remove pkg/registries

Pull the trigger on the `pkg/registries` package which acted as a proxy
for `c/image/pkg/sysregistriesv2`.  Callers should be using the packages
from c/image directly, if needed at all.

Also make use of libimage's SystemContext() method which returns a copy
of a system context, further reducing the risk of unintentionally
altering global data.

[NO TESTS NEEDED]

Signed-off-by: Valentin Rothberg <[email protected]>

Author: vrothberg

cmd/podman/common/completion.go

@@ -8,11 +8,11 @@ import (
 	"strings"
 
 	"github.com/containers/common/pkg/config"
+	"github.com/containers/image/v5/pkg/sysregistriesv2"
 	"github.com/containers/podman/v3/cmd/podman/registry"
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/pkg/domain/entities"
 	"github.com/containers/podman/v3/pkg/network"
-	"github.com/containers/podman/v3/pkg/registries"
 	"github.com/containers/podman/v3/pkg/rootless"
 	systemdDefine "github.com/containers/podman/v3/pkg/systemd/define"
 	"github.com/containers/podman/v3/pkg/util"
@@ -236,7 +236,7 @@ func getSecrets(cmd *cobra.Command, toComplete string) ([]string, cobra.ShellCom
 }
 
 func getRegistries() ([]string, cobra.ShellCompDirective) {
-	regs, err := registries.GetRegistries()
+	regs, err := sysregistriesv2.UnqualifiedSearchRegistries(nil)
 	if err != nil {
 		cobra.CompErrorln(err.Error())
 		return nil, cobra.ShellCompDirectiveNoFileComp

cmd/podman/login.go

@@ -9,7 +9,6 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v3/cmd/podman/common"
 	"github.com/containers/podman/v3/cmd/podman/registry"
-	"github.com/containers/podman/v3/pkg/registries"
 	"github.com/spf13/cobra"
 )
 
@@ -63,12 +62,29 @@ func login(cmd *cobra.Command, args []string) error {
 		skipTLS = types.NewOptionalBool(!loginOptions.tlsVerify)
 	}
 
-	sysCtx := types.SystemContext{
+	sysCtx := &types.SystemContext{
 		AuthFilePath:                loginOptions.AuthFile,
 		DockerCertPath:              loginOptions.CertDir,
 		DockerInsecureSkipTLSVerify: skipTLS,
-		SystemRegistriesConfPath:    registries.SystemRegistriesConfPath(),
 	}
+	setRegistriesConfPath(sysCtx)
 	loginOptions.GetLoginSet = cmd.Flag("get-login").Changed
-	return auth.Login(context.Background(), &sysCtx, &loginOptions.LoginOptions, args)
+	return auth.Login(context.Background(), sysCtx, &loginOptions.LoginOptions, args)
+}
+
+// setRegistriesConfPath sets the registries.conf path for the specified context.
+// NOTE: this is a verbatim copy from c/common/libimage which we're not using
+// to prevent leaking c/storage into this file.  Maybe this should go into c/image?
+func setRegistriesConfPath(systemContext *types.SystemContext) {
+	if systemContext.SystemRegistriesConfPath != "" {
+		return
+	}
+	if envOverride, ok := os.LookupEnv("CONTAINERS_REGISTRIES_CONF"); ok {
+		systemContext.SystemRegistriesConfPath = envOverride
+		return
+	}
+	if envOverride, ok := os.LookupEnv("REGISTRIES_CONFIG_PATH"); ok {
+		systemContext.SystemRegistriesConfPath = envOverride
+		return
+	}
 }

cmd/podman/logout.go

@@ -8,7 +8,6 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v3/cmd/podman/common"
 	"github.com/containers/podman/v3/cmd/podman/registry"
-	"github.com/containers/podman/v3/pkg/registries"
 	"github.com/spf13/cobra"
 )
 
@@ -48,9 +47,9 @@ func init() {
 
 // Implementation of podman-logout.
 func logout(cmd *cobra.Command, args []string) error {
-	sysCtx := types.SystemContext{
-		AuthFilePath:             logoutOptions.AuthFile,
-		SystemRegistriesConfPath: registries.SystemRegistriesConfPath(),
+	sysCtx := &types.SystemContext{
+		AuthFilePath: logoutOptions.AuthFile,
 	}
-	return auth.Logout(&sysCtx, &logoutOptions, args)
+	setRegistriesConfPath(sysCtx)
+	return auth.Logout(sysCtx, &logoutOptions, args)
 }

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/containernetworking/cni v0.8.1
 	github.com/containernetworking/plugins v0.9.1
 	github.com/containers/buildah v1.21.1
-	github.com/containers/common v0.40.2-0.20210623133759-d13a31743aec
+	github.com/containers/common v0.40.2-0.20210624120009-b1d3c4dc2515
 	github.com/containers/conmon v2.0.20+incompatible
 	github.com/containers/image/v5 v5.13.2
 	github.com/containers/ocicrypt v1.1.1

go.sum

@@ -221,8 +221,8 @@ github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRD
 github.com/containers/buildah v1.21.1 h1:e9LmTCUKUBLg72v5DnIOT/wc8ffkfB7LbpQBywLZo20=
 github.com/containers/buildah v1.21.1/go.mod h1:yPdlpVd93T+i91yGxrJbW1YOWrqN64j5ZhHOZmHUejs=
 github.com/containers/common v0.38.4/go.mod h1:egfpX/Y3+19Dz4Wa1eRZDdgzoEOeneieF9CQppKzLBg=
-github.com/containers/common v0.40.2-0.20210623133759-d13a31743aec h1:ZcteA2klZSZAZgVonwJAqezF6hdO9SMKUy49ZHXZd38=
-github.com/containers/common v0.40.2-0.20210623133759-d13a31743aec/go.mod h1:J23CfuhN1fAg85q5HxS6SKYhKbGqmqieKQqoHaQbEI8=
+github.com/containers/common v0.40.2-0.20210624120009-b1d3c4dc2515 h1:ih6akqzrwgKFRxLzdoRBFRUlIGbDWPoDYxhn5GihfXM=
+github.com/containers/common v0.40.2-0.20210624120009-b1d3c4dc2515/go.mod h1:J23CfuhN1fAg85q5HxS6SKYhKbGqmqieKQqoHaQbEI8=
 github.com/containers/conmon v2.0.20+incompatible h1:YbCVSFSCqFjjVwHTPINGdMX1F6JXHGTUje2ZYobNrkg=
 github.com/containers/conmon v2.0.20+incompatible/go.mod h1:hgwZ2mtuDrppv78a/cOBNiCm6O0UMWGx1mu7P00nu5I=
 github.com/containers/image/v5 v5.12.0/go.mod h1:VasTuHmOw+uD0oHCfApQcMO2+36SfyncoSahU7513Xs=

libpod/info.go

@@ -15,10 +15,10 @@ import (
 	"github.com/containers/buildah"
 	"github.com/containers/common/pkg/apparmor"
 	"github.com/containers/common/pkg/seccomp"
+	"github.com/containers/image/v5/pkg/sysregistriesv2"
 	"github.com/containers/podman/v3/libpod/define"
 	"github.com/containers/podman/v3/libpod/linkmode"
 	"github.com/containers/podman/v3/pkg/cgroups"
-	registries2 "github.com/containers/podman/v3/pkg/registries"
 	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/storage"
 	"github.com/containers/storage/pkg/system"
@@ -49,14 +49,16 @@ func (r *Runtime) info() (*define.Info, error) {
 	}
 	info.Store = storeInfo
 	registries := make(map[string]interface{})
-	data, err := registries2.GetRegistriesData()
+
+	sys := r.SystemContext()
+	data, err := sysregistriesv2.GetRegistries(sys)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting registries")
 	}
 	for _, reg := range data {
 		registries[reg.Prefix] = reg
 	}
-	regs, err := registries2.GetRegistries()
+	regs, err := sysregistriesv2.UnqualifiedSearchRegistries(sys)
 	if err != nil {
 		return nil, errors.Wrapf(err, "error getting registries")
 	}

libpod/runtime.go

@@ -29,7 +29,6 @@ import (
 	"github.com/containers/podman/v3/libpod/plugin"
 	"github.com/containers/podman/v3/libpod/shutdown"
 	"github.com/containers/podman/v3/pkg/cgroups"
-	"github.com/containers/podman/v3/pkg/registries"
 	"github.com/containers/podman/v3/pkg/rootless"
 	"github.com/containers/podman/v3/pkg/util"
 	"github.com/containers/storage"
@@ -932,7 +931,9 @@ func (r *Runtime) LibimageRuntime() *libimage.Runtime {
 
 // SystemContext returns the imagecontext
 func (r *Runtime) SystemContext() *types.SystemContext {
-	return r.imageContext
+	// Return the context from the libimage runtime.  libimage is sensitive
+	// to a number of env vars.
+	return r.libimageRuntime.SystemContext()
 }
 
 // GetOCIRuntimePath retrieves the path of the default OCI runtime.
@@ -1042,9 +1043,9 @@ func (r *Runtime) Reload() error {
 	if err := r.reloadStorageConf(); err != nil {
 		return err
 	}
-	if err := reloadRegistriesConf(); err != nil {
-		return err
-	}
+	// Invalidate the registries.conf cache. The next invocation will
+	// reload all data.
+	sysregistriesv2.InvalidateCache()
 	return nil
 }
 
@@ -1059,17 +1060,6 @@ func (r *Runtime) reloadContainersConf() error {
 	return nil
 }
 
-// reloadRegistries reloads the registries.conf
-func reloadRegistriesConf() error {
-	sysregistriesv2.InvalidateCache()
-	registries, err := sysregistriesv2.GetRegistries(&types.SystemContext{SystemRegistriesConfPath: registries.SystemRegistriesConfPath()})
-	if err != nil {
-		return err
-	}
-	logrus.Infof("applied new registry configuration: %+v", registries)
-	return nil
-}
-
 // reloadStorageConf reloads the storage.conf
 func (r *Runtime) reloadStorageConf() error {
 	configFile, err := storage.DefaultConfigFile(rootless.IsRootless())

libpod/runtime_img_test.go

@@ -9,9 +9,9 @@ import (
 
 	DockerClient "github.com/containers/image/v5/docker"
 	"github.com/containers/image/v5/types"
+	"github.com/containers/podman/v3/libpod"
 	"github.com/containers/podman/v3/pkg/api/handlers/utils"
 	"github.com/containers/podman/v3/pkg/domain/entities"
-	"github.com/containers/podman/v3/pkg/registries"
 	docker "github.com/docker/docker/api/types"
 	"github.com/pkg/errors"
 )
@@ -37,15 +37,13 @@ func Auth(w http.ResponseWriter, r *http.Request) {
 		skipTLS = types.NewOptionalBool(true)
 	}
 
+	runtime := r.Context().Value("runtime").(*libpod.Runtime)
+	sysCtx := runtime.SystemContext()
+	sysCtx.DockerInsecureSkipTLSVerify = skipTLS
+
 	fmt.Println("Authenticating with existing credentials...")
-	sysCtx := types.SystemContext{
-		AuthFilePath:                "",
-		DockerCertPath:              "",
-		DockerInsecureSkipTLSVerify: skipTLS,
-		SystemRegistriesConfPath:    registries.SystemRegistriesConfPath(),
-	}
 	registry := stripAddressOfScheme(authConfig.ServerAddress)
-	if err := DockerClient.CheckAuth(context.Background(), &sysCtx, authConfig.Username, authConfig.Password, registry); err == nil {
+	if err := DockerClient.CheckAuth(context.Background(), sysCtx, authConfig.Username, authConfig.Password, registry); err == nil {
 		utils.WriteResponse(w, http.StatusOK, entities.AuthReport{
 			IdentityToken: "",
 			Status:        "Login Succeeded",