opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-13 17:26:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix bug check nonexist authfile

Browse Source 
Use GetDefaultAuthFile() from buildah.
For podman command(except login), if authfile does not exist returns error.

close #4328

Signed-off-by: Qi Wang <qiwan@redhat.com>
This commit is contained in:
Qi Wang
2019-10-25 21:16:37 -04:00
parent b4b727256c
commit d7c0f968ca
20 changed files with 146 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cmd/podman/build.go
View File

@ -155,6 +155,11 @@ func buildCmd(c *cliconfig.BuildValues) error {
tags = tags[1:]
}
}
if c.BudResults.Authfile != "" {
if _, err := os.Stat(c.BudResults.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.BudResults.Authfile)
}
}
pullPolicy := imagebuildah.PullNever
if c.Pull {

4
cmd/podman/common.go
View File

@ -7,8 +7,8 @@ import (
"strings"
"github.com/containers/buildah"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/define"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/sysinfo"
@ -112,7 +112,7 @@ func getCreateFlags(c *cliconfig.PodmanCommand) {
"Attach to STDIN, STDOUT or STDERR (default [])",
)
createFlags.String(
"authfile", shared.GetAuthFile(""),
"authfile", buildahcli.GetDefaultAuthFile(),
"Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override",
)
createFlags.String(

7
cmd/podman/create.go
View File

@ -2,6 +2,7 @@ package main
import (
"fmt"
"os"
"strings"
"github.com/containers/libpod/cmd/podman/cliconfig"
@ -50,6 +51,12 @@ func createCmd(c *cliconfig.CreateValues) error {
defer span.Finish()
}
if c.String("authfile") != "" {
if _, err := os.Stat(c.String("authfile")); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.String("authfile"))
}
}
if err := createInit(&c.PodmanCommand); err != nil {
return err
}

4
cmd/podman/login.go
View File

@ -6,11 +6,11 @@ import (
"os"
"strings"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/image/v5/docker"
"github.com/containers/image/v5/pkg/docker/config"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/image"
"github.com/docker/docker-credential-helpers/credentials"
"github.com/pkg/errors"
@ -54,7 +54,7 @@ func init() {
flags.BoolVar(&loginCommand.StdinPassword, "password-stdin", false, "Take the password from stdin")
// Disabled flags for the remote client
if !remote {
flags.StringVar(&loginCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&loginCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&loginCommand.CertDir, "cert-dir", "", "Pathname of a directory containing TLS certificates and keys used to connect to the registry")
flags.BoolVar(&loginCommand.TlsVerify, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
}

11
cmd/podman/logout.go
View File

@ -3,11 +3,11 @@ package main
import (
"fmt"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/image/v5/docker"
"github.com/containers/image/v5/pkg/docker/config"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/image"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)
@ -40,7 +40,7 @@ func init() {
logoutCommand.SetUsageTemplate(UsageTemplate())
flags := logoutCommand.Flags()
flags.BoolVarP(&logoutCommand.All, "all", "a", false, "Remove the cached credentials for all registries in the auth file")
flags.StringVar(&logoutCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&logoutCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
markFlagHiddenForRemoteClient("authfile", flags)
}
@ -59,7 +59,10 @@ func logoutCmd(c *cliconfig.LogoutValues) error {
server = scrubServer(args[0])
}
sc := image.GetSystemContext("", c.Authfile, false)
sc, err := shared.GetSystemContext(c.Authfile)
if err != nil {
return err
}
if c.All {
if err := config.RemoveAllAuthentication(sc); err != nil {
@ -69,7 +72,7 @@ func logoutCmd(c *cliconfig.LogoutValues) error {
return nil
}
err := config.RemoveAuthentication(sc, server)
err = config.RemoveAuthentication(sc, server)
switch errors.Cause(err) {
case nil:
fmt.Printf("Removed login credentials for %s\n", server)

12
cmd/podman/play_kube.go
View File

@ -2,8 +2,10 @@ package main
import (
"fmt"
"os"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/pkg/adapter"
"github.com/pkg/errors"
"github.com/spf13/cobra"
@ -40,7 +42,7 @@ func init() {
flags.BoolVarP(&playKubeCommand.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
// Disabled flags for the remote client
if !remote {
flags.StringVar(&playKubeCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&playKubeCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&playKubeCommand.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys")
flags.StringVar(&playKubeCommand.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
flags.BoolVar(&playKubeCommand.TlsVerify, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
@ -57,6 +59,12 @@ func playKubeCmd(c *cliconfig.KubePlayValues) error {
return errors.New("you must supply at least one file")
}
if c.Authfile != "" {
if _, err := os.Stat(c.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.Authfile)
}
}
ctx := getContext()
runtime, err := adapter.GetRuntime(ctx, &c.PodmanCommand)
if err != nil {

10
cmd/podman/pull.go
View File

@ -6,12 +6,12 @@ import (
"os"
"strings"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/image/v5/docker"
dockerarchive "github.com/containers/image/v5/docker/archive"
"github.com/containers/image/v5/transports/alltransports"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/image"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/libpod/pkg/util"
@ -60,7 +60,7 @@ func init() {
markFlagHidden(flags, "override-os")
// Disabled flags for the remote client
if !remote {
flags.StringVar(&pullCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pullCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pullCommand.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys")
flags.StringVar(&pullCommand.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
flags.BoolVar(&pullCommand.TlsVerify, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
@ -96,6 +96,12 @@ func pullCmd(c *cliconfig.PullValues) (retError error) {
return errors.Errorf("too many arguments. Requires exactly 1")
}
if c.Authfile != "" {
if _, err := os.Stat(c.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.Authfile)
}
}
arr := strings.SplitN(args[0], ":", 2)
if len(arr) == 2 {
if c.Bool("all-tags") {

10
cmd/podman/push.go
View File

@ -6,11 +6,11 @@ import (
"os"
"strings"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/image/v5/directory"
"github.com/containers/image/v5/manifest"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/image"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/libpod/pkg/util"
@ -59,7 +59,7 @@ func init() {
// Disabled flags for the remote client
if !remote {
flags.StringVar(&pushCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pushCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pushCommand.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys")
flags.BoolVar(&pushCommand.Compress, "compress", false, "Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type as source)")
flags.StringVar(&pushCommand.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
@ -74,6 +74,12 @@ func pushCmd(c *cliconfig.PushValues) error {
destName string
)
if c.Authfile != "" {
if _, err := os.Stat(c.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.Authfile)
}
}
args := c.InputArgs
if len(args) == 0 || len(args) > 2 {
return errors.New("podman push requires at least one image name, and optionally a second to specify a different destination name")

7
cmd/podman/run.go
View File

@ -1,6 +1,8 @@
package main
import (
"os"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/pkg/adapter"
"github.com/opentracing/opentracing-go"
@ -45,6 +47,11 @@ func runCmd(c *cliconfig.RunValues) error {
span, _ := opentracing.StartSpanFromContext(Ctx, "runCmd")
defer span.Finish()
}
if c.String("authfile") != "" {
if _, err := os.Stat(c.String("authfile")); err != nil {
return errors.Wrapf(err, "error checking authfile path %s", c.String("authfile"))
}
}
if err := createInit(&c.PodmanCommand); err != nil {
return err
}

9
cmd/podman/runlabel.go
View File

@ -6,6 +6,7 @@ import (
"os"
"strings"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/libpodruntime"
@ -60,7 +61,7 @@ func init() {
flags.BoolVarP(&runlabelCommand.Quiet, "quiet", "q", false, "Suppress output information when installing images")
// Disabled flags for the remote client
if !remote {
flags.StringVar(&runlabelCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&runlabelCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&runlabelCommand.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys")
flags.StringVar(&runlabelCommand.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
flags.BoolVar(&runlabelCommand.TlsVerify, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
@ -97,6 +98,12 @@ func runlabelCmd(c *cliconfig.RunlabelValues) error {
}
defer runtime.DeferredShutdown(false)
if c.Authfile != "" {
if _, err := os.Stat(c.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.Authfile)
}
}
args := c.InputArgs
if len(args) < 2 {
return errors.Errorf("the runlabel command requires at least 2 arguments: LABEL IMAGE")

11
cmd/podman/search.go
View File

@ -1,13 +1,14 @@
package main
import (
"os"
"reflect"
"strings"
buildahcli "github.com/containers/buildah/pkg/cli"
"github.com/containers/buildah/pkg/formats"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/libpod/image"
"github.com/pkg/errors"
"github.com/spf13/cobra"
@ -45,7 +46,7 @@ func init() {
flags.BoolVar(&searchCommand.NoTrunc, "no-trunc", false, "Do not truncate the output")
// Disabled flags for the remote client
if !remote {
flags.StringVar(&searchCommand.Authfile, "authfile", shared.GetAuthFile(""), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&searchCommand.Authfile, "authfile", buildahcli.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.BoolVar(&searchCommand.TlsVerify, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
}
}
@ -65,6 +66,12 @@ func searchCmd(c *cliconfig.SearchValues) error {
return err
}
if c.Authfile != "" {
if _, err := os.Stat(c.Authfile); err != nil {
return errors.Wrapf(err, "error getting authfile %s", c.Authfile)
}
}
searchOptions := image.SearchOptions{
NoTrunc: c.NoTrunc,
Limit: c.Limit,

2
cmd/podman/shared/create.go
View File

@ -94,7 +94,7 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
ArchitectureChoice: c.String("override-arch"),
}
newImage, err := runtime.ImageRuntime().New(ctx, name, rtc.SignaturePolicyPath, GetAuthFile(c.String("authfile")), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType)
newImage, err := runtime.ImageRuntime().New(ctx, name, rtc.SignaturePolicyPath, c.String("authfile"), writer, &dockerRegistryOptions, image.SigningOptions{}, nil, pullType)
if err != nil {
return nil, nil, err
}

21
cmd/podman/shared/funcs.go
View File

@ -6,24 +6,19 @@ import (
"path/filepath"
"strings"
"github.com/containers/libpod/pkg/util"
"github.com/containers/image/v5/types"
"github.com/containers/libpod/libpod/image"
"github.com/google/shlex"
"github.com/pkg/errors"
)
func GetAuthFile(authfile string) string {
func GetSystemContext(authfile string) (*types.SystemContext, error) {
if authfile != "" {
return authfile
if _, err := os.Stat(authfile); err != nil {
return nil, errors.Wrapf(err, "error checking authfile path %s", authfile)
}
}
authfile = os.Getenv("REGISTRY_AUTH_FILE")
if authfile != "" {
return authfile
}
if runtimeDir, err := util.GetRuntimeDir(); err == nil {
return filepath.Join(runtimeDir, "containers/auth.json")
}
return ""
return image.GetSystemContext("", authfile, false), nil
}
func substituteCommand(cmd string) (string, error) {

7
test/e2e/create_test.go
View File

@ -297,4 +297,11 @@ var _ = Describe("Podman create", func() {
Expect(session.ExitCode()).To((Equal(0)))
Expect(string(session.Out.Contents())).To(ContainSubstring(ALPINEARM64DIGEST))
})
It("podman create --authfile with nonexist authfile", func() {
SkipIfRemote()
session := podmanTest.PodmanNoCache([]string{"create", "--authfile", "/tmp/nonexist", "--name=foo", ALPINE})
session.WaitWithDefaultTimeout()
Expect(session).To(Not(Equal(0)))
})
})

10
test/e2e/login_logout_test.go
View File

@ -123,6 +123,11 @@ var _ = Describe("Podman login and logout", func() {
json.Unmarshal(authInfo, &info)
fmt.Println(info)
// push should fail with nonexist authfile
session = podmanTest.Podman([]string{"push", "--authfile", "/tmp/nonexist", ALPINE, testImg})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))
session = podmanTest.Podman([]string{"push", "--authfile", authFile, ALPINE, testImg})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
@ -131,6 +136,11 @@ var _ = Describe("Podman login and logout", func() {
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
// logout should fail with nonexist authfile
session = podmanTest.Podman([]string{"logout", "--authfile", "/tmp/nonexist", server})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))
session = podmanTest.Podman([]string{"logout", "--authfile", authFile, server})
})

10
test/e2e/play_kube_test.go
View File

@ -209,6 +209,16 @@ var _ = Describe("Podman generate kube", func() {
processTestResult(f)
})
It("podman play kube fail with nonexist authfile", func() {
err := generateKubeYaml(getPod(), kubeYaml)
Expect(err).To(BeNil())
kube := podmanTest.Podman([]string{"play", "kube", "--authfile", "/tmp/nonexist", kubeYaml})
kube.WaitWithDefaultTimeout()
Expect(kube.ExitCode()).To(Not(Equal(0)))
})
It("podman play kube test correct command", func() {
err := generateKubeYaml(getPod(), kubeYaml)
Expect(err).To(BeNil())

7
test/e2e/pull_test.go
View File

@ -353,4 +353,11 @@ var _ = Describe("Podman pull", func() {
rmi.WaitWithDefaultTimeout()
Expect(rmi.ExitCode()).To(Equal(0))
})
It("podman pull from docker with nonexist --authfile", func() {
SkipIfRemote()
session := podmanTest.PodmanNoCache([]string{"pull", "--authfile", "/tmp/nonexist", ALPINE})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))
})
})

7
test/e2e/run_test.go
View File

@ -992,4 +992,11 @@ USER mail`
session.WaitWithDefaultTimeout()
Expect(session).To(ExitWithError())
})
It("podman run should fail with nonexist authfile", func() {
SkipIfRemote()
session := podmanTest.Podman([]string{"run", "--authfile", "/tmp/nonexist", ALPINE, "ls"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Not(Equal(0)))
})
})

15
test/e2e/runlabel_test.go
View File

@ -98,4 +98,19 @@ var _ = Describe("podman container runlabel", func() {
result.WaitWithDefaultTimeout()
Expect(result.ExitCode()).To(Equal(0))
})
It("runlabel should fail with nonexist authfile", func() {
SkipIfRemote()
image := "podman-runlabel-test:podman"
podmanTest.BuildImage(PodmanDockerfile, image, "false")
// runlabel should fail with nonexist authfile
result := podmanTest.Podman([]string{"container", "runlabel", "--authfile", "/tmp/nonexist", "RUN", image})
result.WaitWithDefaultTimeout()
Expect(result.ExitCode()).To(Not(Equal(0)))
result = podmanTest.Podman([]string{"rmi", image})
result.WaitWithDefaultTimeout()
Expect(result.ExitCode()).To(Equal(0))
})
})

8
test/e2e/search_test.go
View File

@ -391,4 +391,12 @@ registries = ['{{.Host}}:{{.Port}}']`
// cleanup
resetRegistriesConfigEnv()
})
// search should fail with nonexist authfile
It("podman search fail with nonexist --authfile", func() {
SkipIfRemote()
search := podmanTest.Podman([]string{"search", "--authfile", "/tmp/nonexist", ALPINE})
search.WaitWithDefaultTimeout()
Expect(search.ExitCode()).To(Not(Equal(0)))
})
})