Guest24897
/
DockerCLI
mirror of https://github.com/docker/cli.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Small content trust enhancement 

- `replaceDockerfileForContentTrust` is only used when content trust is
  enabled, so remove the boolean.
- rename `isContentTrustEnabled` to `contentTrustEnabled`

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
This commit is contained in:
Vincent Demeester 2018-03-14 17:36:23 +01:00
parent 6d7c23a6b4
commit 63ebcae382
No known key found for this signature in database
GPG Key ID: 083CC6FD6EB699A3
3 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cli/command/cli.go
View File

@ -123,7 +123,7 @@ func (cli *DockerCli) ClientInfo() ClientInfo {
return cli.clientInfo return cli.clientInfo
} }
// ContentTrustEnabled returns if content trust has been enabled by an // ContentTrustEnabled returns whether content trust has been enabled by an
// environment variable. // environment variable.
func (cli *DockerCli) ContentTrustEnabled() bool { func (cli *DockerCli) ContentTrustEnabled() bool {
return cli.contentTrust return cli.contentTrust

11
cli/command/image/build.go
View File

@ -297,7 +297,7 @@ func runBuild(dockerCli command.Cli, options buildOptions) error {
buildCtx = replaceDockerfileForContentTrust(ctx, buildCtx, relDockerfile, translator, &resolvedTags) buildCtx = replaceDockerfileForContentTrust(ctx, buildCtx, relDockerfile, translator, &resolvedTags)
} else if dockerfileCtx != nil { } else if dockerfileCtx != nil {
// if there was not archive context still do the possible replacements in Dockerfile // if there was not archive context still do the possible replacements in Dockerfile
newDockerfile, _, err := rewriteDockerfileFrom(ctx, dockerfileCtx, translator, !options.untrusted) newDockerfile, _, err := rewriteDockerfileFromForContentTrust(ctx, dockerfileCtx, translator)
if err != nil { if err != nil {
return err return err
} }
@ -500,11 +500,12 @@ type resolvedTag struct {
tagRef reference.NamedTagged tagRef reference.NamedTagged
} }
// rewriteDockerfileFrom rewrites the given Dockerfile by resolving images in // rewriteDockerfileFromForContentTrust rewrites the given Dockerfile by resolving images in
// "FROM <image>" instructions to a digest reference. `translator` is a // "FROM <image>" instructions to a digest reference. `translator` is a
// function that takes a repository name and tag reference and returns a // function that takes a repository name and tag reference and returns a
// trusted digest reference. // trusted digest reference.
func rewriteDockerfileFrom(ctx context.Context, dockerfile io.Reader, translator translatorFunc, istrusted bool) (newDockerfile []byte, resolvedTags []*resolvedTag, err error) { // This should be called *only* when content trust is enabled
func rewriteDockerfileFromForContentTrust(ctx context.Context, dockerfile io.Reader, translator translatorFunc) (newDockerfile []byte, resolvedTags []*resolvedTag, err error) {
scanner := bufio.NewScanner(dockerfile) scanner := bufio.NewScanner(dockerfile)
buf := bytes.NewBuffer(nil) buf := bytes.NewBuffer(nil)
@ -521,7 +522,7 @@ func rewriteDockerfileFrom(ctx context.Context, dockerfile io.Reader, translator
return nil, nil, err return nil, nil, err
} }
ref = reference.TagNameOnly(ref) ref = reference.TagNameOnly(ref)
if ref, ok := ref.(reference.NamedTagged); ok && istrusted { if ref, ok := ref.(reference.NamedTagged); ok {
trustedRef, err := translator(ctx, ref) trustedRef, err := translator(ctx, ref)
if err != nil { if err != nil {
return nil, nil, err return nil, nil, err
@ -574,7 +575,7 @@ func replaceDockerfileForContentTrust(ctx context.Context, inputTarStream io.Rea
// generated from a directory on the local filesystem, the // generated from a directory on the local filesystem, the
// Dockerfile will only appear once in the archive. // Dockerfile will only appear once in the archive.
var newDockerfile []byte var newDockerfile []byte
newDockerfile, *resolvedTags, err = rewriteDockerfileFrom(ctx, content, translator, true) newDockerfile, *resolvedTags, err = rewriteDockerfileFromForContentTrust(ctx, content, translator)
if err != nil { if err != nil {
pipeWriter.CloseWithError(err) pipeWriter.CloseWithError(err)
return return

4
cmd/docker/docker.go
View File

@ -156,7 +156,7 @@ func main() {
stdin, stdout, stderr := term.StdStreams() stdin, stdout, stderr := term.StdStreams()
logrus.SetOutput(stderr) logrus.SetOutput(stderr)
dockerCli := command.NewDockerCli(stdin, stdout, stderr, isContentTrustEnabled()) dockerCli := command.NewDockerCli(stdin, stdout, stderr, contentTrustEnabled())
cmd := newDockerCommand(dockerCli) cmd := newDockerCommand(dockerCli)
if err := cmd.Execute(); err != nil { if err := cmd.Execute(); err != nil {
@ -176,7 +176,7 @@ func main() {
} }
} }
func isContentTrustEnabled() bool { func contentTrustEnabled() bool {
if e := os.Getenv("DOCKER_CONTENT_TRUST"); e != "" { if e := os.Getenv("DOCKER_CONTENT_TRUST"); e != "" {
if t, err := strconv.ParseBool(e); t || err != nil { if t, err := strconv.ParseBool(e); t || err != nil {
// treat any other value as true // treat any other value as true