\nTry '%[1]s --help' for more information",cmd.CommandPath(),args[0],strings.Join(suggestions,"\n\t"))
}
returnfmt.Errorf("Missing command '%[1]s COMMAND'\nTry '%[1]s --help' for more information",cmd.CommandPath())
}
// createApp returns a cobra.Command, and the underlying globalOptions object, to be run or tested.
funccreateApp()(*cobra.Command,*globalOptions){
opts:=globalOptions{}
app:=cli.NewApp()
app.EnableBashCompletion=true
app.Name="skopeo"
rootCommand:=&cobra.Command{
Use:"skopeo",
Long:"Various operations with container images and container image registries",
RunE:requireSubcommand,
PersistentPreRunE:opts.before,
SilenceUsage:true,
SilenceErrors:true,
// Hide the completion command which is provided by cobra
rootCommand.PersistentFlags().StringVar(&opts.policyPath,"policy","","Path to a trust policy file")
rootCommand.PersistentFlags().BoolVar(&opts.insecurePolicy,"insecure-policy",false,"run the tool without any policy check")
rootCommand.PersistentFlags().StringVar(&opts.registriesDirPath,"registries.d","","use registry configuration files in `DIR` (e.g. for container signature storage)")
rootCommand.PersistentFlags().StringVar(&opts.overrideArch,"override-arch","","use `ARCH` instead of the architecture of the machine for choosing images")
rootCommand.PersistentFlags().StringVar(&opts.overrideOS,"override-os","","use `OS` instead of the running OS for choosing images")
rootCommand.PersistentFlags().StringVar(&opts.overrideVariant,"override-variant","","use `VARIANT` instead of the running architecture variant for choosing images")
rootCommand.PersistentFlags().DurationVar(&opts.commandTimeout,"command-timeout",0,"timeout for the command execution")
rootCommand.PersistentFlags().StringVar(&opts.registriesConfPath,"registries-conf","","path to the registries.conf file")
logrus.Fatal("unable to mark registries-conf flag as hidden")
}
app.Before=opts.before
app.Commands=[]cli.Command{
rootCommand.PersistentFlags().StringVar(&opts.tmpDir,"tmpdir","","directory used to store temporary files")
flag:=commonFlag.OptionalBoolFlag(rootCommand.Flags(),&opts.tlsVerify,"tls-verify","Require HTTPS and verify certificates when accessing the registry")
flag.Hidden=true
rootCommand.AddCommand(
copyCmd(&opts),
deleteCmd(&opts),
generateSigstoreKeyCmd(),
inspectCmd(&opts),
layersCmd(&opts),
tagsCmd(&opts),
loginCmd(&opts),
logoutCmd(&opts),
manifestDigestCmd(),
proxyCmd(&opts),
syncCmd(&opts),
standaloneSignCmd(),
standaloneVerifyCmd(),
syncCmd(&opts),
tagsCmd(&opts),
untrustedSignatureDumpCmd(),
}
returnapp,&opts
)
returnrootCommand,&opts
}
// before is run by the cli package for any command, before running the command-specific handler.
removeSignaturesbool// Do not copy signatures from the source image
signByFingerprintstring// Sign the image using a GPG key with the specified fingerprint
signBySigstoreParamFilestring// Sign the image using a sigstore signature per configuration in a param file
signBySigstorePrivateKeystring// Sign the image using a sigstore private key
signPassphraseFilestring// Path pointing to a passphrase file when signing
formatcommonFlag.OptionalString// Force conversion of the image to a specified format
sourcestring// Source repository name
destinationstring// Destination registry name
scopedbool// When true, namespace copied images at destination using the source repository name
allbool// Copy all of the images if an image in the source is a list
dryRunbool// Don't actually copy anything, just output what it would have done
preserveDigestsbool// Preserve digests during sync
keepGoingbool// Whether or not to abort the sync if there are any errors during syncing the images
appendSuffixstring// Suffix to append to destination image tag
}
// repoDescriptor contains information of a single repository used as a sync source.
typerepoDescriptorstruct{
DirBasePathstring// base path when source is 'dir'
TaggedImages[]types.ImageReference// List of tagged image found for the repository
Context*types.SystemContext// SystemContext for the sync command
DirBasePathstring// base path when source is 'dir'
ImageRefs[]types.ImageReference// List of tagged image found for the repository
Context*types.SystemContext// SystemContext for the sync command
}
// tlsVerify is an implementation of the Unmarshaler interface, used to
// tlsVerifyConfig is an implementation of the Unmarshaler interface, used to
// customize the unmarshaling behaviour of the tls-verify YAML key.
typetlsVerifyConfigstruct{
skiptypes.OptionalBool// skip TLS verification check (false by default)
@@ -50,78 +70,76 @@ type tlsVerifyConfig struct {
// registrySyncConfig contains information about a single registry, read from
// the source YAML file
typeregistrySyncConfigstruct{
Imagesmap[string][]string// Images map images name to slices with the images' tags
Credentialstypes.DockerAuthConfig// Username and password used to authenticate with the registry
TLSVerifytlsVerifyConfig`yaml:"tls-verify"`// TLS verification mode (enabled by default)
CertDirstring`yaml:"cert-dir"`// Path to the TLS certificates of the registry
Imagesmap[string][]string// Images map images name to slices with the images' references (tags, digests)
ImagesByTagRegexmap[string]string`yaml:"images-by-tag-regex"`// Images map images name to regular expression with the images' tags
ImagesBySemvermap[string]string`yaml:"images-by-semver"`// ImagesBySemver maps a repository to a semver constraint (e.g. '>=3.14') to match images' tags to
Credentialstypes.DockerAuthConfig// Username and password used to authenticate with the registry
TLSVerifytlsVerifyConfig`yaml:"tls-verify"`// TLS verification mode (enabled by default)
CertDirstring`yaml:"cert-dir"`// Path to the TLS certificates of the registry
}
// sourceConfig contains all registries information read from the source YAML file
Usage:"Do not copy signatures from SOURCE images",
Destination:&opts.removeSignatures,
},
cli.StringFlag{
Name:"sign-by",
Usage:"Sign the image using a GPG key with the specified `FINGERPRINT`",
Destination:&opts.signByFingerprint,
},
cli.StringFlag{
Name:"src, s",
Usage:"SOURCE transport type",
Destination:&opts.source,
},
cli.StringFlag{
Name:"dest, d",
Usage:"DESTINATION transport type",
Destination:&opts.destination,
},
cli.BoolFlag{
Name:"scoped",
Usage:"Images at DESTINATION are prefix using the full source image path as scope",
Destination:&opts.scoped,
},
},sharedFlags...),srcFlags...),destFlags...),
See skopeo-sync(1) for details.
`,
RunE:commandAction(opts.run),
Example:`skopeosync --src docker --dest dir --scoped registry.example.com/busybox /media/usb`,
}
adjustUsage(cmd)
flags:=cmd.Flags()
flags.BoolVar(&opts.removeSignatures,"remove-signatures",false,"Do not copy signatures from SOURCE images")
flags.StringVar(&opts.signByFingerprint,"sign-by","","Sign the image using a GPG key with the specified `FINGERPRINT`")
flags.StringVar(&opts.signBySigstoreParamFile,"sign-by-sigstore","","Sign the image using a sigstore parameter file at `PATH`")
flags.StringVar(&opts.signBySigstorePrivateKey,"sign-by-sigstore-private-key","","Sign the image using a sigstore private key at `PATH`")
flags.StringVar(&opts.signPassphraseFile,"sign-passphrase-file","","File that contains a passphrase for the --sign-by key")
flags.VarP(commonFlag.NewOptionalStringValue(&opts.format),"format","f",`MANIFEST TYPE (oci, v2s1, or v2s2) to use when syncing image(s) to a destination (default is manifest type of source, with fallbacks)`)
flags.StringVarP(&opts.source,"src","s","","SOURCE transport type")
flags.StringVarP(&opts.destination,"dest","d","","DESTINATION transport type")
flags.BoolVar(&opts.scoped,"scoped",false,"Images at DESTINATION are prefix using the full source image path as scope")
flags.StringVar(&opts.appendSuffix,"append-suffix","","String to append to DESTINATION tags")
flags.BoolVarP(&opts.all,"all","a",false,"Copy all images if SOURCE-IMAGE is a list")
flags.BoolVar(&opts.dryRun,"dry-run",false,"Run without actually copying data")
flags.BoolVar(&opts.preserveDigests,"preserve-digests",false,"Preserve digests of images and lists")
flags.BoolVarP(&opts.keepGoing,"keep-going","",false,"Do not abort the sync if any image copy fails")
flags.AddFlagSet(&sharedFlags)
flags.AddFlagSet(&deprecatedTLSVerifyFlags)
flags.AddFlagSet(&srcFlags)
flags.AddFlagSet(&destFlags)
flags.AddFlagSet(&retryFlags)
returncmd
}
// unmarshalYAML is the implementation of the Unmarshaler interface method
// method for the tlsVerifyConfig type.
// UnmarshalYAML is the implementation of the Unmarshaler interface method
// for the tlsVerifyConfig type.
// It unmarshals the 'tls-verify' YAML key so that, when they key is not
Usage:"path of the authentication file. Example: ${XDG_RUNTIME_DIR}/containers/auth.json",
Value:os.Getenv("REGISTRY_AUTH_FILE"),
Destination:&opts.authFilePath,
},
},&opts
fs:=pflag.FlagSet{}
fs.StringVar(&opts.authFilePath,"authfile",os.Getenv("REGISTRY_AUTH_FILE"),"path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json")
returnfs,&opts
}
// imageOptions collects CLI flags specific to the "docker" transport, which are
// dockerImageOptions collects CLI flags specific to the "docker" transport, which are
// the same across subcommands, but may be different for each image
// (e.g. may differ between the source and destination of a copy)
typedockerImageOptionsstruct{
global*globalOptions// May be shared across several imageOptions instances.
shared*sharedImageOptions// May be shared across several imageOptions instances.
authFilePathoptionalString// Path to a */containers/auth.json (prefixed version to override shared image option).
credsOptionoptionalString// username[:password] for accessing a registry
dockerCertPathstring// A directory using Docker-like *.{crt,cert,key} files for connecting to a registry or a daemon
tlsVerifyoptionalBool// Require HTTPS and verify certificates (for docker: and docker-daemon:)
noCredsbool// Access the registry anonymously
global*globalOptions// May be shared across several imageOptions instances.
shared*sharedImageOptions// May be shared across several imageOptions instances.
deprecatedTLSVerify*deprecatedTLSVerifyOption// May be shared across several imageOptions instances, or nil.
authFilePathcommonFlag.OptionalString// Path to a */containers/auth.json (prefixed version to override shared image option).
credsOptioncommonFlag.OptionalString// username[:password] for accessing a registry
userNamecommonFlag.OptionalString// username for accessing a registry
passwordcommonFlag.OptionalString// password for accessing a registry
registryTokencommonFlag.OptionalString// token to be used directly as a Bearer token when accessing the registry
dockerCertPathstring// A directory using Docker-like *.{crt,cert,key} files for connecting to a registry or a daemon
tlsVerifycommonFlag.OptionalBool// Require HTTPS and verify certificates (for docker: and docker-daemon:)
noCredsbool// Access the registry anonymously
}
// imageOptions collects CLI flags which are the same across subcommands, but may be different for each image
@@ -75,113 +134,108 @@ type imageOptions struct {
// dockerImageFlags prepares a collection of docker-transport specific CLI flags
// writing into imageOptions, and the managed imageOptions structure.
// This is horribly ugly, but we need to support the old option forms of (skopeo copy) for compatibility.
// Don't add any more cases likethis.
credsOptionExtra:=""
ifcredsOptionAlias!=""{
credsOptionExtra+=","+credsOptionAlias
}
varflags[]cli.Flag
fs:=pflag.FlagSet{}
ifflagPrefix!=""{
// the non-prefixed flag is handled by a shared flag.
flags=append(flags,
cli.GenericFlag{
Name:flagPrefix+"authfile",
Usage:"path of the authentication file. Example: ${XDG_RUNTIME_DIR}/containers/auth.json",
Value:newOptionalStringValue(&opts.authFilePath),
},
)
fs.Var(commonFlag.NewOptionalStringValue(&flags.authFilePath),flagPrefix+"authfile","path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json")
}
flags=append(flags,
cli.GenericFlag{
Name:flagPrefix+"creds"+credsOptionExtra,
Usage:"Use `USERNAME[:PASSWORD]` for accessing the registry",
Value:newOptionalStringValue(&opts.credsOption),
},
cli.StringFlag{
Name:flagPrefix+"cert-dir",
Usage:"use certificates at `PATH` (*.crt, *.cert, *.key) to connect to the registry or daemon",
Destination:&opts.dockerCertPath,
},
cli.GenericFlag{
Name:flagPrefix+"tls-verify",
Usage:"require HTTPS and verify certificates when talking to the container registry or daemon (defaults to true)",
Value:newOptionalBoolValue(&opts.tlsVerify),
},
cli.BoolFlag{
Name:flagPrefix+"no-creds",
Usage:"Access the registry anonymously",
Destination:&opts.noCreds,
},
)
returnflags,&opts
fs.Var(commonFlag.NewOptionalStringValue(&flags.credsOption),flagPrefix+"creds","Use `USERNAME[:PASSWORD]` for accessing the registry")
fs.Var(commonFlag.NewOptionalStringValue(&flags.userName),flagPrefix+"username","Username for accessing the registry")
fs.Var(commonFlag.NewOptionalStringValue(&flags.password),flagPrefix+"password","Password for accessing the registry")
ifcredsOptionAlias!=""{
// This is horribly ugly, but we need to support the old option forms of (skopeo copy) for compatibility.
// Don't add any more cases likethis.
f:=fs.VarPF(commonFlag.NewOptionalStringValue(&flags.credsOption),credsOptionAlias,"","Use `USERNAME[:PASSWORD]` for accessing the registry")
f.Hidden=true
}
fs.Var(commonFlag.NewOptionalStringValue(&flags.registryToken),flagPrefix+"registry-token","Provide a Bearer token for accessing the registry")
fs.StringVar(&flags.dockerCertPath,flagPrefix+"cert-dir","","use certificates at `PATH` (*.crt, *.cert, *.key) to connect to the registry or daemon")
commonFlag.OptionalBoolFlag(&fs,&flags.tlsVerify,flagPrefix+"tls-verify","require HTTPS and verify certificates when talking to the container registry or daemon")
fs.BoolVar(&flags.noCreds,flagPrefix+"no-creds",false,"Access the registry anonymously")
returnfs,&flags
}
// imageFlags prepares a collection of CLI flags writing into imageOptions, and the managed imageOptions structure.
fs.BoolVar(&opts.dirForceCompression,flagPrefix+"compress",false,"Compress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source)")
fs.BoolVar(&opts.dirForceDecompression,flagPrefix+"decompress",false,"Decompress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source)")
fs.BoolVar(&opts.ociAcceptUncompressedLayers,flagPrefix+"oci-accept-uncompressed-layers",false,"Allow uncompressed image layers when saving to an OCI image using the 'oci' transport. (default is to compress things that aren't compressed)")
fs.StringVar(&opts.compressionFormat,flagPrefix+"compress-format","","`FORMAT` to use for the compression")
fs.Var(commonFlag.NewOptionalIntValue(&opts.compressionLevel),flagPrefix+"compress-level","`LEVEL` to use for the compression")
fs.BoolVar(&opts.precomputeDigests,flagPrefix+"precompute-digests",false,"Precompute digests to prevent uploading layers already on the registry using the 'docker' transport.")
returnfs,&opts
}
// newSystemContext returns a *types.SystemContext corresponding to opts.
Copy an image (manifest, filesystem layers, signatures) from one location to another.
@@ -15,9 +15,18 @@ Uses the system's trust policy to validate images, rejects images not trusted by
_destination-image_ use the "image name" format described above
_source-image_ and _destination-image_ are interpreted completely independently; e.g. the destination name does not
automatically inherit any parts of the source name.
## OPTIONS
**--all**
See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
**--additional-tag**=_strings_
Additional tags (supports docker-archive).
**--all**, **-a**
If _source-image_ refers to a list of images, instead of copying just the image which matches the current OS and
architecture (subject to the use of the global --override-os, --override-arch and --override-variant options), attempt to copy all of
@@ -25,7 +34,7 @@ the images in the list, and the list itself.
**--authfile** _path_
Path of the authentication file. Default is ${XDG_RUNTIME\_DIR}/containers/auth.json, which is set using `podman login`.
Path of the authentication file. Default is ${XDG_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using `docker login`.
Note: You can also override the default path of the authentication file by setting the REGISTRY\_AUTH\_FILE
@@ -39,52 +48,187 @@ Path of the authentication file for the source registry. Uses path given by `--a
Path of the authentication file for the destination registry. Uses path given by `--authfile`, if not provided.
**--format, -f** _manifest-type_ Manifest type (oci, v2s1, or v2s2) to use when saving image to directory using the 'dir:' transport (default is manifest type of source)
**--dest-shared-blob-dir** _directory_
**--quiet, -q** suppress output information when copying images
Directory to use to share blobs across OCI repositories.
**--remove-signatures** do not copy signatures, if any, from _source-image_. Necessary when copying a signed image to a destination which does not support signatures.
**--digestfile** _path_
**--sign-by=**_key-id_ add a signature using that key ID for an image name corresponding to _destination-image_
After copying the image, write the digest of the resulting image to the file.
**--encryption-key** _Key_ a reference prefixed with the encryption protocol to use. The supported protocols are JWE, PGP and PKCS7. For instance, jwe:/path/to/key.pem or pgp:admin@example.com or pkcs7:/path/to/x509-file. This feature is still *experimental*.
**--preserve-digests**
**--decryption-key** _Key_ a reference required to perform decryption of container images. This should point to files which represent keys and/or certificates that can be used for decryption. Decryption will be tried with all keys. This feature is still *experimental*.
Preserve the digests during copying. Fail if the digest cannot be preserved.
**--src-creds** _username[:password]_ for accessing the source registry
This option does not change what will be copied; consider using `--all` at the same time.
**--dest-compress** _bool-value_ Compress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source)
**--encrypt-layer** _ints_
**--dest-oci-accept-uncompressed-layers** _bool-value_Allow uncompressed image layers when saving to an OCI image using the 'oci' transport. (default is to compress things that aren't compressed)
*Experimental*the 0-indexed layer indices, with support for negative indexing (e.g. 0 is the first layer, -1 is the last layer)
**--dest-creds** _username[:password]_ for accessing the destination registry
**--format**,**-f** _manifest-type_
**--src-cert-dir** _path_ Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the source registry or daemon
MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default is manifest type of source, with fallbacks)
**--src-no-creds** _bool-value_ Access the registry anonymously.
**--help**,**-h**
**--src-tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to container source registry or daemon (defaults to true)
Print usage statement
**--dest-cert-dir** _path_ Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the destination registry or daemon
**--multi-arch** _option_
**--dest-no-creds** _bool-value_ Access the registry anonymously.
Control what is copied if _source-image_ refers to a multi-architecture image. Default is system.
**--dest-tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to container destination registry or daemon (defaults to true)
Options:
- system: Copy only the image that matches the system architecture
- all: Copy the full multi-architecture image
- index-only: Copy only the index
**--src-daemon-host** _host_ Copy from docker daemon at _host_. If _host_ starts with `tcp://`, HTTPS is enabled by default. To use plain HTTP, use the form `http://` (default is `unix:///var/run/docker.sock`).
The index-only option usually fails unless the referenced per-architecture images are already present in the destination, or the target registry supports sparse indexes.
**--dest-daemon-host** _host_ Copy to docker daemon at _host_. If_host_ starts with `tcp://`, HTTPS is enabled by default. To use plain HTTP, use the form `http://` (default is `unix:///var/run/docker.sock`).
**--quiet**,**-q**
Suppress output information when copying images.
**--remove-signatures**
Do not copy signatures, if any, from _source-image_. Necessary when copying a signed image to a destination which does not support signatures.
**--sign-by** _key-id_
Add a “simple signing” signature using that key ID for an image name corresponding to _destination-image_
**--sign-by-sigstore** _param-file_
Add a sigstore signature based on the options in the specified containers sigstore signing parameter file, _param-file_.
See containers-sigstore-signing-params.yaml(5) for details about the file format.
**--sign-by-sigstore-private-key** _path_
Add a sigstore signature using a private key at _path_ for an image name corresponding to _destination-image_
**--sign-passphrase-file** _path_
The passphare to use when signing with `--sign-by` or `--sign-by-sigstore-private-key`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
**--sign-identity** _reference_
The identity to use when signing the image. The identity must be a fully specified docker reference. If the identity is not specified, the target docker reference will be used.
**--src-shared-blob-dir** _directory_
Directory to use to share blobs across OCI repositories.
**--encryption-key** _protocol:keyfile_
Specifies the encryption protocol, which can be JWE (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material required for image encryption. For instance, jwe:/path/to/key.pem or pgp:admin@example.com or pkcs7:/path/to/x509-file.
**--decryption-key** _key[:passphrase]_
Key to be used for decryption of images. Key can point to keys and/or certificates. Decryption will be tried with all keys. If the key is protected by a passphrase, it is required to be passed in the argument and omitted otherwise.
**--src-creds** _username[:password]_
Credentials for accessing the source registry.
**--dest-compress**
Compress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source).
**--dest-decompress**
Decompress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source).
**--dest-oci-accept-uncompressed-layers**
Allow uncompressed image layers when saving to an OCI image using the 'oci' transport. (default is to compress things that aren't compressed).
**--dest-creds** _username[:password]_
Credentials for accessing the destination registry.
**--src-cert-dir** _path_
Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the source registry or daemon.
**--src-no-creds**
Access the registry anonymously.
**--src-tls-verify**=_bool_
Require HTTPS and verify certificates when talking to container source registry or daemon. Default to source registry setting.
**--dest-cert-dir** _path_
Use certificates at _path_ (*.crt, *.cert, *.key) to connect to the destination registry or daemon.
**--dest-no-creds**
Access the registry anonymously.
**--dest-tls-verify**=_bool_
Require HTTPS and verify certificates when talking to container destination registry or daemon. Default to destination registry setting.
**--src-daemon-host** _host_
Copy from docker daemon at _host_. If _host_ starts with `tcp://`, HTTPS is enabled by default. To use plain HTTP, use the form `http://` (default is `unix:///var/run/docker.sock`).
**--dest-daemon-host** _host_
Copy to docker daemon at _host_. If _host_ starts with `tcp://`, HTTPS is enabled by default. To use plain HTTP, use the form `http://` (default is `unix:///var/run/docker.sock`).
Existing signatures, if any, are preserved as well.
**--dest-compress-format** _format_ Specifies the compression format to use. Supported values are: `gzip` and `zstd`.
**--dest-compress-format** _format_
**--dest-compress-level** _format_Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive), while for gzip it is 1-9 (inclusive).
Specifies the compression format to use. Supported values are: `gzip`, `zstd` and `zstd:chunked`.
**--dest-compress-level** _format_
Specifies the compression level to use. The value is specific to the compression algorithm used, e.g. for zstd the accepted values are in the range 1-20 (inclusive), while for gzip it is 1-9 (inclusive).
**--src-registry-token** _token_
Bearer token for accessing the source registry.
**--dest-registry-token** _token_
Bearer token for accessing the destination registry.
**--dest-precompute-digests**
Precompute digests to ensure layers are not uploaded that already exist on the destination registry. Layers with initially unknown digests (ex. compressing "on the fly") will be temporarily streamed to disk.
**--retry-times**
The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
**--src-username**
The username to access the source registry.
**--src-password**
The password to access the source registry.
**--dest-username**
The username to access the destination registry.
**--dest-password**
The password to access the destination registry.
## EXAMPLES
To just copy an image from one registry to another:
Container images can also be partially encrypted by specifying the index of the layer. Layers are 0-indexed indices, with support for negative indexing. i.e. 0 is the first layer, -1 is the last layer.
Let's say out of 3 layers that the image `docker.io/library/nginx:1.17.8` is made up of, we only want to encrypt the 2nd layer,
skopeo\-delete - Mark the _image-name_ for later deletion by the registry's garbage collector.
## SYNOPSIS
**skopeo delete** _image-name_
**skopeo delete** [*options*]_image-name_
Mark _image-name_ for deletion. To release the allocated disk space, you must login to the container registry server and execute the container registry garbage collector. E.g.,
## DESCRIPTION
Mark _image-name_ for deletion.
The effect of this is registry-specific; many registries don’t support this operation, or don’t allow it in some circumstances / configurations.
**WARNING**: If _image-name_ contains a digest, this affects the referenced manifest, and may delete all tags (within the current repository?) pointing to that manifest.
**WARNING**: If _image-name_ contains a tag (but not a digest), in the current version of Skopeo this resolves the tag into a digest, and then deletes the manifest by digest, as described above (possibly deleting all tags pointing to that manifest, not just the provided tag). This behavior may change in the future.
When using the github.com/distribution/distribution registry server:
To release the allocated disk space, you must login to the container registry server and execute the container registry garbage collector. E.g.,
Return low-level information about _image-name_ in a registry
## DESCRIPTION
**--raw** output raw manifest, default is to format in JSON
Return low-level information about _image-name_ in a registry.
See [skopeo(1)](skopeo.1.md) for the format of _image-name_.
_image-name_ name of image to retrieve information about
The default output includes data from various sources: user input (**Name**), the remote repository, if any (**RepoTags**), the top-level manifest (**Digest**),
and a per-architecture/OS image matching the current run-time environment (most other values).
To see values for a different architecture/OS, use the **--override-os** / **--override-arch** options documented in [skopeo(1)](skopeo.1.md).
**--config** output configuration in OCI format, default is to format in JSON
## OPTIONS
_image-name_ name of image to retrieve configuration for
See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
**--config** **--raw** output configuration in raw format
**--authfile** _path_
_image-name_ name of image to retrieve configuration for
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using `docker login`.
**--authfile** _path_
**--cert-dir** _path_
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `podman login`.
If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using `docker login`.
Use certificates at _path_ (\*.crt, \*.cert, \*.key) to connect to the registry.
**--creds** _username[:password]_ for accessing the registry
**--config**
**--cert-dir** _path_ Use certificates at _path_ (\*.crt, \*.cert, \*.key) to connect to the registry
Output configuration in OCI format, default is to format in JSON format.
**--tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to container registries (defaults to true)
**--creds** _username[:password]_
**--no-creds** _bool-value_ Access the registry anonymously.
Username and password for accessing the registry.
**--daemon-host** _host_
Use docker daemon host at _host_ (`docker-daemon:` transport only)
**--format**, **-f**=*format*
Format the output using the given Go template.
The keys of the returned JSON can be used as the values for the --format flag (see examples below).
Supports the Go templating functions available at https://pkg.go.dev/github.com/containers/common/pkg/report#hdr-Template_Functions
**--help**, **-h**
Print usage statement
**--no-creds**
Access the registry anonymously.
**--raw**
Output raw manifest or config data depending on --config option.
The --format option is not supported with --raw option.
**--registry-token** _Bearer token_
Registry token for accessing the registry.
**--retry-times**
The number of times to retry; retry wait time will be exponentially increased based on the number of failed attempts.
**--shared-blob-dir** _directory_
Directory to use to share blobs across OCI repositories.
**--tls-verify**=_bool_
Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
**--username**
The username to access the registry.
**--password**
The password to access the registry.
**--no-tags**, **-n**
Do not list the available tags from the repository in the output. When `true`, the `RepoTags` array will be empty. Defaults to `false`, which includes all available tags.
## EXAMPLES
To review information for the image fedora from the docker.io registry:
skopeo\-list\-tags - Return a list of tags the transport-specific image repository
skopeo\-list\-tags - List image names in a transport-specific collection of images.
## SYNOPSIS
**skopeo list-tags** _repository-name_
**skopeo list-tags** [*options*] _source-image_
Return a list of tags from _repository-name_ in a registry.
Return a list of tags from _source-image_ in a registry or a local docker-archive file.
_repository-name_ name of repository to retrieve tag listing from
_source-image_ name of the repository to retrieve a tag listing from or a local docker-archive file.
**--authfile** _path_
## OPTIONS
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `podman login`.
See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
**--authfile** _path_
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using `docker login`.
**--creds** _username[:password]_ for accessing the registry
**--creds** _username[:password]_ for accessing the registry.
**--cert-dir** _path_ Use certificates at _path_ (\*.crt, \*.cert, \*.key) to connect to the registry
**--cert-dir** _path_
**--tls-verify** _bool-value_ Require HTTPS and verify certificates when talking to container registries (defaults to true)
Use certificates at _path_ (\*.crt, \*.cert, \*.key) to connect to the registry.
**--no-creds** _bool-value_ Access the registry anonymously.
**--help**,**-h**
Print usage statement
**--no-creds**
Access the registry anonymously.
**--registry-token** _Bearer token_
Bearer token for accessing the registry.
**--retry-times**
The number of times to retry. Retry wait time will be exponentially increased based on the number of failed attempts.
**--tls-verify**=_bool_
Require HTTPS and verify certificates when talking to the container registry or daemon. Default to registry.conf setting.
**--username**
The username to access the registry.
**--password**
The password to access the registry.
## REPOSITORY NAMES
Repository names are transport-specific references as each transport may have its own concept of a "repository" and "tags". Currently, only the Docker transport is supported.
Repository names are transport-specific references as each transport may have its own concept of a "repository" and "tags".
This commands refers to repositories using a _transport_`:`_details_ format. The following formats are supported:
**docker://**_docker-repository-reference_
A repository in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in either `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`.
A repository in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in either `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(skopeo login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`.
A _docker-repository-reference_ is of the form: **registryhost:port/repositoryname** which is similar to an _image-reference_ but with no tag or digest allowed as the last component (e.g no `:latest` or `@sha256:xyz`)
more than one images were stored in a docker save-formatted file.
## EXAMPLES
### Docker Transport
To get the list of tags in the "fedora" repository from the docker.io registry (the repository name expands to "library/fedora" per docker transport canonical form):
This is primarily a debugging tool, or useful for special cases,
and usually should not be a part of your normal operational workflow; use `skopeo copy --sign-by` instead to publish and sign an image in one step.
This is primarily a debugging tool, useful for special cases, and usually should not be a part of your normal operational workflow; use `skopeo copy --sign-by` instead to publish and sign an image in one step.
_manifest_ Path to a file containing the image manifest
@@ -16,19 +15,36 @@ and usually should not be a part of your normal operational workflow; use `skope
_key-fingerprint_ Key identity to use for signing
**--output**|**-o** output file
## OPTIONS
See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
**--help**, **-h**
Print usage statement
**--output**, **-o** _output file_
Write signature to _output file_.
**--passphrase-file**=_path_
The passphare to use when signing with the key ID from `--sign-by`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
This command is intended for use with local signatures e.g. OpenPGP ( other signature formats may be added in the future ), as per containers-signature(5). Furthermore, this command does **not** interact with the artifacts generated by Docker Content Trust (DCT). For more information, please see [containers-signature(5)](https://github.com/containers/image/blob/main/docs/containers-signature.5.md).
This command is intended for use with local signatures e.g. OpenPGP ( other signature formats may be added in the future ), as per containers-signature(5). Furthermore, this command does **not** interact with the artifacts generated by Docker Content Trust (DCT). For more information, please see [containers-signature(5)](https://github.com/containers/image/blob/main/docs/containers-signature.5.md).
Synchronize images between container registries and local directories.
The synchronization is achieved by copying all the images found at _source_ to _destination_.
Useful to synchronize a local container registry mirror, and to to populate registries running inside of air-gapped environments.
Synchronize images between registry repositories and local directories. Synchronization is achieved by copying all the images found at _source_ to _destination_ - useful when synchronizing a local container registry mirror or for populating registries running inside of air-gapped environments.
Differently from other skopeo commands, skopeo sync requires both source and destination transports to be specified separately from _source_ and _destination_.
One of the problems of prefixing a destination with its transport is that, the registry `docker://hostname:port` would be wrongly interpreted as an image reference at a non-fully qualified registry, with `hostname` and `port` the image name and tag.
@@ -32,9 +29,17 @@ When the `--scoped` option is specified, images are prefixed with the source ima
name can be stored at _destination_.
## OPTIONS
See also [skopeo(1)](skopeo.1.md) for options placed before the subcommand name.
**--all**, **-a**
If one of the images in __src__ refers to a list of images, instead of copying just the image which matches the current OS and
architecture (subject to the use of the global --override-os, --override-arch and --override-variant options), attempt to copy all of
the images in the list, and the list itself.
**--authfile** _path_
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `podman login`.
Path of the authentication file. Default is ${XDG\_RUNTIME\_DIR}/containers/auth.json, which is set using `skopeo login`.
If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using `docker login`.
**--src-authfile** _path_
@@ -45,15 +50,48 @@ Path of the authentication file for the source registry. Uses path given by `--a
Path of the authentication file for the destination registry. Uses path given by `--authfile`, if not provided.
**--src** _transport_ Transport for the source repository.
**--dry-run**
**--dest** _transport_ Destination transport.
Run the sync without actually copying data to the destination.
**--src**, **-s** _transport_ Transport for the source repository.
**--format**, **-f** _manifest-type_ Manifest Type (oci, v2s1, or v2s2) to use when syncing image(s) to a destination (default is manifest type of source, with fallbacks).
**--help**, **-h**
Print usage statement.
**--scoped** Prefix images with the source image path, so that multiple images with the same name can be stored at _destination_.
**--append-suffix** _tag-suffix_ String to append to destination tags.
**--preserve-digests**
Preserve the digests during copying. Fail if the digest cannot be preserved.
This option does not change what will be copied; consider using `--all` at the same time.
**--remove-signatures** Do not copy signatures, if any, from _source-image_. This is necessary when copying a signed image to a destination which does not support signatures.
**--sign-by=**_key-id_ Add a signature using that key ID for an image name corresponding to _destination-image_.
**--sign-by**_key-id_
Add a “simple signing” signature using that key ID for an image name corresponding to _destination-image_
**--sign-by-sigstore** _param-file_
Add a sigstore signature based on the options in the specified containers sigstore signing parameter file, _param-file_.
See containers-sigstore-signing-params.yaml(5) for details about the file format.
**--sign-by-sigstore-private-key** _path_
Add a sigstore signature using a private key at _path_ for an image name corresponding to _destination-image_
**--sign-passphrase-file** _path_
The passphare to use when signing with `--sign-by` or `--sign-by-sigstore-private-key`. Only the first line will be read. A passphrase stored in a file is of questionable security if other users can read this file. Do not use this option if at all avoidable.
**--src-creds** _username[:password]_ for accessing the source registry.
@@ -61,20 +99,45 @@ Path of the authentication file for the destination registry. Uses path given by
**--src-cert-dir** _path_ Use certificates (*.crt, *.cert, *.key) at _path_ to connect to the source registry or daemon.
**--src-no-creds**_bool-value_ Access the registry anonymously.
**--src-no-creds** Access the registry anonymously.
**--src-tls-verify**_bool-value_ Require HTTPS and verify certificates when talking to a container source registry or daemon (defaults to true).
**--src-tls-verify**=_bool_ Require HTTPS and verify certificates when talking to a container source registry or daemon. Default to source registry entry in registry.conf setting.
**--dest-cert-dir** _path_ Use certificates (*.crt, *.cert, *.key) at _path_ to connect to the destination registry or daemon.
**--dest-no-creds**_bool-value_ Access the registry anonymously.
**--dest-no-creds** Access the registry anonymously.
**--dest-tls-verify**_bool-value_ Require HTTPS and verify certificates when talking to a container destination registry or daemon (defaults to true).
**--dest-tls-verify**=_bool_ Require HTTPS and verify certificates when talking to a container destination registry or daemon. Default to destination registry entry in registry.conf setting.
**--src-registry-token** _Bearer token_ for accessing the source registry.
**--dest-registry-token** _Bearer token_ for accessing the destination registry.
**--retry-times** the number of times to retry, retry wait time will be exponentially increased based on the number of failed attempts.
**--keep-going**
If any errors occur during copying of images, those errors are logged and the process continues syncing rest of the images and finally fails at the end.
**--src-username**
The username to access the source registry.
**--src-password**
The password to access the source registry.
**--dest-username**
The username to access the destination registry.
**--dest-password**
The password to access the destination registry.
## EXAMPLES
### Synchronizing to a local directory
```
```console
$ skopeo sync --src docker --dest dir registry.example.com/busybox /media/usb
```
Images are located at:
@@ -86,8 +149,23 @@ Images are located at:
/media/usb/busybox:latest
```
### Synchronizing to a local directory, scoped
### Synchronizing to a container registry from local
Images are located at:
```
/media/usb/busybox:1-glibc
```
Sync run
```console
$ skopeo sync --src dir --dest docker /media/usb/busybox:1-glibc my-registry.local.lan/test/
```
Destination registry content:
```
REPO TAGS
my-registry.local.lan/test/busybox 1-glibc
```
### Synchronizing to a local directory, scoped
```console
$ skopeo sync --src docker --dest dir --scoped registry.example.com/busybox /media/usb
- Repository `registry.example.com/busybox`: all images, as no tags are specified.
- Repository `registry.example.com/redis`: images tagged "1.0" and "2.0".
- Repository `registry.example.com/redis`: images tagged "1.0" and "2.0" along with image with digest "sha256:0000000000000000000000000000000011111111111111111111111111111111".
- Repository `registry.example.com/nginx`: images tagged "1.13.1-alpine-perl" and "1.13.2-alpine-perl".
- Repository `registry.example.com/alpine`: all images with tags match the semantic version constraint ">= 3.12.0" ("3.12.0, "3.12.1", ... ,"4.0.0", ...)
The full list of possible semantic version comparisons can be found in the
Version ordering and precedence is understood as defined here:
https://semver.org/#spec-item-11.
For the registry `registry.example.com`, the "john"/"this is a secret" credentials are used, with server TLS certificates located at `/home/john/certs`.
TLS verification is normally enabled, and it can be disabled setting `tls-verify` to `true`.
In the above example, TLS verification is enabled for `reigstry.example.com`, while is
TLS verification is normally enabled, and it can be disabled setting `tls-verify` to `false`.
In the above example, TLS verification is enabled for `registry.example.com`, while is
@@ -27,13 +27,13 @@ its functionality. It also does not require root, unless you are copying images
Most commands refer to container images, using a _transport_`:`_details_ format. The following formats are supported:
**containers-storage:**_docker-reference_
An image located in a local containers/storage image store. Location and image store specified in /etc/containers/storage.conf
An image located in a local containers/storage image store. Both the location and image store are specified in /etc/containers/storage.conf. (Backend for Podman, CRI-O, Buildah and friends)
**dir:**_path_
An existing local directory _path_ storing the manifest, layer tarballs and signatures as individual files. This is a non-standardized format, primarily useful for debugging or noninvasive container inspection.
**docker://**_docker-reference_
An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in either `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(podman login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`.
An image in a registry implementing the "Docker Registry HTTP API V2". By default, uses the authorization state in either `$XDG_RUNTIME_DIR/containers/auth.json`, which is set using `(skopeo login)`. If the authorization state is not found there, `$HOME/.docker/config.json` is checked, which is set using `(docker login)`.
An image is stored in the `docker save` formatted file. _docker-reference_ is only used when creating such a file, and it must not contain a digest.
@@ -44,54 +44,87 @@ Most commands refer to container images, using a _transport_`:`_details_ format.
**oci:**_path_**:**_tag_
An image _tag_ in a directory compliant with "Open Container Image Layout Specification" at _path_.
**oci-archive:**_path_**:**_tag_
An image _tag_ in a tar archive compliant with "Open Container Image Layout Specification" at _path_.
See [containers-transports(5)](https://github.com/containers/image/blob/main/docs/containers-transports.5.md) for details.
## OPTIONS
**--command-timeout** _duration_ Timeout for the command execution.
These options should be placed before the subcommand name.
Individual subcommands have their own options.
**--debug** enable debug output
**--command-timeout** _duration_
**--help**|**-h** Show help
Timeout for the command execution.
**--insecure-policy** Adopt an insecure, permissive policy that allows anything. This obviates the need for a policy file.
**--debug**
**--override-arch** _arch_ Use _arch_ instead of the architecture of the machine for choosing images.
enable debug output
**--override-os** _OS_ Use _OS_ instead of the running OS for choosing images.
**--help**,**-h**
**--override-variant** _VARIANT_ Use _VARIANT_ instead of the running architecture variant for choosing images.
Show help
**--policy** _path-to-policy_ Path to a policy.json file to use for verifying signatures and deciding whether an image is trusted, overriding the default trust policy file.
**--insecure-policy**
**--registries.d** _dir_ use registry configuration files in _dir_ (e.g. for container signature storage), overriding the default path.
Adopt an insecure, permissive policy that allows anything. This obviates the need for a policy file.
**--tmpdir** _dir_ used to store temporary files. Defaults to /var/tmp.
**--override-arch** _arch_
**--version**|**-v** print the version number
Use_arch_ instead of the architecture of the machine for choosing images.
**--override-os** _os_
Use _OS_ instead of the running OS for choosing images.
**--override-variant** _variant_
Use _variant_ instead of the running architecture variant for choosing images.
**--policy** _path-to-policy_
Path to a policy.json file to use for verifying signatures and deciding whether an image is trusted, overriding the default trust policy file.
**--registries.d** _dir_
Use registry configuration files in _dir_ (e.g. for container signature storage), overriding the default path.
**--tmpdir** _dir_
Directory used to store temporary files. Defaults to /var/tmp.
| [skopeo-copy(1)](skopeo-copy.1.md) | Copy an image (manifest, filesystem layers, signatures) from one location to another. |
| [skopeo-delete(1)](skopeo-delete.1.md) | Mark image-name for deletion. |
| [skopeo-inspect(1)](skopeo-inspect.1.md) | Return low-level information about image-name in a registry. |
| [skopeo-list-tags(1)](skopeo-list-tags.1.md) | List the tags for the given transport/repository. |
| [skopeo-manifest-digest(1)](skopeo-manifest-digest.1.md) | Compute a manifest digest of manifest-file and write it to standard output.|
| [skopeo-standalone-sign(1)](skopeo-standalone-sign.1.md) | Sign an image. |
| [skopeo-standalone-verify(1)](skopeo-standalone-verify.1.md)| Verify an image. |
| [skopeo-sync(1)](skopeo-sync.1.md)| Copy images from one or more repositories to a user specified destination. |
| [skopeo-delete(1)](skopeo-delete.1.md) | Mark the _image-name_ for later deletion by the registry's garbage collector. |
| [skopeo-generate-sigstore-key(1)](skopeo-generate-sigstore-key.1.md) | Generate a sigstore public/private key pair. |
| [skopeo-inspect(1)](skopeo-inspect.1.md) | Return low-level information about _image-name_ in a registry. |
| [skopeo-list-tags(1)](skopeo-list-tags.1.md) | List image names in a transport-specific collection of images.|
| [skopeo-login(1)](skopeo-login.1.md) | Login to a container registry. |
| [skopeo-logout(1)](skopeo-logout.1.md) | Logout of a container registry. |
| [skopeo-manifest-digest(1)](skopeo-manifest-digest.1.md) | Compute a manifest digest for a manifest-file and write it to standard output. |
| [skopeo-standalone-sign(1)](skopeo-standalone-sign.1.md) | Debugging tool - Publish and sign an image in one step. |
| [skopeo-standalone-verify(1)](skopeo-standalone-verify.1.md)| Verify an image signature. |
| [skopeo-sync(1)](skopeo-sync.1.md)| Synchronize images between registry repositories and local directories. |
## FILES
**/etc/containers/policy.json**
Default trust policy file, if **--policy** is not specified.
The policy format is documented in https://github.com/containers/image/blob/master/docs/containers-policy.json.5.md .
The policy format is documented in [containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md) .
**/etc/containers/registries.d**
Default directory containing registry configuration, if **--registries.d** is not specified.
The contents of this directory are documented in https://github.com/containers/image/blob/master/docs/containers-policy.json.5.md.
The contents of this directory are documented in [containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md).
<pathinkscape:export-ydpi="96.181694"inkscape:export-xdpi="96.181694"sodipodi:nodetypes="cc"inkscape:connector-curvature="0"id="path81576"d="m 61.405599,166.31541 v 5.83669"style="fill:none;fill-opacity:1;stroke:#9dc6e7;stroke-width:0.79375;stroke-linecap:square;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"inkscape:export-filename="/home/duffy/Documents/Projects/Favors/Buildah logo/final/color-not-color.png"/>
cd$GOPATH/src/github.com/containers/skopeo && make bin/skopeo
```
### Building in a container
By default the `make` command (make all) will build bin/skopeo and the documentation locally.
Building in a container is simpler, but more restrictive:
- It requires the `podman` command and the ability to run Linux containers
- The created executable is a Linux executable, and depends on dynamic libraries
which may only be available only in a container of a similar Linux
distribution.
```bash
$ make binary # Or (make all) to also build documentation, see below.
Building of documentation requires `go-md2man`. On systems that do not have this tool, the
document generation can be skipped by passing `DISABLE_DOCS=1`:
```
DISABLE_DOCS=1 make
```
To build a pure-Go static binary (disables devicemapper, btrfs, and gpgme):
#### Additional prerequisites
In order to dynamically link against system libraries and avoid compilation errors the ```CGO_ENABLED='1'``` flag must be enabled. You can easily check by ```go env | grep CGO_ENABLED```.
An alternative would be to set the `BUILDTAGS=containers_image_openpgp` (this removes the dependency on `libgpgme` and its companion libraries).
### Cross-compilation
For cross-building skopeo, use the command `make bin/skopeo.OS.ARCH`, where OS represents
the target operating system and ARCH stands for the desired architecture. For instance,
to build skopeo for RISC-V 64-bit Linux, execute:
```bash
$ make binary-static DISABLE_CGO=1
make bin/skopeo.linux.riscv64
```
### Building documentation
@@ -136,24 +217,80 @@ To build the manual you will need go-md2man.
```bash
# Debian:
$ sudo apt-get install go-md2man
sudo apt-get install go-md2man
```
```
# Fedora:
$ sudo dnf install go-md2man
sudo dnf install go-md2man
```
```
# MacOS:
brew install go-md2man
```
Then
```bash
$ make docs
make docs
```
### Building in a container
Building in a container is simpler, but more restrictive:
- It requires the `podman` command and the ability to run Linux containers.
- The created executable is a Linux executable, and depends on dynamic libraries
which may only be available only in a container of a similar Linux
distribution.
```bash
$ make binary
```
### Shell completion scripts
Skopeo has shell completion scripts for bash, zsh, fish and powershell. They are installed as part of `make install`.
You may have to restart your shell in order for them to take effect.
For instructions to manually generate and load the scripts please see `skopeo completion --help`.
### Installation
Finally, after the binary and documentation is built:
```bash
$ sudo make install
sudo make install
```
### Building a static binary
There have been efforts in the past to produce and maintain static builds, but the maintainers prefer to run Skopeo using distro packages or within containers. This is because static builds of Skopeo tend to be unreliable and functionally restricted. Specifically:
- Some features of Skopeo depend on non-Go libraries like `libgpgme` and `libdevmapper`.
- Generating static Go binaries uses native Go libraries, which don't support e.g. `.local` or LDAP-based name resolution.
That being said, if you would like to build Skopeo statically, you might be able to do it by combining all the following steps.
- Export environment variable `CGO_ENABLED=0` (disabling CGO causes Go to prefer native libraries when possible, instead of dynamically linking against system libraries).
- Set the `BUILDTAGS=containers_image_openpgp` Make variable (this removes the dependency on `libgpgme` and its companion libraries).
- Clear the `GO_DYN_FLAGS` Make variable if even a dependency on the ELF interpreter is undesirable.
Keep in mind that the resulting binary is unsupported and might crash randomly. Only use if you know what you're doing!
For more information, history, and context about static builds, check the following issues:
- [#391] - Consider distributing statically built binaries as part of release
- [#669] - Static build fails with segmentation violation
- [#670] - Fixing static binary build using container
- [#755] - Remove static and in-container targets from Makefile
- [#932] - Add nix derivation for static builds
- [#1336] - Unable to run skopeo on Fedora 30 (due to dyn lib dependency)
- [#1478] - Publish binary releases to GitHub (request+discussion)
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
