Skip to content

Commit c01696f

Browse files
thaJeztahthaJeztah
authored
Merge pull request #6603 from thaJeztah/remove_trust_integration
remove support for client-side docker content trust validation
2 parents 8d1525a + ad776d1 commit c01696f

File tree

29 files changed

+132
-550
lines changed

29 files changed

+132
-550
lines changed

‎cli/command/container/create.go‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,9 @@ import (
1717
"github.com/docker/cli/cli"
1818
"github.com/docker/cli/cli/command"
1919
"github.com/docker/cli/cli/command/completion"
20-
"github.com/docker/cli/cli/command/image"
2120
"github.com/docker/cli/cli/config/configfile"
2221
"github.com/docker/cli/cli/config/types"
2322
"github.com/docker/cli/cli/streams"
24-
"github.com/docker/cli/cli/trust"
2523
"github.com/docker/cli/internal/jsonstream"
2624
"github.com/docker/cli/opts"
2725
"github.com/moby/moby/api/types/mount"
@@ -41,7 +39,6 @@ const (
4139
type createOptions struct {
4240
name string
4341
platform string
44-
untrusted bool
4542
pull string // always, missing, never
4643
quiet bool
4744
useAPISocket bool
@@ -88,7 +85,9 @@ func newCreateCommand(dockerCLI command.Cli) *cobra.Command {
8885
_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
8986
_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms())
9087

91-
flags.BoolVar(&options.untrusted, "disable-content-trust", !trust.Enabled(), "Skip image verification")
88+
// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
89+
flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
90+
_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
9291
copts = addFlags(flags)
9392

9493
addCompletions(cmd, dockerCLI)
@@ -213,10 +212,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
213212
hostConfig := containerCfg.HostConfig
214213
networkingConfig := containerCfg.NetworkingConfig
215214

216-
var (
217-
trustedRef reference.Canonical
218-
namedRef reference.Named
219-
)
215+
var namedRef reference.Named
220216

221217
// TODO(thaJeztah): add a platform option-type / flag-type.
222218
if options.platform != "" {
@@ -240,15 +236,6 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
240236
}
241237
if named, ok := ref.(reference.Named); ok {
242238
namedRef = reference.TagNameOnly(named)
243-
244-
if taggedRef, ok := namedRef.(reference.NamedTagged); ok && !options.untrusted {
245-
var err error
246-
trustedRef, err = image.TrustedReference(ctx, dockerCli, taggedRef)
247-
if err != nil {
248-
return "", err
249-
}
250-
config.Image = reference.FamiliarString(trustedRef)
251-
}
252239
}
253240

254241
const dockerConfigPathInContainer = "/run/secrets/docker/config.json"
@@ -331,9 +318,6 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
331318
if err := pullImage(ctx, dockerCli, config.Image, options); err != nil {
332319
return err
333320
}
334-
if taggedRef, ok := namedRef.(reference.NamedTagged); ok && trustedRef != nil {
335-
return trust.TagTrusted(ctx, dockerCli.Client(), dockerCli.Err(), trustedRef, taggedRef)
336-
}
337321
return nil
338322
}
339323

‎cli/command/container/create_test.go‎

Lines changed: 3 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"github.com/docker/cli/cli"
1414
"github.com/docker/cli/cli/config/configfile"
1515
"github.com/docker/cli/internal/test"
16-
"github.com/docker/cli/internal/test/notary"
1716
"github.com/google/go-cmp/cmp"
1817
"github.com/moby/moby/api/types/container"
1918
"github.com/moby/moby/api/types/system"
@@ -136,10 +135,9 @@ func TestCreateContainerImagePullPolicy(t *testing.T) {
136135
}
137136
fakeCLI := test.NewFakeCli(apiClient)
138137
id, err := createContainer(context.Background(), fakeCLI, config, &createOptions{
139-
name: "name",
140-
platform: runtime.GOOS,
141-
untrusted: true,
142-
pull: tc.PullPolicy,
138+
name: "name",
139+
platform: runtime.GOOS,
140+
pull: tc.PullPolicy,
143141
})
144142

145143
if tc.ExpectedErrMsg != "" {
@@ -215,51 +213,6 @@ func TestCreateContainerValidateFlags(t *testing.T) {
215213
}
216214
}
217215

218-
func TestNewCreateCommandWithContentTrustErrors(t *testing.T) {
219-
testCases := []struct {
220-
name string
221-
args []string
222-
expectedError string
223-
notaryFunc test.NotaryClientFuncType
224-
}{
225-
{
226-
name: "offline-notary-server",
227-
notaryFunc: notary.GetOfflineNotaryRepository,
228-
expectedError: "client is offline",
229-
args: []string{"image:tag"},
230-
},
231-
{
232-
name: "uninitialized-notary-server",
233-
notaryFunc: notary.GetUninitializedNotaryRepository,
234-
expectedError: "remote trust data does not exist",
235-
args: []string{"image:tag"},
236-
},
237-
{
238-
name: "empty-notary-server",
239-
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
240-
expectedError: "No valid trust data for tag",
241-
args: []string{"image:tag"},
242-
},
243-
}
244-
for _, tc := range testCases {
245-
t.Run(tc.name, func(t *testing.T) {
246-
t.Setenv("DOCKER_CONTENT_TRUST", "true")
247-
fakeCLI := test.NewFakeCli(&fakeClient{
248-
createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
249-
return client.ContainerCreateResult{}, errors.New("shouldn't try to pull image")
250-
},
251-
})
252-
fakeCLI.SetNotaryClient(tc.notaryFunc)
253-
cmd := newCreateCommand(fakeCLI)
254-
cmd.SetOut(io.Discard)
255-
cmd.SetErr(io.Discard)
256-
cmd.SetArgs(tc.args)
257-
err := cmd.Execute()
258-
assert.ErrorContains(t, err, tc.expectedError)
259-
})
260-
}
261-
}
262-
263216
func TestNewCreateCommandWithWarnings(t *testing.T) {
264217
testCases := []struct {
265218
name string

‎cli/command/container/run.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"github.com/docker/cli/cli"
1313
"github.com/docker/cli/cli/command"
1414
"github.com/docker/cli/cli/command/completion"
15-
"github.com/docker/cli/cli/trust"
1615
"github.com/docker/cli/opts"
1716
"github.com/moby/moby/api/types/container"
1817
"github.com/moby/moby/client"
@@ -73,7 +72,10 @@ func newRunCommand(dockerCLI command.Cli) *cobra.Command {
7372
// TODO(thaJeztah): consider adding platform as "image create option" on containerOptions
7473
flags.StringVar(&options.platform, "platform", os.Getenv("DOCKER_DEFAULT_PLATFORM"), "Set platform if server is multi-platform capable")
7574
_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
76-
flags.BoolVar(&options.untrusted, "disable-content-trust", !trust.Enabled(), "Skip image verification")
75+
76+
// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
77+
flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
78+
_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
7779
copts = addFlags(flags)
7880

7981
_ = cmd.RegisterFlagCompletionFunc("detach-keys", completeDetachKeys)

‎cli/command/container/run_test.go‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"github.com/docker/cli/cli"
1414
"github.com/docker/cli/cli/streams"
1515
"github.com/docker/cli/internal/test"
16-
"github.com/docker/cli/internal/test/notary"
1716
"github.com/moby/moby/api/types"
1817
"github.com/moby/moby/api/types/container"
1918
"github.com/moby/moby/client"
@@ -295,54 +294,6 @@ func TestRunPullTermination(t *testing.T) {
295294
}
296295
}
297296

298-
func TestRunCommandWithContentTrustErrors(t *testing.T) {
299-
testCases := []struct {
300-
name string
301-
args []string
302-
expectedError string
303-
notaryFunc test.NotaryClientFuncType
304-
}{
305-
{
306-
name: "offline-notary-server",
307-
notaryFunc: notary.GetOfflineNotaryRepository,
308-
expectedError: "client is offline",
309-
args: []string{"image:tag"},
310-
},
311-
{
312-
name: "uninitialized-notary-server",
313-
notaryFunc: notary.GetUninitializedNotaryRepository,
314-
expectedError: "remote trust data does not exist",
315-
args: []string{"image:tag"},
316-
},
317-
{
318-
name: "empty-notary-server",
319-
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
320-
expectedError: "No valid trust data for tag",
321-
args: []string{"image:tag"},
322-
},
323-
}
324-
for _, tc := range testCases {
325-
t.Run(tc.name, func(t *testing.T) {
326-
t.Setenv("DOCKER_CONTENT_TRUST", "true")
327-
fakeCLI := test.NewFakeCli(&fakeClient{
328-
createContainerFunc: func(options client.ContainerCreateOptions) (client.ContainerCreateResult, error) {
329-
return client.ContainerCreateResult{}, errors.New("shouldn't try to pull image")
330-
},
331-
})
332-
fakeCLI.SetNotaryClient(tc.notaryFunc)
333-
cmd := newRunCommand(fakeCLI)
334-
cmd.SetArgs(tc.args)
335-
cmd.SetOut(io.Discard)
336-
cmd.SetErr(io.Discard)
337-
err := cmd.Execute()
338-
statusErr := cli.StatusError{}
339-
assert.Check(t, errors.As(err, &statusErr))
340-
assert.Check(t, is.Equal(statusErr.StatusCode, 125))
341-
assert.Check(t, is.ErrorContains(err, tc.expectedError))
342-
})
343-
}
344-
}
345-
346297
func TestRunContainerImagePullPolicyInvalid(t *testing.T) {
347298
cases := []struct {
348299
PullPolicy string

‎cli/command/image/build.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,9 @@ func newBuildCommand(dockerCLI command.Cli) *cobra.Command {
149149
flags.SetAnnotation("target", annotation.ExternalURL, []string{"https://docs.docker.com/reference/cli/docker/buildx/build/#target"})
150150
flags.StringVar(&options.imageIDFile, "iidfile", "", "Write the image ID to the file")
151151

152+
// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
152153
flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
153-
_ = flags.MarkHidden("disable-content-trust")
154+
_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
154155

155156
flags.StringVar(&options.platform, "platform", os.Getenv("DOCKER_DEFAULT_PLATFORM"), "Set platform if server is multi-platform capable")
156157
flags.SetAnnotation("platform", "version", []string{"1.38"})

‎cli/command/image/pull.go‎

Lines changed: 20 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,18 @@ import (
1313
"github.com/docker/cli/cli/command"
1414
"github.com/docker/cli/cli/command/completion"
1515
"github.com/docker/cli/cli/streams"
16-
"github.com/docker/cli/cli/trust"
1716
"github.com/docker/cli/internal/jsonstream"
18-
"github.com/moby/moby/api/pkg/authconfig"
19-
registrytypes "github.com/moby/moby/api/types/registry"
2017
"github.com/moby/moby/client"
2118
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
2219
"github.com/spf13/cobra"
2320
)
2421

2522
// pullOptions defines what and how to pull.
2623
type pullOptions struct {
27-
remote string
28-
all bool
29-
platform string
30-
quiet bool
31-
untrusted bool
24+
remote string
25+
all bool
26+
platform string
27+
quiet bool
3228
}
3329

3430
// newPullCommand creates a new `docker pull` command
@@ -57,7 +53,11 @@ func newPullCommand(dockerCLI command.Cli) *cobra.Command {
5753

5854
flags.BoolVarP(&opts.all, "all-tags", "a", false, "Download all tagged images in the repository")
5955
flags.BoolVarP(&opts.quiet, "quiet", "q", false, "Suppress verbose output")
60-
flags.BoolVar(&opts.untrusted, "disable-content-trust", !trust.Enabled(), "Skip image verification")
56+
57+
// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30
58+
flags.Bool("disable-content-trust", true, "Skip image verification (deprecated)")
59+
_ = flags.MarkDeprecated("disable-content-trust", "support for docker content trust was removed")
60+
6161
flags.StringVar(&opts.platform, "platform", os.Getenv("DOCKER_DEFAULT_PLATFORM"), "Set platform if server is multi-platform capable")
6262
_ = flags.SetAnnotation("platform", "version", []string{"1.32"})
6363
_ = cmd.RegisterFlagCompletionFunc("platform", completion.Platforms())
@@ -80,46 +80,22 @@ func runPull(ctx context.Context, dockerCLI command.Cli, opts pullOptions) error
8080
}
8181
}
8282

83+
var ociPlatforms []ocispec.Platform
8384
if opts.platform != "" {
8485
// TODO(thaJeztah): add a platform option-type / flag-type.
85-
if _, err = platforms.Parse(opts.platform); err != nil {
86+
p, err := platforms.Parse(opts.platform)
87+
if err != nil {
8688
return err
8789
}
90+
ociPlatforms = append(ociPlatforms, p)
8891
}
8992

90-
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, authResolver(dockerCLI), distributionRef.String())
93+
encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), distributionRef.String())
9194
if err != nil {
9295
return err
9396
}
9497

95-
// Check if reference has a digest
96-
_, isCanonical := distributionRef.(reference.Canonical)
97-
if !opts.untrusted && !isCanonical {
98-
if err := trustedPull(ctx, dockerCLI, imgRefAndAuth, opts); err != nil {
99-
return err
100-
}
101-
} else {
102-
if err := imagePullPrivileged(ctx, dockerCLI, imgRefAndAuth.Reference(), imgRefAndAuth.AuthConfig(), opts); err != nil {
103-
return err
104-
}
105-
}
106-
_, _ = fmt.Fprintln(dockerCLI.Out(), imgRefAndAuth.Reference().String())
107-
return nil
108-
}
109-
110-
// imagePullPrivileged pulls the image and displays it to the output
111-
func imagePullPrivileged(ctx context.Context, dockerCLI command.Cli, ref reference.Named, authConfig *registrytypes.AuthConfig, opts pullOptions) error {
112-
encodedAuth, err := authconfig.Encode(*authConfig)
113-
if err != nil {
114-
return err
115-
}
116-
var ociPlatforms []ocispec.Platform
117-
if opts.platform != "" {
118-
// Already validated.
119-
ociPlatforms = append(ociPlatforms, platforms.MustParse(opts.platform))
120-
}
121-
122-
responseBody, err := dockerCLI.Client().ImagePull(ctx, reference.FamiliarString(ref), client.ImagePullOptions{
98+
responseBody, err := dockerCLI.Client().ImagePull(ctx, reference.FamiliarString(distributionRef), client.ImagePullOptions{
12399
RegistryAuth: encodedAuth,
124100
PrivilegeFunc: nil,
125101
All: opts.all,
@@ -134,5 +110,9 @@ func imagePullPrivileged(ctx context.Context, dockerCLI command.Cli, ref referen
134110
if opts.quiet {
135111
out = streams.NewOut(io.Discard)
136112
}
137-
return jsonstream.Display(ctx, responseBody, out)
113+
if err := jsonstream.Display(ctx, responseBody, out); err != nil {
114+
return err
115+
}
116+
_, _ = fmt.Fprintln(dockerCLI.Out(), distributionRef.String())
117+
return nil
138118
}

‎cli/command/image/pull_test.go‎

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"testing"
88

99
"github.com/docker/cli/internal/test"
10-
"github.com/docker/cli/internal/test/notary"
1110
"github.com/moby/moby/client"
1211
"gotest.tools/v3/assert"
1312
is "gotest.tools/v3/assert/cmp"
@@ -89,49 +88,3 @@ func TestNewPullCommandSuccess(t *testing.T) {
8988
})
9089
}
9190
}
92-
93-
func TestNewPullCommandWithContentTrustErrors(t *testing.T) {
94-
testCases := []struct {
95-
name string
96-
args []string
97-
expectedError string
98-
notaryFunc test.NotaryClientFuncType
99-
}{
100-
{
101-
name: "offline-notary-server",
102-
notaryFunc: notary.GetOfflineNotaryRepository,
103-
expectedError: "client is offline",
104-
args: []string{"image:tag"},
105-
},
106-
{
107-
name: "uninitialized-notary-server",
108-
notaryFunc: notary.GetUninitializedNotaryRepository,
109-
expectedError: "remote trust data does not exist",
110-
args: []string{"image:tag"},
111-
},
112-
{
113-
name: "empty-notary-server",
114-
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
115-
expectedError: "No valid trust data for tag",
116-
args: []string{"image:tag"},
117-
},
118-
}
119-
for _, tc := range testCases {
120-
t.Run(tc.name, func(t *testing.T) {
121-
t.Setenv("DOCKER_CONTENT_TRUST", "true")
122-
cli := test.NewFakeCli(&fakeClient{
123-
imagePullFunc: func(ref string, options client.ImagePullOptions) (client.ImagePullResponse, error) {
124-
// FIXME(thaJeztah): how to mock this?
125-
return fakeStreamResult{ReadCloser: http.NoBody}, nil
126-
},
127-
})
128-
cli.SetNotaryClient(tc.notaryFunc)
129-
cmd := newPullCommand(cli)
130-
cmd.SetOut(io.Discard)
131-
cmd.SetErr(io.Discard)
132-
cmd.SetArgs(tc.args)
133-
err := cmd.Execute()
134-
assert.ErrorContains(t, err, tc.expectedError)
135-
})
136-
}
137-
}

0 commit comments

Comments
 (0)