Function resolverDefaultTLS

cmd/ctr/commands/resolver.go:114–152

(cliContext *cli.Context)

}

func resolverDefaultTLS(cliContext *cli.Context) (*tls.Config, error) {
	tlsConfig := &tls.Config{}

	if cliContext.Bool("skip-verify") {
		tlsConfig.InsecureSkipVerify = true
	}

	if tlsRootPath := cliContext.String("tlscacert"); tlsRootPath != "" {
		tlsRootData, err := os.ReadFile(tlsRootPath)
		if err != nil {
			return nil, fmt.Errorf("failed to read %q: %w", tlsRootPath, err)
		}

		tlsConfig.RootCAs = x509.NewCertPool()
		if !tlsConfig.RootCAs.AppendCertsFromPEM(tlsRootData) {
			return nil, fmt.Errorf("failed to load TLS CAs from %q: invalid data", tlsRootPath)
		}
	}

	tlsCertPath := cliContext.String("tlscert")
	tlsKeyPath := cliContext.String("tlskey")
	if tlsCertPath != "" || tlsKeyPath != "" {
		if tlsCertPath == "" || tlsKeyPath == "" {
			return nil, errors.New("flags --tlscert and --tlskey must be set together")
		}
		keyPair, err := tls.LoadX509KeyPair(tlsCertPath, tlsKeyPath)
		if err != nil {
			return nil, fmt.Errorf("failed to load TLS client credentials (cert=%q, key=%q): %w", tlsCertPath, tlsKeyPath, err)
		}
		tlsConfig.Certificates = []tls.Certificate{keyPair}
	}

	// If nothing was set, return nil rather than empty config
	if !tlsConfig.InsecureSkipVerify && tlsConfig.RootCAs == nil && tlsConfig.Certificates == nil {
		return nil, nil
	}

	return tlsConfig, nil
}

type staticCredentials struct {
	ref      string