-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #13247 from rhatdan/trust
Cleanup display of trust with transports
- Loading branch information
Showing
8 changed files
with
197 additions
and
44 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,6 +40,8 @@ Trust may be updated using the command **podman image trust set** for an existin | |
| #### **--help**, **-h** | ||
| Print usage statement. | ||
|
|
||
| ### set OPTIONS | ||
|
|
||
| #### **--pubkeysfile**=*KEY1*, **-f** | ||
| A path to an exported public key on the local system. Key paths | ||
| will be referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to | ||
|
|
@@ -54,14 +56,17 @@ Trust may be updated using the command **podman image trust set** for an existin | |
| registry scope | ||
| **reject**: do not accept images for this registry scope | ||
|
|
||
| ## show OPTIONS | ||
|
|
||
| #### **--raw** | ||
| Output trust policy file as raw JSON | ||
| ### show OPTIONS | ||
|
|
||
| #### **--json**, **-j** | ||
| Output trust as JSON for machine parsing | ||
|
|
||
| #### **--noheading**, **-n** | ||
| Omit the table headings from the trust listings | ||
|
|
||
| #### **--raw** | ||
| Output trust policy file as raw JSON | ||
|
|
||
| ## EXAMPLES | ||
|
|
||
| Accept all unsigned images from a registry | ||
|
|
@@ -74,15 +79,110 @@ Modify default trust policy | |
|
|
||
| Display system trust policy | ||
|
|
||
| sudo podman image trust show | ||
| podman image trust show | ||
| ``` | ||
| TRANSPORT NAME TYPE ID STORE | ||
| all default reject | ||
| repository docker.io/library accept | ||
| repository registry.access.redhat.com signed [email protected] https://access.redhat.com/webassets/docker/content/sigstore | ||
| repository registry.redhat.io signed [email protected] https://registry.redhat.io/containers/sigstore | ||
| repository docker.io reject | ||
| docker-daemon accept | ||
| ``` | ||
|
|
||
| Display trust policy file | ||
|
|
||
| sudo podman image trust show --raw | ||
| podman image trust show --raw | ||
| ``` | ||
| { | ||
| "default": [ | ||
| { | ||
| "type": "reject" | ||
| } | ||
| ], | ||
| "transports": { | ||
| "docker": { | ||
| "docker.io": [ | ||
| { | ||
| "type": "reject" | ||
| } | ||
| ], | ||
| "docker.io/library": [ | ||
| { | ||
| "type": "insecureAcceptAnything" | ||
| } | ||
| ], | ||
| "registry.access.redhat.com": [ | ||
| { | ||
| "type": "signedBy", | ||
| "keyType": "GPGKeys", | ||
| "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" | ||
| } | ||
| ], | ||
| "registry.redhat.io": [ | ||
| { | ||
| "type": "signedBy", | ||
| "keyType": "GPGKeys", | ||
| "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" | ||
| } | ||
| ] | ||
| }, | ||
| "docker-daemon": { | ||
| "": [ | ||
| { | ||
| "type": "insecureAcceptAnything" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| Display trust as JSON | ||
|
|
||
| sudo podman image trust show --json | ||
| podman image trust show --json | ||
| ``` | ||
| [ | ||
| { | ||
| "transport": "all", | ||
| "name": "* (default)", | ||
| "repo_name": "default", | ||
| "type": "reject" | ||
| }, | ||
| { | ||
| "transport": "repository", | ||
| "name": "docker.io", | ||
| "repo_name": "docker.io", | ||
| "type": "reject" | ||
| }, | ||
| { | ||
| "transport": "repository", | ||
| "name": "docker.io/library", | ||
| "repo_name": "docker.io/library", | ||
| "type": "accept" | ||
| }, | ||
| { | ||
| "transport": "repository", | ||
| "name": "registry.access.redhat.com", | ||
| "repo_name": "registry.access.redhat.com", | ||
| "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", | ||
| "type": "signed", | ||
| "gpg_id": "[email protected]" | ||
| }, | ||
| { | ||
| "transport": "repository", | ||
| "name": "registry.redhat.io", | ||
| "repo_name": "registry.redhat.io", | ||
| "sigstore": "https://registry.redhat.io/containers/sigstore", | ||
| "type": "signed", | ||
| "gpg_id": "[email protected]" | ||
| }, | ||
| { | ||
| "transport": "docker-daemon", | ||
| "type": "accept" | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| ## SEE ALSO | ||
| **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)** | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,29 +39,26 @@ var _ = Describe("Podman trust", func() { | |
| }) | ||
|
|
||
| It("podman image trust show", func() { | ||
| session := podmanTest.Podman([]string{"image", "trust", "show", "--registrypath", filepath.Join(INTEGRATION_ROOT, "test"), "--policypath", filepath.Join(INTEGRATION_ROOT, "test/policy.json")}) | ||
| session := podmanTest.Podman([]string{"image", "trust", "show", "-n", "--registrypath", filepath.Join(INTEGRATION_ROOT, "test"), "--policypath", filepath.Join(INTEGRATION_ROOT, "test/policy.json")}) | ||
| session.WaitWithDefaultTimeout() | ||
| Expect(session).Should(Exit(0)) | ||
| outArray := session.OutputToStringArray() | ||
| Expect(outArray).To(HaveLen(3)) | ||
|
|
||
| // Repository order is not guaranteed. So, check that | ||
| // all expected lines appear in output; we also check total number of lines, so that handles all of them. | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^default\s+accept\s*$`)) | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^docker.io/library/hello-world\s+reject\s*$`)) | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^registry.access.redhat.com\s+signedBy\[email protected], [email protected]\s+https://access.redhat.com/webassets/docker/content/sigstore\s*$`)) | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^all\s+default\s+accept\s*$`)) | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^repository\s+docker.io/library/hello-world\s+reject\s*$`)) | ||
| Expect(string(session.Out.Contents())).To(MatchRegexp(`(?m)^repository\s+registry.access.redhat.com\s+signed\[email protected], [email protected]\s+https://access.redhat.com/webassets/docker/content/sigstore\s*$`)) | ||
| }) | ||
|
|
||
| It("podman image trust set", func() { | ||
| path, err := os.Getwd() | ||
| if err != nil { | ||
| os.Exit(1) | ||
| } | ||
| session := podmanTest.Podman([]string{"image", "trust", "set", "--policypath", filepath.Join(filepath.Dir(path), "trust_set_test.json"), "-t", "accept", "default"}) | ||
| policyJSON := filepath.Join(podmanTest.TempDir, "trust_set_test.json") | ||
| session := podmanTest.Podman([]string{"image", "trust", "set", "--policypath", policyJSON, "-t", "accept", "default"}) | ||
| session.WaitWithDefaultTimeout() | ||
| Expect(session).Should(Exit(0)) | ||
| var teststruct map[string][]map[string]string | ||
| policyContent, err := ioutil.ReadFile(filepath.Join(filepath.Dir(path), "trust_set_test.json")) | ||
| policyContent, err := ioutil.ReadFile(policyJSON) | ||
| if err != nil { | ||
| os.Exit(1) | ||
| } | ||
|
|
@@ -88,25 +85,23 @@ var _ = Describe("Podman trust", func() { | |
| } | ||
| Expect(repoMap).To(Equal(map[string][]map[string]string{ | ||
| "* (default)": {{ | ||
| "type": "accept", | ||
| "transport": "all", | ||
| "name": "* (default)", | ||
| "repo_name": "default", | ||
| "sigstore": "", | ||
| "transport": "", | ||
| "type": "accept", | ||
| }}, | ||
| "docker.io/library/hello-world": {{ | ||
| "transport": "repository", | ||
| "name": "docker.io/library/hello-world", | ||
| "repo_name": "docker.io/library/hello-world", | ||
| "sigstore": "", | ||
| "transport": "", | ||
| "type": "reject", | ||
| }}, | ||
| "registry.access.redhat.com": {{ | ||
| "transport": "repository", | ||
| "name": "registry.access.redhat.com", | ||
| "repo_name": "registry.access.redhat.com", | ||
| "sigstore": "https://access.redhat.com/webassets/docker/content/sigstore", | ||
| "transport": "", | ||
| "type": "signedBy", | ||
| "type": "signed", | ||
| "gpg_id": "[email protected], [email protected]", | ||
| }}, | ||
| })) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| #!/usr/bin/env bats -*- bats -*- | ||
| # | ||
| # tests for podman image trust | ||
| # | ||
|
|
||
| load helpers | ||
|
|
||
| @test "podman image trust set" { | ||
| skip_if_remote "trust only works locally" | ||
| policypath=$PODMAN_TMPDIR/policy.json | ||
| run_podman 125 image trust set --policypath=$policypath --type=bogus default | ||
| is "$output" "Error: invalid choice: bogus.*" "error from --type=bogus" | ||
|
|
||
| run_podman image trust set --policypath=$policypath --type=accept default | ||
| run_podman image trust show --policypath=$policypath | ||
| is "$output" ".*all *default *accept" "default policy should be accept" | ||
|
|
||
| run_podman image trust set --policypath=$policypath --type=reject default | ||
| run_podman image trust show --policypath=$policypath | ||
| is "$output" ".*all *default *reject" "default policy should be reject" | ||
|
|
||
| run_podman image trust set --policypath=$policypath --type=reject docker.io | ||
| run_podman image trust show --policypath=$policypath | ||
| is "$output" ".*all *default *reject" "default policy should still be reject" | ||
| is "$output" ".*repository *docker.io *reject" "docker.io should also be reject" | ||
|
|
||
| run_podman image trust show --policypath=$policypath --json | ||
| subset=$(jq -r '.[0] | .repo_name, .type' <<<"$output" | fmt) | ||
| is "$subset" "default reject" "--json also shows default" | ||
| subset=$(jq -r '.[1] | .repo_name, .type' <<<"$output" | fmt) | ||
| is "$subset" "docker.io reject" "--json also shows docker.io" | ||
|
|
||
| run_podman image trust set --policypath=$policypath --type=accept docker.io | ||
| run_podman image trust show --policypath=$policypath --json | ||
| subset=$(jq -r '.[0] | .repo_name, .type' <<<"$output" | fmt) | ||
| is "$subset" "default reject" "--json, default is still reject" | ||
| subset=$(jq -r '.[1] | .repo_name, .type' <<<"$output" | fmt) | ||
| is "$subset" "docker.io accept" "--json, docker.io should now be accept" | ||
|
|
||
| run cat $policypath | ||
| policy=$output | ||
| run_podman image trust show --policypath=$policypath --raw | ||
| is "$output" "$policy" "output should show match content of policy.json" | ||
| } | ||
|
|
||
| # vim: filetype=sh |
This file was deleted.
Oops, something went wrong.