decryptLayer decrypts the layer using the CryptoConfig and creates a new OCI Descriptor. The caller is expected to store the returned plain data and OCI Descriptor
(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor, unwrapOnly bool)
| 162 | // decryptLayer decrypts the layer using the CryptoConfig and creates a new OCI Descriptor. |
| 163 | // The caller is expected to store the returned plain data and OCI Descriptor |
| 164 | func decryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, error) { |
| 165 | resultReader, d, err := ocicrypt.DecryptLayer(cc.DecryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc, unwrapOnly) |
| 166 | if err != nil || unwrapOnly { |
| 167 | return ocispec.Descriptor{}, nil, err |
| 168 | } |
| 169 | |
| 170 | newDesc := ocispec.Descriptor{ |
| 171 | Digest: d, |
| 172 | Size: 0, |
| 173 | Platform: desc.Platform, |
| 174 | } |
| 175 | |
| 176 | switch desc.MediaType { |
| 177 | case encocispec.MediaTypeLayerGzipEnc: |
| 178 | newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip |
| 179 | case encocispec.MediaTypeLayerZstdEnc: |
| 180 | newDesc.MediaType = ocispec.MediaTypeImageLayerZstd |
| 181 | case encocispec.MediaTypeLayerEnc: |
| 182 | newDesc.MediaType = images.MediaTypeDockerSchema2Layer |
| 183 | default: |
| 184 | return ocispec.Descriptor{}, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType) |
| 185 | } |
| 186 | return newDesc, resultReader, nil |
| 187 | } |
| 188 | |
| 189 | // cryptLayer handles the changes due to encryption or decryption of a layer |
| 190 | func cryptLayer(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, cryptoOp cryptoOp) (ocispec.Descriptor, error) { |
no outgoing calls
no test coverage detected
searching dependent graphs…