forked from containers/skopeo
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request containers#1610 from Jamstah/sign-identity
Add option to specify the identity for signing
- Loading branch information
Showing
27 changed files
with
154 additions
and
113 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -969,20 +969,6 @@ func (s *CopySuite) TestCopyAtomicExtension(c *check.C) { | |
| assertDirImagesAreEqual(c, filepath.Join(topDir, "dirDA"), filepath.Join(topDir, "dirDD")) | ||
| } | ||
|
|
||
| // copyWithSignedIdentity creates a copy of an unsigned image, adding a signature for an unrelated identity | ||
| // This should be easier than using standalone-sign. | ||
| func copyWithSignedIdentity(c *check.C, src, dest, signedIdentity, signBy, registriesDir string) { | ||
| topDir := c.MkDir() | ||
|
|
||
| signingDir := filepath.Join(topDir, "signing-temp") | ||
| assertSkopeoSucceeds(c, "", "copy", "--src-tls-verify=false", src, "dir:"+signingDir) | ||
| c.Logf("%s", combinedOutputOfCommand(c, "ls", "-laR", signingDir)) | ||
| assertSkopeoSucceeds(c, "^$", "standalone-sign", "-o", filepath.Join(signingDir, "signature-1"), | ||
| filepath.Join(signingDir, "manifest.json"), signedIdentity, signBy) | ||
| c.Logf("%s", combinedOutputOfCommand(c, "ls", "-laR", signingDir)) | ||
| assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--dest-tls-verify=false", "dir:"+signingDir, dest) | ||
| } | ||
|
|
||
| // Both mirroring support in registries.conf, and mirrored remapIdentity support in policy.json | ||
| func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) { | ||
| const regPrefix = "docker://localhost:5006/myns/mirroring-" | ||
|
|
@@ -1026,10 +1012,12 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) { | |
| assertSkopeoFails(c, ".*Source image rejected: None of the signatures were accepted, reasons: Signature for identity localhost:5006/myns/mirroring-primary:direct is not accepted; Signature for identity localhost:5006/myns/mirroring-mirror:mirror-signed is not accepted.*", | ||
| "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"primary:mirror-signed", dirDest) | ||
|
|
||
| // Fail if we specify an unqualified identity | ||
| assertSkopeoFails(c, ".*Could not parse --sign-identity: repository name must be canonical.*", | ||
| "--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "[email protected]", "--sign-identity=this-is-not-fully-specified", regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed") | ||
|
|
||
| // Create a signature for mirroring-primary:primary-signed without pushing there. | ||
| copyWithSignedIdentity(c, regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed", | ||
| "localhost:5006/myns/mirroring-primary:primary-signed", "[email protected]", | ||
| registriesDir) | ||
| assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "[email protected]", "--sign-identity=localhost:5006/myns/mirroring-primary:primary-signed", regPrefix+"primary:unsigned", regPrefix+"mirror:primary-signed") | ||
| // Verify that a correctly signed image for the primary is accessible using the primary's reference | ||
| assertSkopeoSucceeds(c, "", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"primary:primary-signed", dirDest) | ||
| // … but verify that while it is accessible using the mirror location | ||
|
|
@@ -1044,9 +1032,7 @@ func (s *CopySuite) TestCopyVerifyingMirroredSignatures(c *check.C) { | |
| // … it is NOT accessible when requiring a signature … | ||
| assertSkopeoFails(c, ".*Source image rejected: None of the signatures were accepted, reasons: Signature for identity localhost:5006/myns/mirroring-primary:direct is not accepted; Signature for identity localhost:5006/myns/mirroring-mirror:mirror-signed is not accepted; Signature for identity localhost:5006/myns/mirroring-primary:primary-signed is not accepted.*", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"remap:remapped", dirDest) | ||
| // … until signed. | ||
| copyWithSignedIdentity(c, regPrefix+"remap:remapped", regPrefix+"remap:remapped", | ||
| "localhost:5006/myns/mirroring-primary:remapped", "[email protected]", | ||
| registriesDir) | ||
| assertSkopeoSucceeds(c, "", "--registries.d", registriesDir, "copy", "--src-tls-verify=false", "--dest-tls-verify=false", "[email protected]", "--sign-identity=localhost:5006/myns/mirroring-primary:remapped", regPrefix+"remap:remapped", regPrefix+"remap:remapped") | ||
| assertSkopeoSucceeds(c, "", "--policy", policy, "--registries.d", registriesDir, "--registries-conf", "fixtures/registries.conf", "copy", "--src-tls-verify=false", regPrefix+"remap:remapped", dirDest) | ||
| // To be extra clear about the semantics, verify that the signedPrefix (primary) location never exists | ||
| // and only the remapped prefix (mirror) is accessed. | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.