Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: cosign image pulls #2599

Merged
merged 15 commits into from
Jun 7, 2024
8 changes: 7 additions & 1 deletion src/internal/packager/images/pull.go
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,13 @@ func Pull(ctx context.Context, cfg PullConfig) (map[transform.Image]v1.Image, er
return fmt.Errorf("%s resolved to an index, please select a specific platform to use", refInfo.Reference)
}

img = cache.Image(img, cache.NewFilesystemCache(cfg.CacheDirectory))
cacheImg, err := utils.OnlyHasImageLayers(img)
if err != nil {
return err
}
if cacheImg {
img = cache.Image(img, cache.NewFilesystemCache(cfg.CacheDirectory))
}

manifest, err := img.Manifest()
if err != nil {
Expand Down
40 changes: 40 additions & 0 deletions src/internal/packager/images/pull_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: 2021-Present The Zarf Authors

// Package images provides functions for building and pushing images.
package images

import (
"context"
"path/filepath"
"testing"

"github.com/defenseunicorns/zarf/src/pkg/transform"
"github.com/stretchr/testify/require"
)

func TestPull(t *testing.T) {
t.Run("pulling a cosign image is successful and doesn't add anything to the cache", func(t *testing.T) {

ref, err := transform.ParseImageRef("ghcr.io/stefanprodan/podinfo:sha256-57a654ace69ec02ba8973093b6a786faa15640575fbf0dbb603db55aca2ccec8.sig")
require.NoError(t, err)
tmpDestDir := t.TempDir()
tmpCacheDir := t.TempDir()
destDir := filepath.Join(tmpDestDir, "images")
pullConfig := PullConfig{
DestinationDirectory: destDir,
CacheDirectory: tmpCacheDir,
ImageList: []transform.Image{
ref,
},
}

_, err = Pull(context.Background(), pullConfig)
require.NoError(t, err)
require.FileExists(t, filepath.Join(destDir, "blobs/sha256/3e84ea487b4c52a3299cf2996f70e7e1721236a0998da33a0e30107108486b3e"))

files, err := filepath.Glob(filepath.Join(tmpCacheDir, "*"))
AustinAbro321 marked this conversation as resolved.
Show resolved Hide resolved
require.NoError(t, err)
require.Empty(t, files)
})
}
2 changes: 1 addition & 1 deletion src/pkg/packager/creator/normal.go
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ func (pc *PackageCreator) Assemble(ctx context.Context, dst *layout.PackagePaths
if err := dst.Images.AddV1Image(img); err != nil {
return err
}
ok, err := utils.HasImageLayers(img)
ok, err := utils.OnlyHasImageLayers(img)
if err != nil {
return fmt.Errorf("failed to validate %s is an image and not an artifact: %w", info, err)
}
Expand Down
4 changes: 2 additions & 2 deletions src/pkg/utils/image.go
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,8 @@ func AddImageNameAnnotation(ociPath string, referenceToDigest map[string]string)
return os.WriteFile(indexPath, b, helpers.ReadWriteUser)
}

// HasImageLayers checks if all layers in the v1.Image are known image layers.
func HasImageLayers(img v1.Image) (bool, error) {
// OnlyHasImageLayers checks if all layers in the v1.Image are known image layers.
func OnlyHasImageLayers(img v1.Image) (bool, error) {
layers, err := img.Layers()
if err != nil {
return false, err
Expand Down
Loading