Andreas/watchtower
1
0
Fork 0
mirror of https://github.com/containrrr/watchtower.git synced 2025-12-16 23:20:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: pass context when fetching digests

Browse source
This commit is contained in:
nils måsén 2022-12-06 20:47:08 +01:00
parent b71eb2dec7
commit 9220b51665
5 changed files with 40 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

2
pkg/container/client.go
View file

@ -335,7 +335,7 @@ func (client dockerClient) PullImage(ctx context.Context, container Container) e
log.WithFields(fields).Debugf("Checking if pull is needed") log.WithFields(fields).Debugf("Checking if pull is needed")
if match, err := digest.CompareDigest(container, opts.RegistryAuth); err != nil { if match, err := digest.CompareDigest(ctx, container, opts.RegistryAuth); err != nil {
headLevel := log.DebugLevel headLevel := log.DebugLevel
if client.WarnOnHeadPullFailed(container) { if client.WarnOnHeadPullFailed(container) {
headLevel = log.WarnLevel headLevel = log.WarnLevel

21
pkg/registry/auth/auth.go
View file

@ -1,6 +1,7 @@
package auth package auth
import ( import (
"context"
"encoding/json" "encoding/json"
"errors" "errors"
"fmt" "fmt"
@ -19,7 +20,7 @@ import (
const ChallengeHeader = "WWW-Authenticate" const ChallengeHeader = "WWW-Authenticate"
// GetToken fetches a token for the registry hosting the provided image // GetToken fetches a token for the registry hosting the provided image
func GetToken(container types.Container, registryAuth string) (string, error) { func GetToken(ctx context.Context, container types.Container, registryAuth string) (string, error) {
var err error var err error
var URL url.URL var URL url.URL
@ -29,13 +30,12 @@ func GetToken(container types.Container, registryAuth string) (string, error) {
logrus.WithField("URL", URL.String()).Debug("Building challenge URL") logrus.WithField("URL", URL.String()).Debug("Building challenge URL")
var req *http.Request var req *http.Request
if req, err = GetChallengeRequest(URL); err != nil { if req, err = GetChallengeRequest(ctx, URL); err != nil {
return "", err return "", err
} }
client := &http.Client{}
var res *http.Response var res *http.Response
if res, err = client.Do(req); err != nil { if res, err = http.DefaultClient.Do(req); err != nil {
return "", err return "", err
} }
defer res.Body.Close() defer res.Body.Close()
@ -55,15 +55,15 @@ func GetToken(container types.Container, registryAuth string) (string, error) {
return fmt.Sprintf("Basic %s", registryAuth), nil return fmt.Sprintf("Basic %s", registryAuth), nil
} }
if strings.HasPrefix(challenge, "bearer") { if strings.HasPrefix(challenge, "bearer") {
return GetBearerHeader(challenge, container.ImageName(), registryAuth) return GetBearerHeader(ctx, challenge, container.ImageName(), registryAuth)
} }
return "", errors.New("unsupported challenge type from registry") return "", errors.New("unsupported challenge type from registry")
} }
// GetChallengeRequest creates a request for getting challenge instructions // GetChallengeRequest creates a request for getting challenge instructions
func GetChallengeRequest(URL url.URL) (*http.Request, error) { func GetChallengeRequest(ctx context.Context, URL url.URL) (*http.Request, error) {
req, err := http.NewRequest("GET", URL.String(), nil) req, err := http.NewRequestWithContext(ctx, "GET", URL.String(), nil)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -73,8 +73,7 @@ func GetChallengeRequest(URL url.URL) (*http.Request, error) {
} }
// GetBearerHeader tries to fetch a bearer token from the registry based on the challenge instructions // GetBearerHeader tries to fetch a bearer token from the registry based on the challenge instructions
func GetBearerHeader(challenge string, img string, registryAuth string) (string, error) { func GetBearerHeader(ctx context.Context, challenge string, img string, registryAuth string) (string, error) {
client := http.Client{}
if strings.Contains(img, ":") { if strings.Contains(img, ":") {
img = strings.Split(img, ":")[0] img = strings.Split(img, ":")[0]
} }
@ -85,7 +84,7 @@ func GetBearerHeader(challenge string, img string, registryAuth string) (string,
} }
var r *http.Request var r *http.Request
if r, err = http.NewRequest("GET", authURL.String(), nil); err != nil { if r, err = http.NewRequestWithContext(ctx, "GET", authURL.String(), nil); err != nil {
return "", err return "", err
} }
@ -98,7 +97,7 @@ func GetBearerHeader(challenge string, img string, registryAuth string) (string,
} }
var authResponse *http.Response var authResponse *http.Response
if authResponse, err = client.Do(r); err != nil { if authResponse, err = http.DefaultClient.Do(r); err != nil {
return "", err return "", err
} }

10
pkg/registry/auth/auth_test.go
View file

@ -1,14 +1,16 @@
package auth_test package auth_test
import ( import (
"context"
"fmt" "fmt"
"github.com/containrrr/watchtower/internal/actions/mocks"
"github.com/containrrr/watchtower/pkg/registry/auth"
"net/url" "net/url"
"os" "os"
"testing" "testing"
"time" "time"
"github.com/containrrr/watchtower/internal/actions/mocks"
"github.com/containrrr/watchtower/pkg/registry/auth"
wtTypes "github.com/containrrr/watchtower/pkg/types" wtTypes "github.com/containrrr/watchtower/pkg/types"
. "github.com/onsi/ginkgo" . "github.com/onsi/ginkgo"
. "github.com/onsi/gomega" . "github.com/onsi/gomega"
@ -32,6 +34,8 @@ func SkipIfCredentialsEmpty(credentials *wtTypes.RegistryCredentials, fn func())
} }
} }
var ctx = context.Background()
var GHCRCredentials = &wtTypes.RegistryCredentials{ var GHCRCredentials = &wtTypes.RegistryCredentials{
Username: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_USERNAME"), Username: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_USERNAME"),
Password: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_PASSWORD"), Password: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_PASSWORD"),
@ -55,7 +59,7 @@ var _ = Describe("the auth module", func() {
It("should parse the token from the response", It("should parse the token from the response",
SkipIfCredentialsEmpty(GHCRCredentials, func() { SkipIfCredentialsEmpty(GHCRCredentials, func() {
creds := fmt.Sprintf("%s:%s", GHCRCredentials.Username, GHCRCredentials.Password) creds := fmt.Sprintf("%s:%s", GHCRCredentials.Username, GHCRCredentials.Password)
token, err := auth.GetToken(mockContainer, creds) token, err := auth.GetToken(ctx, mockContainer, creds)
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Expect(token).NotTo(Equal("")) Expect(token).NotTo(Equal(""))
}), }),

22
pkg/registry/digest/digest.go
View file

@ -1,35 +1,37 @@
package digest package digest
import ( import (
"context"
"crypto/tls" "crypto/tls"
"encoding/base64" "encoding/base64"
"encoding/json" "encoding/json"
"errors" "errors"
"fmt" "fmt"
"net"
"net/http"
"strings"
"time"
"github.com/containrrr/watchtower/internal/meta" "github.com/containrrr/watchtower/internal/meta"
"github.com/containrrr/watchtower/pkg/registry/auth" "github.com/containrrr/watchtower/pkg/registry/auth"
"github.com/containrrr/watchtower/pkg/registry/manifest" "github.com/containrrr/watchtower/pkg/registry/manifest"
"github.com/containrrr/watchtower/pkg/types" "github.com/containrrr/watchtower/pkg/types"
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
"net"
"net/http"
"strings"
"time"
) )
// ContentDigestHeader is the key for the key-value pair containing the digest header // ContentDigestHeader is the key for the key-value pair containing the digest header
const ContentDigestHeader = "Docker-Content-Digest" const ContentDigestHeader = "Docker-Content-Digest"
// CompareDigest ... // CompareDigest ...
func CompareDigest(container types.Container, registryAuth string) (bool, error) { func CompareDigest(ctx context.Context, container types.Container, registryAuth string) (bool, error) {
if !container.HasImageInfo() { if !container.HasImageInfo() {
return false, errors.New("container image info missing") return false, errors.New("container image info missing")
} }
var digest string var digest string
registryAuth = TransformAuth(registryAuth) registryAuth = TransformAuth(registryAuth)
token, err := auth.GetToken(container, registryAuth) token, err := auth.GetToken(ctx, container, registryAuth)
if err != nil { if err != nil {
return false, err return false, err
} }
@ -39,7 +41,7 @@ func CompareDigest(container types.Container, registryAuth string) (bool, error)
return false, err return false, err
} }
if digest, err = GetDigest(digestURL, token); err != nil { if digest, err = GetDigest(ctx, digestURL, token); err != nil {
return false, err return false, err
} }
@ -74,7 +76,7 @@ func TransformAuth(registryAuth string) string {
} }
// GetDigest from registry using a HEAD request to prevent rate limiting // GetDigest from registry using a HEAD request to prevent rate limiting
func GetDigest(url string, token string) (string, error) { func GetDigest(ctx context.Context, url string, token string) (string, error) {
tr := &http.Transport{ tr := &http.Transport{
Proxy: http.ProxyFromEnvironment, Proxy: http.ProxyFromEnvironment,
DialContext: (&net.Dialer{ DialContext: (&net.Dialer{
@ -90,7 +92,7 @@ func GetDigest(url string, token string) (string, error) {
} }
client := &http.Client{Transport: tr} client := &http.Client{Transport: tr}
req, _ := http.NewRequest("HEAD", url, nil) req, _ := http.NewRequestWithContext(ctx, "HEAD", url, nil)
req.Header.Set("User-Agent", meta.UserAgent) req.Header.Set("User-Agent", meta.UserAgent)
if token != "" { if token != "" {

18
pkg/registry/digest/digest_test.go
View file

@ -2,20 +2,21 @@ package digest_test
import ( import (
"fmt" "fmt"
"net/http"
"os"
"testing"
"time"
"github.com/containrrr/watchtower/internal/actions/mocks" "github.com/containrrr/watchtower/internal/actions/mocks"
"github.com/containrrr/watchtower/pkg/registry/digest" "github.com/containrrr/watchtower/pkg/registry/digest"
wtTypes "github.com/containrrr/watchtower/pkg/types" wtTypes "github.com/containrrr/watchtower/pkg/types"
. "github.com/onsi/ginkgo" . "github.com/onsi/ginkgo"
. "github.com/onsi/gomega" . "github.com/onsi/gomega"
"github.com/onsi/gomega/ghttp" "github.com/onsi/gomega/ghttp"
"net/http" "golang.org/x/net/context"
"os"
"testing"
"time"
) )
func TestDigest(t *testing.T) { func TestDigest(t *testing.T) {
RegisterFailHandler(Fail) RegisterFailHandler(Fail)
RunSpecs(GinkgoT(), "Digest Suite") RunSpecs(GinkgoT(), "Digest Suite")
} }
@ -29,6 +30,7 @@ var (
Username: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_USERNAME"), Username: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_USERNAME"),
Password: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_PASSWORD"), Password: os.Getenv("CI_INTEGRATION_TEST_REGISTRY_GH_PASSWORD"),
} }
ctx = context.Background()
) )
func SkipIfCredentialsEmpty(credentials *wtTypes.RegistryCredentials, fn func()) func() { func SkipIfCredentialsEmpty(credentials *wtTypes.RegistryCredentials, fn func()) func() {
@ -65,7 +67,7 @@ var _ = Describe("Digests", func() {
It("should return true if digests match", It("should return true if digests match",
SkipIfCredentialsEmpty(GHCRCredentials, func() { SkipIfCredentialsEmpty(GHCRCredentials, func() {
creds := fmt.Sprintf("%s:%s", GHCRCredentials.Username, GHCRCredentials.Password) creds := fmt.Sprintf("%s:%s", GHCRCredentials.Username, GHCRCredentials.Password)
matches, err := digest.CompareDigest(mockContainer, creds) matches, err := digest.CompareDigest(ctx, mockContainer, creds)
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Expect(matches).To(Equal(true)) Expect(matches).To(Equal(true))
}), }),
@ -78,7 +80,7 @@ var _ = Describe("Digests", func() {
}) })
It("should return an error when container contains no image info", func() { It("should return an error when container contains no image info", func() {
matches, err := digest.CompareDigest(mockContainerNoImage, `user:pass`) matches, err := digest.CompareDigest(ctx, mockContainerNoImage, `user:pass`)
Expect(err).To(HaveOccurred()) Expect(err).To(HaveOccurred())
Expect(matches).To(Equal(false)) Expect(matches).To(Equal(false))
}) })
@ -116,7 +118,7 @@ var _ = Describe("Digests", func() {
}), }),
), ),
) )
dig, err := digest.GetDigest(server.URL(), "token") dig, err := digest.GetDigest(ctx, server.URL(), "token")
Expect(server.ReceivedRequests()).Should(HaveLen(1)) Expect(server.ReceivedRequests()).Should(HaveLen(1))
Expect(err).NotTo(HaveOccurred()) Expect(err).NotTo(HaveOccurred())
Expect(dig).To(Equal(mockDigest)) Expect(dig).To(Equal(mockDigest))