@@ -3,12 +3,9 @@ package main
33import (
44 "encoding/json"
55 "fmt"
6- "os"
7- "path/filepath"
86 "regexp"
97 "strings"
108
11- "github.com/docker/distribution/manifest/schema1"
129 "github.com/docker/distribution/manifest/schema2"
1310 "github.com/docker/docker/api/types"
1411 "github.com/docker/docker/integration-cli/checker"
@@ -80,10 +77,6 @@ func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
8077 testPullByTagDisplaysDigest (c )
8178}
8279
83- func (s * DockerSchema1RegistrySuite ) TestPullByTagDisplaysDigest (c * check.C ) {
84- testPullByTagDisplaysDigest (c )
85- }
86-
8780func testPullByDigest (c * check.C ) {
8881 testRequires (c , DaemonIsLinux )
8982 pushDigest , err := setupImage (c )
@@ -106,10 +99,6 @@ func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) {
10699 testPullByDigest (c )
107100}
108101
109- func (s * DockerSchema1RegistrySuite ) TestPullByDigest (c * check.C ) {
110- testPullByDigest (c )
111- }
112-
113102func testPullByDigestNoFallback (c * check.C ) {
114103 testRequires (c , DaemonIsLinux )
115104 // pull from the registry using the <name>@<digest> reference
@@ -123,10 +112,6 @@ func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) {
123112 testPullByDigestNoFallback (c )
124113}
125114
126- func (s * DockerSchema1RegistrySuite ) TestPullByDigestNoFallback (c * check.C ) {
127- testPullByDigestNoFallback (c )
128- }
129-
130115func (s * DockerRegistrySuite ) TestCreateByDigest (c * check.C ) {
131116 pushDigest , err := setupImage (c )
132117 c .Assert (err , checker .IsNil , check .Commentf ("error setting up image" ))
@@ -563,131 +548,3 @@ func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
563548 expectedErrorMsg := fmt .Sprintf ("manifest verification failed for digest %s" , manifestDigest )
564549 c .Assert (out , checker .Contains , expectedErrorMsg )
565550}
566-
567- // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
568- // we have modified a manifest blob and its digest cannot be verified.
569- // This is the schema1 version of the test.
570- func (s * DockerSchema1RegistrySuite ) TestPullFailsWithAlteredManifest (c * check.C ) {
571- testRequires (c , DaemonIsLinux )
572- manifestDigest , err := setupImage (c )
573- c .Assert (err , checker .IsNil , check .Commentf ("error setting up image" ))
574-
575- // Load the target manifest blob.
576- manifestBlob := s .reg .ReadBlobContents (c , manifestDigest )
577-
578- var imgManifest schema1.Manifest
579- err = json .Unmarshal (manifestBlob , & imgManifest )
580- c .Assert (err , checker .IsNil , check .Commentf ("unable to decode image manifest from blob" ))
581-
582- // Change a layer in the manifest.
583- imgManifest .FSLayers [0 ] = schema1.FSLayer {
584- BlobSum : digest .Digest ("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" ),
585- }
586-
587- // Move the existing data file aside, so that we can replace it with a
588- // malicious blob of data. NOTE: we defer the returned undo func.
589- undo := s .reg .TempMoveBlobData (c , manifestDigest )
590- defer undo ()
591-
592- alteredManifestBlob , err := json .MarshalIndent (imgManifest , "" , " " )
593- c .Assert (err , checker .IsNil , check .Commentf ("unable to encode altered image manifest to JSON" ))
594-
595- s .reg .WriteBlobContents (c , manifestDigest , alteredManifestBlob )
596-
597- // Now try pulling that image by digest. We should get an error about
598- // digest verification for the manifest digest.
599-
600- // Pull from the registry using the <name>@<digest> reference.
601- imageReference := fmt .Sprintf ("%s@%s" , repoName , manifestDigest )
602- out , exitStatus , _ := dockerCmdWithError ("pull" , imageReference )
603- c .Assert (exitStatus , checker .Not (check .Equals ), 0 )
604-
605- expectedErrorMsg := fmt .Sprintf ("image verification failed for digest %s" , manifestDigest )
606- c .Assert (out , checker .Contains , expectedErrorMsg )
607- }
608-
609- // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
610- // we have modified a layer blob and its digest cannot be verified.
611- // This is the schema2 version of the test.
612- func (s * DockerRegistrySuite ) TestPullFailsWithAlteredLayer (c * check.C ) {
613- testRequires (c , DaemonIsLinux )
614- manifestDigest , err := setupImage (c )
615- c .Assert (err , checker .IsNil )
616-
617- // Load the target manifest blob.
618- manifestBlob := s .reg .ReadBlobContents (c , manifestDigest )
619-
620- var imgManifest schema2.Manifest
621- err = json .Unmarshal (manifestBlob , & imgManifest )
622- c .Assert (err , checker .IsNil )
623-
624- // Next, get the digest of one of the layers from the manifest.
625- targetLayerDigest := imgManifest .Layers [0 ].Digest
626-
627- // Move the existing data file aside, so that we can replace it with a
628- // malicious blob of data. NOTE: we defer the returned undo func.
629- undo := s .reg .TempMoveBlobData (c , targetLayerDigest )
630- defer undo ()
631-
632- // Now make a fake data blob in this directory.
633- s .reg .WriteBlobContents (c , targetLayerDigest , []byte ("This is not the data you are looking for." ))
634-
635- // Now try pulling that image by digest. We should get an error about
636- // digest verification for the target layer digest.
637-
638- // Remove distribution cache to force a re-pull of the blobs
639- if err := os .RemoveAll (filepath .Join (testEnv .DaemonInfo .DockerRootDir , "image" , s .d .StorageDriver (), "distribution" )); err != nil {
640- c .Fatalf ("error clearing distribution cache: %v" , err )
641- }
642-
643- // Pull from the registry using the <name>@<digest> reference.
644- imageReference := fmt .Sprintf ("%s@%s" , repoName , manifestDigest )
645- out , exitStatus , _ := dockerCmdWithError ("pull" , imageReference )
646- c .Assert (exitStatus , checker .Not (check .Equals ), 0 , check .Commentf ("expected a non-zero exit status" ))
647-
648- expectedErrorMsg := fmt .Sprintf ("filesystem layer verification failed for digest %s" , targetLayerDigest )
649- c .Assert (out , checker .Contains , expectedErrorMsg , check .Commentf ("expected error message in output: %s" , out ))
650- }
651-
652- // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
653- // we have modified a layer blob and its digest cannot be verified.
654- // This is the schema1 version of the test.
655- func (s * DockerSchema1RegistrySuite ) TestPullFailsWithAlteredLayer (c * check.C ) {
656- testRequires (c , DaemonIsLinux )
657- manifestDigest , err := setupImage (c )
658- c .Assert (err , checker .IsNil )
659-
660- // Load the target manifest blob.
661- manifestBlob := s .reg .ReadBlobContents (c , manifestDigest )
662-
663- var imgManifest schema1.Manifest
664- err = json .Unmarshal (manifestBlob , & imgManifest )
665- c .Assert (err , checker .IsNil )
666-
667- // Next, get the digest of one of the layers from the manifest.
668- targetLayerDigest := imgManifest .FSLayers [0 ].BlobSum
669-
670- // Move the existing data file aside, so that we can replace it with a
671- // malicious blob of data. NOTE: we defer the returned undo func.
672- undo := s .reg .TempMoveBlobData (c , targetLayerDigest )
673- defer undo ()
674-
675- // Now make a fake data blob in this directory.
676- s .reg .WriteBlobContents (c , targetLayerDigest , []byte ("This is not the data you are looking for." ))
677-
678- // Now try pulling that image by digest. We should get an error about
679- // digest verification for the target layer digest.
680-
681- // Remove distribution cache to force a re-pull of the blobs
682- if err := os .RemoveAll (filepath .Join (testEnv .DaemonInfo .DockerRootDir , "image" , s .d .StorageDriver (), "distribution" )); err != nil {
683- c .Fatalf ("error clearing distribution cache: %v" , err )
684- }
685-
686- // Pull from the registry using the <name>@<digest> reference.
687- imageReference := fmt .Sprintf ("%s@%s" , repoName , manifestDigest )
688- out , exitStatus , _ := dockerCmdWithError ("pull" , imageReference )
689- c .Assert (exitStatus , checker .Not (check .Equals ), 0 , check .Commentf ("expected a non-zero exit status" ))
690-
691- expectedErrorMsg := fmt .Sprintf ("filesystem layer verification failed for digest %s" , targetLayerDigest )
692- c .Assert (out , checker .Contains , expectedErrorMsg , check .Commentf ("expected error message in output: %s" , out ))
693- }
0 commit comments