mirror of
https://github.com/containers/podman.git
synced 2025-08-16 12:28:48 +08:00
dc80267b59
* Support the `X-Registry-Auth` http-request header. * The content of the header is a base64 encoded JSON payload which can either be a single auth config or a map of auth configs (user+pw or token) with the corresponding registries being the keys. Vanilla Docker, projectatomic Docker and the bindings are transparantly supported. * Add a hidden `--registries-conf` flag. Buildah exposes the same flag, mostly for testing purposes. * Do all credential parsing in the client (i.e., `cmd/podman`) pass the username and password in the backend instead of unparsed credentials. * Add a `pkg/auth` which handles most of the heavy lifting. * Go through the authentication-handling code of most commands, bindings and endpoints. Migrate them to the new code and fix issues as seen. A final evaluation and more tests is still required *after* this change. * The manifest-push endpoint is missing certain parameters and should use the ABI function instead. Adding auth-support isn't really possible without these parts working. * The container commands and endpoints (i.e., create and run) have not been changed yet. The APIs don't yet account for the authfile. * Add authentication tests to `pkg/bindings`. Fixes: #6384 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
71 lines
3.0 KiB
Go
71 lines
3.0 KiB
Go
package image
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/containers/buildah/pkg/parse"
|
|
"github.com/containers/image/v5/docker/reference"
|
|
"github.com/containers/image/v5/types"
|
|
podmanVersion "github.com/containers/libpod/version"
|
|
)
|
|
|
|
// DockerRegistryOptions encapsulates settings that affect how we connect or
|
|
// authenticate to a remote registry.
|
|
type DockerRegistryOptions struct {
|
|
// DockerRegistryCreds is the user name and password to supply in case
|
|
// we need to pull an image from a registry, and it requires us to
|
|
// authenticate.
|
|
DockerRegistryCreds *types.DockerAuthConfig
|
|
// DockerCertPath is the location of a directory containing CA
|
|
// certificates which will be used to verify the registry's certificate
|
|
// (all files with names ending in ".crt"), and possibly client
|
|
// certificates and private keys (pairs of files with the same name,
|
|
// except for ".cert" and ".key" suffixes).
|
|
DockerCertPath string
|
|
// DockerInsecureSkipTLSVerify turns off verification of TLS
|
|
// certificates and allows connecting to registries without encryption
|
|
// - or forces it on even if registries.conf has the registry configured as insecure.
|
|
DockerInsecureSkipTLSVerify types.OptionalBool
|
|
// If not "", overrides the use of platform.GOOS when choosing an image or verifying OS match.
|
|
OSChoice string
|
|
// If not "", overrides the use of platform.GOARCH when choosing an image or verifying architecture match.
|
|
ArchitectureChoice string
|
|
// RegistriesConfPath can be used to override the default path of registries.conf.
|
|
RegistriesConfPath string
|
|
}
|
|
|
|
// GetSystemContext constructs a new system context from a parent context. the values in the DockerRegistryOptions, and other parameters.
|
|
func (o DockerRegistryOptions) GetSystemContext(parent *types.SystemContext, additionalDockerArchiveTags []reference.NamedTagged) *types.SystemContext {
|
|
sc := &types.SystemContext{
|
|
DockerAuthConfig: o.DockerRegistryCreds,
|
|
DockerCertPath: o.DockerCertPath,
|
|
DockerInsecureSkipTLSVerify: o.DockerInsecureSkipTLSVerify,
|
|
DockerArchiveAdditionalTags: additionalDockerArchiveTags,
|
|
OSChoice: o.OSChoice,
|
|
ArchitectureChoice: o.ArchitectureChoice,
|
|
BigFilesTemporaryDir: parse.GetTempDir(),
|
|
}
|
|
if parent != nil {
|
|
sc.SignaturePolicyPath = parent.SignaturePolicyPath
|
|
sc.AuthFilePath = parent.AuthFilePath
|
|
sc.DirForceCompress = parent.DirForceCompress
|
|
sc.DockerRegistryUserAgent = parent.DockerRegistryUserAgent
|
|
sc.OSChoice = parent.OSChoice
|
|
sc.ArchitectureChoice = parent.ArchitectureChoice
|
|
}
|
|
return sc
|
|
}
|
|
|
|
// GetSystemContext Constructs a new containers/image/types.SystemContext{} struct from the given signaturePolicy path
|
|
func GetSystemContext(signaturePolicyPath, authFilePath string, forceCompress bool) *types.SystemContext {
|
|
sc := &types.SystemContext{}
|
|
if signaturePolicyPath != "" {
|
|
sc.SignaturePolicyPath = signaturePolicyPath
|
|
}
|
|
sc.AuthFilePath = authFilePath
|
|
sc.DirForceCompress = forceCompress
|
|
sc.DockerRegistryUserAgent = fmt.Sprintf("libpod/%s", podmanVersion.Version)
|
|
|
|
return sc
|
|
}
|