docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add support for ecr, gcp, acr authn

Browse Source
This commit is contained in:
mrjoelkamp
2024-06-18 09:59:04 -05:00
parent 8e3c6a2ec5
commit f611f81fff
7 changed files with 113 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
pkg/mirror/mirror.go
View File

@@ -5,12 +5,15 @@ import (
"log"
"os"
ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
acr "github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
"github.com/docker/attest/internal/embed"
"github.com/docker/attest/pkg/tuf"
"github.com/google/go-containerregistry/pkg/authn"
"github.com/google/go-containerregistry/pkg/name"
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/google/go-containerregistry/pkg/v1/empty"
"github.com/google/go-containerregistry/pkg/v1/google"
"github.com/google/go-containerregistry/pkg/v1/layout"
"github.com/google/go-containerregistry/pkg/v1/remote"
)
@@ -27,18 +30,19 @@ func NewTufMirror(root []byte, tufPath, metadataURL, targetsURL string, versionC
}
func PushImageToRegistry(image v1.Image, imageName string) error {
// Parse the image name
ref, err := name.ParseReference(imageName)
if err != nil {
log.Fatalf("Failed to parse image name: %v", err)
}
// Get the authenticator from the default Docker keychain
auth, err := authn.DefaultKeychain.Resolve(ref.Context())
if err != nil {
log.Fatalf("Failed to get authenticator: %v", err)
}
// Create a multi-keychain that will use the default Docker, Google, ECR or ACR keychain
keychain := authn.NewMultiKeychain(
authn.DefaultKeychain,
google.Keychain,
authn.NewKeychainFromHelper(ecr.NewECRHelper()),
authn.NewKeychainFromHelper(acr.NewACRCredentialsHelper()),
)
// Push the image to the registry
return remote.Write(ref, image, remote.WithAuth(auth))
return remote.Write(ref, image, remote.WithAuthFromKeychain(keychain))
}
func PushIndexToRegistry(image v1.ImageIndex, imageName string) error {
@@ -47,13 +51,15 @@ func PushIndexToRegistry(image v1.ImageIndex, imageName string) error {
if err != nil {
log.Fatalf("Failed to parse image name: %v", err)
}
// Get the authenticator from the default Docker keychain
auth, err := authn.DefaultKeychain.Resolve(ref.Context())
if err != nil {
log.Fatalf("Failed to get authenticator: %v", err)
}
// Create a multi-keychain that will use the default Docker, Google, ECR or ACR keychain
keychain := authn.NewMultiKeychain(
authn.DefaultKeychain,
google.Keychain,
authn.NewKeychainFromHelper(ecr.NewECRHelper()),
authn.NewKeychainFromHelper(acr.NewACRCredentialsHelper()),
)
// Push the index to the registry
return remote.WriteIndex(ref, image, remote.WithAuth(auth))
return remote.WriteIndex(ref, image, remote.WithAuthFromKeychain(keychain))
}
func SaveImageAsOCILayout(image v1.Image, path string) error {