validateImage checks that the image was crafted by chainloop and contains the expected content
(img v1.Image, digest string)
| 249 | |
| 250 | // validateImage checks that the image was crafted by chainloop and contains the expected content |
| 251 | func validateImage(img v1.Image, digest string) error { |
| 252 | // Review required annotations |
| 253 | m, err := img.Manifest() |
| 254 | if err != nil { |
| 255 | return fmt.Errorf("getting manifest: %w", err) |
| 256 | } |
| 257 | |
| 258 | if v, ok := m.Annotations[ocispec.AnnotationAuthors]; !ok || v != backend.AuthorAnnotation { |
| 259 | return errors.New("image not uploaded by chainloop") |
| 260 | } |
| 261 | |
| 262 | if v, ok := m.Annotations[ocispec.AnnotationTitle]; !ok && v != "" { |
| 263 | return errors.New("image does not contain filename information") |
| 264 | } |
| 265 | |
| 266 | // NOTE: we use img.Layers instead of LayerByDiffID because the latter does not compute the image manifest |
| 267 | layers, err := img.Layers() |
| 268 | if err != nil { |
| 269 | return fmt.Errorf("getting layers: %w", err) |
| 270 | } |
| 271 | |
| 272 | if len(layers) != 1 { |
| 273 | return errors.New("image does not contain a single layer") |
| 274 | } |
| 275 | |
| 276 | // Check the actual layer digest content meets the expected one |
| 277 | d, err := layers[0].Digest() |
| 278 | if err != nil { |
| 279 | return fmt.Errorf("getting layer digest: %w", err) |
| 280 | } |
| 281 | |
| 282 | if d.Hex != digest { |
| 283 | return errors.New("layer digest does not match the expected one") |
| 284 | } |
| 285 | |
| 286 | return nil |
| 287 | } |
| 288 | |
| 289 | // CheckWritePermissions performs an actual write to the repository to check that the credentials |
| 290 | func (b *Backend) CheckWritePermissions(_ context.Context) error { |