docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: make common authn function

Browse Source
This commit is contained in:
mrjoelkamp
2024-06-18 11:55:30 -05:00
parent ff38975c76
commit 08e823e05b
6 changed files with 42 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/oci/authn.go Normal file
View File

@@ -0,0 +1,23 @@
package oci
import (
ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
acr "github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
"github.com/google/go-containerregistry/pkg/authn"
"github.com/google/go-containerregistry/pkg/v1/google"
"github.com/google/go-containerregistry/pkg/v1/remote"
)
func MultiKeychainOption() remote.Option {
return remote.WithAuthFromKeychain(MultiKeychainAll())
}
func MultiKeychainAll() authn.Keychain {
// Create a multi-keychain that will use the default Docker, Google, ECR or ACR keychain
return authn.NewMultiKeychain(
authn.DefaultKeychain,
google.Keychain,
authn.NewKeychainFromHelper(ecr.NewECRHelper()),
authn.NewKeychainFromHelper(acr.NewACRCredentialsHelper()),
)
}

16
pkg/oci/oci.go
View File

@@ -6,15 +6,11 @@ import (
"fmt"
"strings"
ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
acr "github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
"github.com/containerd/containerd/platforms"
"github.com/distribution/reference"
att "github.com/docker/attest/pkg/attestation"
"github.com/google/go-containerregistry/pkg/authn"
"github.com/google/go-containerregistry/pkg/name"
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/google/go-containerregistry/pkg/v1/google"
"github.com/google/go-containerregistry/pkg/v1/layout"
"github.com/google/go-containerregistry/pkg/v1/remote"
"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
@@ -245,6 +241,9 @@ func (r *ReferrersResolver) resolveAttestations(ctx context.Context) error {
return fmt.Errorf("failed to parse reference: %w", err)
}
subjectDigest, err := r.ImageDigest(ctx)
if err != nil {
return fmt.Errorf("failed to get image digest: %w", err)
}
var referrersSubjectRef name.Digest
if r.referrersRepo != "" {
@@ -459,14 +458,7 @@ func FetchAttestationManifest(ctx context.Context, image string, platform *v1.Pl
func WithOptions(ctx context.Context, platform *v1.Platform) []remote.Option {
// prepare options
// Create a multi-keychain that will use the default Docker, Google, ECR or ACR keychain
keychain := authn.NewMultiKeychain(
authn.DefaultKeychain,
google.Keychain,
authn.NewKeychainFromHelper(ecr.NewECRHelper()),
authn.NewKeychainFromHelper(acr.NewACRCredentialsHelper()),
)
options := []remote.Option{remote.WithAuthFromKeychain(keychain), remote.WithTransport(HttpTransport()), remote.WithContext(ctx)}
options := []remote.Option{MultiKeychainOption(), remote.WithTransport(HttpTransport()), remote.WithContext(ctx)}
// add in platform into remote Get operation; this might conflict with an explicit digest, but we are trying anyway
if platform != nil {

13
pkg/oci/types.go
View File

@@ -4,12 +4,8 @@ import (
"fmt"
"log"
ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
acr "github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
"github.com/google/go-containerregistry/pkg/authn"
"github.com/google/go-containerregistry/pkg/name"
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/google/go-containerregistry/pkg/v1/google"
"github.com/google/go-containerregistry/pkg/v1/layout"
"github.com/google/go-containerregistry/pkg/v1/remote"
)
@@ -53,15 +49,8 @@ func SubjectIndexFromRemote(image string) (*SubjectIndex, error) {
if err != nil {
log.Fatalf("Failed to parse image name: %v", err)
}
// Create a multi-keychain that will use the default Docker, Google, ECR or ACR keychain
keychain := authn.NewMultiKeychain(
authn.DefaultKeychain,
google.Keychain,
authn.NewKeychainFromHelper(ecr.NewECRHelper()),
authn.NewKeychainFromHelper(acr.NewACRCredentialsHelper()),
)
// Pull the image from the registry
idx, err := remote.Index(ref, remote.WithAuthFromKeychain(keychain))
idx, err := remote.Index(ref, MultiKeychainOption())
if err != nil {
return nil, fmt.Errorf("failed to pull image %s: %w", image, err)
}