removeSingleSigner attempts to remove a single signer and returns whether signer removal happened. The signer not being removed doesn't necessarily raise an error e.g. user choosing "No" when prompted for confirmation.
(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, forceYes bool)
| 91 | // removeSingleSigner attempts to remove a single signer and returns whether signer removal happened. |
| 92 | // The signer not being removed doesn't necessarily raise an error e.g. user choosing "No" when prompted for confirmation. |
| 93 | func removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, forceYes bool) (bool, error) { |
| 94 | imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, authResolver(dockerCLI), repoName) |
| 95 | if err != nil { |
| 96 | return false, err |
| 97 | } |
| 98 | |
| 99 | signerDelegation := data.RoleName("targets/" + signerName) |
| 100 | if signerDelegation == releasesRoleTUFName { |
| 101 | return false, errors.New("releases is a reserved keyword and cannot be removed") |
| 102 | } |
| 103 | notaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull) |
| 104 | if err != nil { |
| 105 | return false, trust.NotaryError(imgRefAndAuth.Reference().Name(), err) |
| 106 | } |
| 107 | delegationRoles, err := notaryRepo.GetDelegationRoles() |
| 108 | if err != nil { |
| 109 | return false, fmt.Errorf("error retrieving signers for %s: %w", repoName, err) |
| 110 | } |
| 111 | var role data.Role |
| 112 | for _, delRole := range delegationRoles { |
| 113 | if delRole.Name == signerDelegation { |
| 114 | role = delRole |
| 115 | break |
| 116 | } |
| 117 | } |
| 118 | if role.Name == "" { |
| 119 | return false, fmt.Errorf("no signer %s for repository %s", signerName, repoName) |
| 120 | } |
| 121 | allRoles, err := notaryRepo.ListRoles() |
| 122 | if err != nil { |
| 123 | return false, err |
| 124 | } |
| 125 | |
| 126 | isLastSigner, err := isLastSignerForReleases(role, allRoles) |
| 127 | if err != nil { |
| 128 | return false, err |
| 129 | } |
| 130 | |
| 131 | ok, err := maybePromptForSignerRemoval(ctx, dockerCLI, repoName, signerName, isLastSigner, forceYes) |
| 132 | if err != nil { |
| 133 | return false, err |
| 134 | } |
| 135 | if !ok { |
| 136 | return false, nil |
| 137 | } |
| 138 | |
| 139 | if err := notaryRepo.RemoveDelegationKeys(releasesRoleTUFName, role.KeyIDs); err != nil { |
| 140 | return false, err |
| 141 | } |
| 142 | if err := notaryRepo.RemoveDelegationRole(signerDelegation); err != nil { |
| 143 | return false, err |
| 144 | } |
| 145 | |
| 146 | if err := notaryRepo.Publish(); err != nil { |
| 147 | return false, err |
| 148 | } |
| 149 | |
| 150 | _, _ = fmt.Fprintf(dockerCLI.Out(), "Successfully removed %s from %s\n\n", signerName, repoName) |
searching dependent graphs…