Skip to content

Commit 3f5b1bd

Browse files
thaJeztahthaJeztah
committed
cli/command/plugin: remove DCT
Plugins are not widely used, and there's no known plugins that use content-trust. We're working on updating the authentication stack in the CLI, and the trust implementation hinders us in making changes, so removing parts that are not high-priority (ahead of full deprecation of DCT). Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 845870e commit 3f5b1bd

8 files changed

Lines changed: 33 additions & 141 deletions

File tree

‎cli/command/plugin/install.go‎

Lines changed: 10 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"github.com/distribution/reference"
99
"github.com/docker/cli/cli"
1010
"github.com/docker/cli/cli/command"
11-
"github.com/docker/cli/cli/command/image"
1211
"github.com/docker/cli/internal/jsonstream"
1312
"github.com/docker/cli/internal/prompt"
1413
"github.com/docker/cli/internal/registry"
@@ -17,7 +16,6 @@ import (
1716
"github.com/moby/moby/client"
1817
"github.com/pkg/errors"
1918
"github.com/spf13/cobra"
20-
"github.com/spf13/pflag"
2119
)
2220

2321
type pluginOptions struct {
@@ -27,12 +25,6 @@ type pluginOptions struct {
2725
disable bool
2826
args []string
2927
skipRemoteCheck bool
30-
untrusted bool
31-
}
32-
33-
func loadPullFlags(dockerCli command.Cli, opts *pluginOptions, flags *pflag.FlagSet) {
34-
flags.BoolVar(&opts.grantPerms, "grant-all-permissions", false, "Grant all permissions necessary to run the plugin")
35-
command.AddTrustVerificationFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
3628
}
3729

3830
func newInstallCommand(dockerCli command.Cli) *cobra.Command {
@@ -51,13 +43,15 @@ func newInstallCommand(dockerCli command.Cli) *cobra.Command {
5143
}
5244

5345
flags := cmd.Flags()
54-
loadPullFlags(dockerCli, &options, flags)
46+
flags.BoolVar(&options.grantPerms, "grant-all-permissions", false, "Grant all permissions necessary to run the plugin")
5547
flags.BoolVar(&options.disable, "disable", false, "Do not enable the plugin on install")
5648
flags.StringVar(&options.localName, "alias", "", "Local name for plugin")
49+
flags.Bool("disable-content-trust", dockerCli.ContentTrustEnabled(), "Skip image verification (deprecated)")
50+
_ = flags.MarkHidden("disable-content-trust")
5751
return cmd
5852
}
5953

60-
func buildPullConfig(ctx context.Context, dockerCli command.Cli, opts pluginOptions) (client.PluginInstallOptions, error) {
54+
func buildPullConfig(dockerCLI command.Cli, opts pluginOptions) (client.PluginInstallOptions, error) {
6155
// Names with both tag and digest will be treated by the daemon
6256
// as a pull by digest with a local name for the tag
6357
// (if no local name is provided).
@@ -66,40 +60,21 @@ func buildPullConfig(ctx context.Context, dockerCli command.Cli, opts pluginOpti
6660
return client.PluginInstallOptions{}, err
6761
}
6862

69-
indexInfo := registry.NewIndexInfo(ref)
70-
remote := ref.String()
71-
72-
_, isCanonical := ref.(reference.Canonical)
73-
if !opts.untrusted && !isCanonical {
74-
ref = reference.TagNameOnly(ref)
75-
nt, ok := ref.(reference.NamedTagged)
76-
if !ok {
77-
return client.PluginInstallOptions{}, errors.Errorf("invalid name: %s", ref.String())
78-
}
79-
80-
trusted, err := image.TrustedReference(ctx, dockerCli, nt)
81-
if err != nil {
82-
return client.PluginInstallOptions{}, err
83-
}
84-
remote = reference.FamiliarString(trusted)
85-
}
86-
87-
authConfig := command.ResolveAuthConfig(dockerCli.ConfigFile(), indexInfo)
63+
authConfig := command.ResolveAuthConfig(dockerCLI.ConfigFile(), registry.NewIndexInfo(ref))
8864
encodedAuth, err := registrytypes.EncodeAuthConfig(authConfig)
8965
if err != nil {
9066
return client.PluginInstallOptions{}, err
9167
}
9268

93-
options := client.PluginInstallOptions{
69+
return client.PluginInstallOptions{
9470
RegistryAuth: encodedAuth,
95-
RemoteRef: remote,
71+
RemoteRef: ref.String(),
9672
Disabled: opts.disable,
9773
AcceptAllPermissions: opts.grantPerms,
98-
AcceptPermissionsFunc: acceptPrivileges(dockerCli, opts.remote),
74+
AcceptPermissionsFunc: acceptPrivileges(dockerCLI, opts.remote),
9975
PrivilegeFunc: nil,
10076
Args: opts.args,
101-
}
102-
return options, nil
77+
}, nil
10378
}
10479

10580
func runInstall(ctx context.Context, dockerCLI command.Cli, opts pluginOptions) error {
@@ -115,7 +90,7 @@ func runInstall(ctx context.Context, dockerCLI command.Cli, opts pluginOptions)
11590
localName = reference.FamiliarString(reference.TagNameOnly(aref))
11691
}
11792

118-
options, err := buildPullConfig(ctx, dockerCLI, opts)
93+
options, err := buildPullConfig(dockerCLI, opts)
11994
if err != nil {
12095
return err
12196
}

‎cli/command/plugin/install_test.go‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"testing"
88

99
"github.com/docker/cli/internal/test"
10-
"github.com/docker/cli/internal/test/notary"
1110
"github.com/moby/moby/client"
1211

1312
"gotest.tools/v3/assert"
@@ -65,50 +64,6 @@ func TestInstallErrors(t *testing.T) {
6564
}
6665
}
6766

68-
func TestInstallContentTrustErrors(t *testing.T) {
69-
testCases := []struct {
70-
description string
71-
args []string
72-
expectedError string
73-
notaryFunc test.NotaryClientFuncType
74-
}{
75-
{
76-
description: "install plugin, offline notary server",
77-
args: []string{"plugin:tag"},
78-
expectedError: "client is offline",
79-
notaryFunc: notary.GetOfflineNotaryRepository,
80-
},
81-
{
82-
description: "install plugin, uninitialized notary server",
83-
args: []string{"plugin:tag"},
84-
expectedError: "remote trust data does not exist",
85-
notaryFunc: notary.GetUninitializedNotaryRepository,
86-
},
87-
{
88-
description: "install plugin, empty notary server",
89-
args: []string{"plugin:tag"},
90-
expectedError: "No valid trust data for tag",
91-
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
92-
},
93-
}
94-
95-
for _, tc := range testCases {
96-
t.Run(tc.description, func(t *testing.T) {
97-
cli := test.NewFakeCli(&fakeClient{
98-
pluginInstallFunc: func(name string, options client.PluginInstallOptions) (io.ReadCloser, error) {
99-
return nil, errors.New("should not try to install plugin")
100-
},
101-
}, test.EnableContentTrust)
102-
cli.SetNotaryClient(tc.notaryFunc)
103-
cmd := newInstallCommand(cli)
104-
cmd.SetArgs(tc.args)
105-
cmd.SetOut(io.Discard)
106-
cmd.SetErr(io.Discard)
107-
assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
108-
})
109-
}
110-
}
111-
11267
func TestInstall(t *testing.T) {
11368
testCases := []struct {
11469
description string

‎cli/command/plugin/push.go‎

Lines changed: 10 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,55 +2,45 @@ package plugin
22

33
import (
44
"context"
5+
"fmt"
56

67
"github.com/distribution/reference"
78
"github.com/docker/cli/cli"
89
"github.com/docker/cli/cli/command"
9-
"github.com/docker/cli/cli/trust"
1010
"github.com/docker/cli/internal/jsonstream"
1111
"github.com/docker/cli/internal/registry"
1212
registrytypes "github.com/moby/moby/api/types/registry"
13-
"github.com/pkg/errors"
1413
"github.com/spf13/cobra"
1514
)
1615

17-
type pushOptions struct {
18-
name string
19-
untrusted bool
20-
}
21-
22-
func newPushCommand(dockerCli command.Cli) *cobra.Command {
23-
var opts pushOptions
16+
func newPushCommand(dockerCLI command.Cli) *cobra.Command {
2417
cmd := &cobra.Command{
2518
Use: "push [OPTIONS] PLUGIN[:TAG]",
2619
Short: "Push a plugin to a registry",
2720
Args: cli.ExactArgs(1),
2821
RunE: func(cmd *cobra.Command, args []string) error {
29-
opts.name = args[0]
30-
return runPush(cmd.Context(), dockerCli, opts)
22+
name := args[0]
23+
return runPush(cmd.Context(), dockerCLI, name)
3124
},
3225
}
3326

3427
flags := cmd.Flags()
35-
36-
command.AddTrustSigningFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
37-
28+
flags.Bool("disable-content-trust", dockerCLI.ContentTrustEnabled(), "Skip image verification (deprecated)")
29+
_ = flags.MarkHidden("disable-content-trust")
3830
return cmd
3931
}
4032

41-
func runPush(ctx context.Context, dockerCli command.Cli, opts pushOptions) error {
42-
named, err := reference.ParseNormalizedNamed(opts.name)
33+
func runPush(ctx context.Context, dockerCli command.Cli, name string) error {
34+
named, err := reference.ParseNormalizedNamed(name)
4335
if err != nil {
4436
return err
4537
}
4638
if _, ok := named.(reference.Canonical); ok {
47-
return errors.Errorf("invalid name: %s", opts.name)
39+
return fmt.Errorf("invalid name: %s", name)
4840
}
4941

5042
named = reference.TagNameOnly(named)
51-
52-
indexInfo := registry.NewIndexInfo(named)
53-
authConfig := command.ResolveAuthConfig(dockerCli.ConfigFile(), indexInfo)
43+
authConfig := command.ResolveAuthConfig(dockerCli.ConfigFile(), registry.NewIndexInfo(named))
5444
encodedAuth, err := registrytypes.EncodeAuthConfig(authConfig)
5545
if err != nil {
5646
return err
@@ -63,14 +53,5 @@ func runPush(ctx context.Context, dockerCli command.Cli, opts pushOptions) error
6353
defer func() {
6454
_ = responseBody.Close()
6555
}()
66-
67-
if !opts.untrusted {
68-
repoInfo := &trust.RepositoryInfo{
69-
Name: reference.TrimNamed(named),
70-
Index: indexInfo,
71-
}
72-
return trust.PushTrustedReference(ctx, dockerCli, repoInfo, named, authConfig, responseBody, command.UserAgent())
73-
}
74-
7556
return jsonstream.Display(ctx, responseBody, dockerCli.Out())
7657
}

‎cli/command/plugin/upgrade.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,9 @@ func newUpgradeCommand(dockerCli command.Cli) *cobra.Command {
3131
}
3232

3333
flags := cmd.Flags()
34-
loadPullFlags(dockerCli, &options, flags)
34+
flags.BoolVar(&options.grantPerms, "grant-all-permissions", false, "Grant all permissions necessary to run the plugin")
35+
flags.Bool("disable-content-trust", dockerCli.ContentTrustEnabled(), "Skip image verification (deprecated)")
36+
_ = flags.MarkHidden("disable-content-trust")
3537
flags.BoolVar(&options.skipRemoteCheck, "skip-remote-check", false, "Do not check if specified remote plugin matches existing plugin image")
3638
return cmd
3739
}
@@ -73,7 +75,7 @@ func runUpgrade(ctx context.Context, dockerCLI command.Cli, opts pluginOptions)
7375
}
7476
}
7577

76-
options, err := buildPullConfig(ctx, dockerCLI, opts)
78+
options, err := buildPullConfig(dockerCLI, opts)
7779
if err != nil {
7880
return err
7981
}

‎docs/reference/commandline/plugin_install.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ Install a plugin
99
|:--------------------------|:---------|:--------|:--------------------------------------------------|
1010
| `--alias` | `string` | | Local name for plugin |
1111
| `--disable` | `bool` | | Do not enable the plugin on install |
12-
| `--disable-content-trust` | `bool` | `true` | Skip image verification |
1312
| `--grant-all-permissions` | `bool` | | Grant all permissions necessary to run the plugin |
1413

1514

‎docs/reference/commandline/plugin_push.md‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,6 @@
33
<!---MARKER_GEN_START-->
44
Push a plugin to a registry
55

6-
### Options
7-
8-
| Name | Type | Default | Description |
9-
|:--------------------------|:-------|:--------|:-------------------|
10-
| `--disable-content-trust` | `bool` | `true` | Skip image signing |
11-
126

137
<!---MARKER_GEN_END-->
148

‎docs/reference/commandline/plugin_upgrade.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ Upgrade an existing plugin
77

88
| Name | Type | Default | Description |
99
|:--------------------------|:-------|:--------|:----------------------------------------------------------------------|
10-
| `--disable-content-trust` | `bool` | `true` | Skip image verification |
1110
| `--grant-all-permissions` | `bool` | | Grant all permissions necessary to run the plugin |
1211
| `--skip-remote-check` | `bool` | | Do not check if specified remote plugin matches existing plugin image |
1312

e2e/plugin/trust_test.go renamed to e2e/plugin/plugin_test.go

Lines changed: 9 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,24 @@ package plugin
22

33
import (
44
"context"
5+
"fmt"
56
"testing"
67

78
"github.com/docker/cli/e2e/internal/fixtures"
89
"github.com/docker/cli/e2e/testutils"
910
"github.com/docker/cli/internal/test/environment"
10-
"github.com/moby/moby/api/types/versions"
1111
"gotest.tools/v3/icmd"
1212
"gotest.tools/v3/skip"
1313
)
1414

1515
const registryPrefix = "registry:5000"
1616

17-
func TestInstallWithContentTrust(t *testing.T) {
18-
// TODO(krissetto): remove this skip once the fix (see https://github.com/moby/moby/pull/47299) is deployed to moby versions < 25
19-
skip.If(t, versions.LessThan(environment.DaemonAPIVersion(t), "1.44"))
17+
func TestCreatePushPull(t *testing.T) {
2018
skip.If(t, environment.SkipPluginTests())
21-
t.Skip("flaky")
2219

23-
const pluginName = registryPrefix + "/plugin-content-trust"
20+
const pluginName = registryPrefix + "/my-plugin"
2421

22+
// TODO(thaJeztah): probably should use a config without the content trust bits.
2523
dir := fixtures.SetupConfigFile(t)
2624
defer dir.Remove()
2725

@@ -33,39 +31,28 @@ func TestInstallWithContentTrust(t *testing.T) {
3331
icmd.RunCommand("docker", "plugin", "create", pluginName, pluginDir).Assert(t, icmd.Success)
3432
result := icmd.RunCmd(icmd.Command("docker", "plugin", "push", pluginName),
3533
fixtures.WithConfig(dir.Path()),
36-
fixtures.WithTrust,
37-
fixtures.WithNotary,
3834
fixtures.WithPassphrase("foo", "bar"),
3935
)
4036
result.Assert(t, icmd.Expected{
41-
Out: "Signing and pushing trust metadata",
37+
Out: fmt.Sprintf("The push refers to repository [%s]", pluginName),
4238
})
4339

4440
icmd.RunCommand("docker", "plugin", "rm", "-f", pluginName).Assert(t, icmd.Success)
4541

4642
result = icmd.RunCmd(icmd.Command("docker", "plugin", "install", "--grant-all-permissions", pluginName),
4743
fixtures.WithConfig(dir.Path()),
48-
fixtures.WithTrust,
49-
fixtures.WithNotary,
5044
)
5145
result.Assert(t, icmd.Expected{
5246
Out: "Installed plugin " + pluginName,
5347
})
5448
}
5549

56-
func TestInstallWithContentTrustUntrusted(t *testing.T) {
50+
func TestInstall(t *testing.T) {
5751
skip.If(t, environment.SkipPluginTests())
5852

59-
dir := fixtures.SetupConfigFile(t)
60-
defer dir.Remove()
61-
62-
result := icmd.RunCmd(icmd.Command("docker", "plugin", "install", "--grant-all-permissions", "tiborvass/sample-volume-plugin:latest"),
63-
fixtures.WithConfig(dir.Path()),
64-
fixtures.WithTrust,
65-
fixtures.WithNotary,
66-
)
53+
const pluginName = "tiborvass/sample-volume-plugin:latest"
54+
result := icmd.RunCmd(icmd.Command("docker", "plugin", "install", "--grant-all-permissions", pluginName))
6755
result.Assert(t, icmd.Expected{
68-
ExitCode: 1,
69-
Err: "Error: remote trust data does not exist",
56+
Out: "Installed plugin " + pluginName,
7057
})
7158
}

0 commit comments

Comments
 (0)