-
Notifications
You must be signed in to change notification settings - Fork 99
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Jakub Warczarek <[email protected]>
- Loading branch information
1 parent
e4dc64e
commit 0ad13e6
Showing
5 changed files
with
249 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
|
|
||
| "oras.land/oras-go/v2/registry/remote/auth" | ||
| ) | ||
|
|
||
| // getCredentialsFromCache is a helper function to get the credential for serverAddress from authsRaw where key | ||
| // is an address and value is a raw JSON content. | ||
| func getCredentialFromAuthsRaw(authsRaw map[string]json.RawMessage, serverAddress string) (auth.Credential, error) { | ||
| authCfgBytes, ok := authsRaw[serverAddress] | ||
| if !ok { | ||
| // NOTE: the auth key for the server address may have been stored with | ||
| // a http/https prefix in legacy config files, e.g. "registry.example.com" | ||
| // can be stored as "https://registry.example.com/". | ||
| var matched bool | ||
| for addr, auth := range authsRaw { | ||
| if toHostname(addr) == serverAddress { | ||
| matched = true | ||
| authCfgBytes = auth | ||
| break | ||
| } | ||
| } | ||
| if !matched { | ||
| return auth.EmptyCredential, nil | ||
| } | ||
| } | ||
| var authCfg AuthConfig | ||
| if err := json.Unmarshal(authCfgBytes, &authCfg); err != nil { | ||
| return auth.EmptyCredential, fmt.Errorf("failed to unmarshal auth field: %w: %v", ErrInvalidConfigFormat, err) | ||
| } | ||
| return authCfg.Credential() | ||
| } |
67 changes: 67 additions & 0 deletions
67
registry/remote/credentials/internal/config/readonly_config.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| Copyright The ORAS Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package config | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
| "io" | ||
|
|
||
| "oras.land/oras-go/v2/registry/remote/auth" | ||
| ) | ||
|
|
||
| // ReadOnlyConfig represents authentication credentials parsed from a standard config file, | ||
| // which are read to use. It is read-only - only GetCredential is supported. | ||
| type ReadOnlyConfig struct { | ||
| auths map[string]auth.Credential | ||
| } | ||
|
|
||
| // LoadFromReader creates a new ReadOnlyConfig from the given reader that contains a standard | ||
| // config file content. It returns an error if the content is not in the expected format. | ||
| func LoadFromReader(reader io.Reader) (*ReadOnlyConfig, error) { | ||
| var content map[string]json.RawMessage | ||
| if err := json.NewDecoder(reader).Decode(&content); err != nil { | ||
| return nil, err | ||
| } | ||
| var authsRaw map[string]json.RawMessage | ||
| if authsBytes, ok := content[configFieldAuths]; ok { | ||
| if err := json.Unmarshal(authsBytes, &authsRaw); err != nil { | ||
| return nil, fmt.Errorf("failed to unmarshal auths field: %w: %v", ErrInvalidConfigFormat, err) | ||
| } | ||
| } | ||
|
|
||
| cfg := ReadOnlyConfig{ | ||
| auths: make(map[string]auth.Credential, len(authsRaw)), | ||
| } | ||
| for serverAddress := range authsRaw { | ||
| creds, err := getCredentialFromAuthsRaw(authsRaw, serverAddress) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| cfg.auths[serverAddress] = creds | ||
| } | ||
|
|
||
| return &cfg, nil | ||
| } | ||
|
|
||
| // GetCredential returns the credential for the given server address. For non-existent server address, | ||
| // it returns auth.EmptyCredential. | ||
| func (cfg *ReadOnlyConfig) GetCredential(serverAddress string) (auth.Credential, error) { | ||
| if v, ok := cfg.auths[serverAddress]; ok { | ||
| return v, nil | ||
| } | ||
| return auth.EmptyCredential, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| /* | ||
| Copyright The ORAS Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package credentials | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "io" | ||
|
|
||
| "oras.land/oras-go/v2/registry/remote/auth" | ||
| "oras.land/oras-go/v2/registry/remote/credentials/internal/config" | ||
| ) | ||
|
|
||
| // ReadOnlyFileStore implements a credentials store using the docker configuration file | ||
| // as an input. It supports only Get operation that works in the same way as for standard | ||
| // FileStore. | ||
| type ReadOnlyFileStore struct { | ||
| cfg *config.ReadOnlyConfig | ||
| } | ||
|
|
||
| // ErrReadOnlyStore is returned for operations | ||
| // Put(...) and Delete(...) for read-only store. | ||
| var ErrReadOnlyStore = errors.New("cannot modify content of the read-only store") | ||
|
|
||
| // NewReadOnlyFileStore creates a new file credentials store based on the given config, | ||
| // it returns an error if the config is not in the expected format. | ||
| func NewReadOnlyFileStore(reader io.Reader) (*ReadOnlyFileStore, error) { | ||
| cfg, err := config.LoadFromReader(reader) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return &ReadOnlyFileStore{cfg: cfg}, nil | ||
| } | ||
|
|
||
| // Get retrieves credentials from the store for the given server address. In case of non-existent | ||
| // server address, it returns auth.EmptyCredential. | ||
| func (fs *ReadOnlyFileStore) Get(_ context.Context, serverAddress string) (auth.Credential, error) { | ||
| return fs.cfg.GetCredential(serverAddress) | ||
| } | ||
|
|
||
| // Get always returns ErrReadOnlyStore. It's present to satisfy the Store interface. | ||
| func (fs *ReadOnlyFileStore) Put(_ context.Context, _ string, _ auth.Credential) error { | ||
| return ErrReadOnlyStore | ||
| } | ||
|
|
||
| // Delete always returns ErrReadOnlyStore. It's present to satisfy the Store interface. | ||
| func (fs *ReadOnlyFileStore) Delete(_ context.Context, _ string) error { | ||
| return ErrReadOnlyStore | ||
| } |