Skip to content

Commit

Permalink
Don't decrypt images by default
Browse files Browse the repository at this point in the history 
A non-nil but empty decryption configuration
seems to be valid enough to trigger decryption in some
configurations, per
containers/podman#18196 .

Like in Skopeo and Podman, only decrypt when the user explicitly
instructs us to (e.g. not triggering decryption based on environment
variables).

Signed-off-by: Miloslav Trmač <[email protected]>
  • Loading branch information
@mtrmac
mtrmac committed Apr 24, 2023
1 parent 61c8187 commit 1bb65e2
Show file tree
Hide file tree
Showing 5 changed files with 27 additions and 13 deletions.
2 changes: 1 addition & 1 deletion internal/util/util.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ func ExportFromReader(input io.Reader, opts define.BuildOutputOption) error {

// DecryptConfig translates decryptionKeys into a DescriptionConfig structure
func DecryptConfig(decryptionKeys []string) (*encconfig.DecryptConfig, error) {
decryptConfig := &encconfig.DecryptConfig{}
var decryptConfig *encconfig.DecryptConfig
if len(decryptionKeys) > 0 {
// decryption
dcc, err := enchelpers.CreateCryptoConfig([]string{}, decryptionKeys)
Expand Down
14 changes: 14 additions & 0 deletions internal/util/util_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,20 @@ import (
"github.com/stretchr/testify/assert"
)

func TestDecryptConfig(t *testing.T) {
// Just a smoke test for the default path.
res, err := DecryptConfig(nil)
assert.NoError(t, err)
assert.Nil(t, res)
}

func TestEncryptConfig(t *testing.T) {
// Just a smoke test for the default path.
cfg, layers, err := EncryptConfig(nil, nil)
assert.NoError(t, err)
assert.Nil(t, cfg)
assert.Nil(t, layers)
}
func TestGetFormat(t *testing.T) {
_, err := GetFormat("bogus")
assert.NotNil(t, err)
Expand Down
4 changes: 2 additions & 2 deletions tests/bud.bats
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3997,8 +3997,8 @@ EOM
echo FROM localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest > $contextdir/Dockerfile

# Try to build from encrypted image without key
run_buildah 125 build $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword -t ${target} -f $contextdir/Dockerfile
assert "$output" =~ "missing private key needed for decryption"
run_buildah 1 build $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword -t ${target} -f $contextdir/Dockerfile
assert "$output" =~ "archive/tar: invalid tar header"

# Try to build from encrypted image with wrong key
run_buildah 125 build $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --decryption-key $contextdir/mykey2.pem -t ${target} -f $contextdir/Dockerfile
Expand Down
8 changes: 4 additions & 4 deletions tests/from.bats
View file
Original file line number Diff line number Diff line change
Expand Up @@ -427,8 +427,8 @@ load helpers
run_buildah push $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --encryption-key jwe:${TEST_SCRATCH_DIR}/tmp/mykey.pub busybox oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc

# Try encrypted image without key should fail
run_buildah 125 from oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
expect_output --substring "decrypting layer .* missing private key needed for decryption"
run_buildah 1 from oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
expect_output --substring "archive/tar: invalid tar header"

# Try encrypted image with wrong key should fail
run_buildah 125 from --decryption-key ${TEST_SCRATCH_DIR}/tmp/mykey2.pem oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
Expand All @@ -450,8 +450,8 @@ load helpers
run_buildah push $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --encryption-key jwe:${TEST_SCRATCH_DIR}/tmp/mykey.pub busybox docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest

# Try encrypted image without key should fail
run_buildah 125 from --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "decrypting layer .* missing private key needed for decryption"
run_buildah 1 from --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "archive/tar: invalid tar header"

# Try encrypted image with wrong key should fail
run_buildah 125 from --tls-verify=false --creds testuser:testpassword --decryption-key ${TEST_SCRATCH_DIR}/tmp/mykey2.pem docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
Expand Down
12 changes: 6 additions & 6 deletions tests/pull.bats
View file
Original file line number Diff line number Diff line change
Expand Up @@ -190,8 +190,8 @@ load helpers
run_buildah push $WITH_POLICY_JSON --encryption-key jwe:${TEST_SCRATCH_DIR}/tmp/mykey.pub busybox oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc

# Try to pull encrypted image without key should fail
run_buildah 125 pull $WITH_POLICY_JSON oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
expect_output --substring "decrypting layer .* missing private key needed for decryption"
run_buildah 1 pull $WITH_POLICY_JSON oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
expect_output --substring "archive/tar: invalid tar header"

# Try to pull encrypted image with wrong key should fail
run_buildah 125 pull $WITH_POLICY_JSON --decryption-key ${TEST_SCRATCH_DIR}/tmp/mykey2.pem oci:${TEST_SCRATCH_DIR}/tmp/busybox_enc
Expand All @@ -213,8 +213,8 @@ load helpers
run_buildah push $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --encryption-key jwe:${TEST_SCRATCH_DIR}/tmp/mykey.pub busybox docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest

# Try to pull encrypted image without key should fail
run_buildah 125 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "decrypting layer .* missing private key needed for decryption"
run_buildah 1 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "archive/tar: invalid tar header"

# Try to pull encrypted image with wrong key should fail, with diff. msg
run_buildah 125 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --decryption-key ${TEST_SCRATCH_DIR}/tmp/mykey2.pem docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
Expand All @@ -240,8 +240,8 @@ load helpers
run_buildah commit --iidfile /dev/null --tls-verify=false --creds testuser:testpassword $WITH_POLICY_JSON --encryption-key jwe:${TEST_SCRATCH_DIR}/tmp/mykey.pub -q $cid docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest

# Try to pull encrypted image without key should fail
run_buildah 125 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "decrypting layer .* missing private key needed for decryption"
run_buildah 1 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
expect_output --substring "archive/tar: invalid tar header"

# Try to pull encrypted image with wrong key should fail
run_buildah 125 pull $WITH_POLICY_JSON --tls-verify=false --creds testuser:testpassword --decryption-key ${TEST_SCRATCH_DIR}/tmp/mykey2.pem docker://localhost:${REGISTRY_PORT}/buildah/busybox_encrypted:latest
Expand Down

0 comments on commit 1bb65e2

Please sign in to comment.