getOneSignature downloads one signature from sigURL, and returns (signature, false, nil) If it successfully determines that the signature does not exist, returns (nil, true, nil). NOTE: Keep this in sync with docs/signature-protocols.md!
(ctx context.Context, sigURL *url.URL)
| 538 | // If it successfully determines that the signature does not exist, returns (nil, true, nil). |
| 539 | // NOTE: Keep this in sync with docs/signature-protocols.md! |
| 540 | func (s *dockerImageSource) getOneSignature(ctx context.Context, sigURL *url.URL) (signature.Signature, bool, error) { |
| 541 | switch sigURL.Scheme { |
| 542 | case "file": |
| 543 | logrus.Debugf("Reading %s", sigURL.Path) |
| 544 | sigBlob, err := os.ReadFile(sigURL.Path) |
| 545 | if err != nil { |
| 546 | if os.IsNotExist(err) { |
| 547 | return nil, true, nil |
| 548 | } |
| 549 | return nil, false, err |
| 550 | } |
| 551 | sig, err := signature.FromBlob(sigBlob) |
| 552 | if err != nil { |
| 553 | return nil, false, fmt.Errorf("parsing signature %q: %w", sigURL.Path, err) |
| 554 | } |
| 555 | return sig, false, nil |
| 556 | |
| 557 | case "http", "https": |
| 558 | logrus.Debugf("GET %s", sigURL.Redacted()) |
| 559 | req, err := http.NewRequestWithContext(ctx, http.MethodGet, sigURL.String(), nil) |
| 560 | if err != nil { |
| 561 | return nil, false, err |
| 562 | } |
| 563 | res, err := s.c.client.Do(req) |
| 564 | if err != nil { |
| 565 | return nil, false, err |
| 566 | } |
| 567 | defer res.Body.Close() |
| 568 | if res.StatusCode == http.StatusNotFound { |
| 569 | logrus.Debugf("... got status 404, as expected = end of signatures") |
| 570 | return nil, true, nil |
| 571 | } else if res.StatusCode != http.StatusOK { |
| 572 | return nil, false, fmt.Errorf("reading signature from %s: %w", sigURL.Redacted(), newUnexpectedHTTPStatusError(res)) |
| 573 | } |
| 574 | |
| 575 | contentType := res.Header.Get("Content-Type") |
| 576 | if mimeType := simplifyContentType(contentType); mimeType == "text/html" { |
| 577 | logrus.Warnf("Signature %q has Content-Type %q, unexpected for a signature", sigURL.Redacted(), contentType) |
| 578 | // Don’t immediately fail; the lookaside spec does not place any requirements on Content-Type. |
| 579 | // If the content really is HTML, it’s going to fail in signature.FromBlob. |
| 580 | } |
| 581 | |
| 582 | sigBlob, err := iolimits.ReadAtMost(res.Body, iolimits.MaxSignatureBodySize) |
| 583 | if err != nil { |
| 584 | return nil, false, err |
| 585 | } |
| 586 | sig, err := signature.FromBlob(sigBlob) |
| 587 | if err != nil { |
| 588 | return nil, false, fmt.Errorf("parsing signature %s: %w", sigURL.Redacted(), err) |
| 589 | } |
| 590 | return sig, false, nil |
| 591 | |
| 592 | default: |
| 593 | return nil, false, fmt.Errorf("Unsupported scheme when reading signature from %s", sigURL.Redacted()) |
| 594 | } |
| 595 | } |
| 596 | |
| 597 | // appendSignaturesFromAPIExtension implements GetSignaturesWithFormat() using the X-Registry-Supports-Signatures API extension, |
no test coverage detected