Skip to content
This repository was archived by the owner on Jan 15, 2026. It is now read-only.

Commit 592aab4

Browse files
author
zhouhao
committed
Add index validation
Signed-off-by: zhouhao <zhouhao@cn.fujitsu.com>
1 parent 91950f9 commit 592aab4

3 files changed

Lines changed: 194 additions & 18 deletions

File tree

‎image/descriptor.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,14 @@ import (
2525
"github.com/pkg/errors"
2626
)
2727

28+
const indexPath = "index.json"
29+
2830
func listReferences(w walker) (map[string]*v1.Descriptor, error) {
2931
refs := make(map[string]*v1.Descriptor)
3032
var index v1.Index
3133

3234
if err := w.walk(func(path string, info os.FileInfo, r io.Reader) error {
33-
if info.IsDir() || filepath.Clean(path) != "index.json" {
35+
if info.IsDir() || filepath.Clean(path) != indexPath {
3436
return nil
3537
}
3638

@@ -56,7 +58,7 @@ func findDescriptor(w walker, name string) (*v1.Descriptor, error) {
5658
var index v1.Index
5759

5860
switch err := w.walk(func(path string, info os.FileInfo, r io.Reader) error {
59-
if info.IsDir() || filepath.Clean(path) != "index.json" {
61+
if info.IsDir() || filepath.Clean(path) != indexPath {
6062
return nil
6163
}
6264

‎image/image.go‎

Lines changed: 120 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -88,14 +88,44 @@ func validate(w walker, refs []string, out *log.Logger) error {
8888
return err
8989
}
9090

91-
m, err := findManifest(w, d)
92-
if err != nil {
93-
return err
91+
if d.MediaType == validRefMediaTypes[0] {
92+
m, err := findManifest(w, d)
93+
if err != nil {
94+
return err
95+
}
96+
97+
if err := m.validate(w); err != nil {
98+
return err
99+
}
94100
}
95101

96-
if err := m.validate(w); err != nil {
97-
return err
102+
if d.MediaType == validRefMediaTypes[1] {
103+
index, err := findIndex(w, d)
104+
if err != nil {
105+
return err
106+
}
107+
108+
if err := validateIndex(index, w); err != nil {
109+
return err
110+
}
111+
112+
if len(index.Manifests) == 0 {
113+
fmt.Println("warning: no manifests found")
114+
return nil
115+
}
116+
117+
for _, manifest := range index.Manifests {
118+
m, err := findManifest(w, &(manifest.Descriptor))
119+
if err != nil {
120+
return err
121+
}
122+
123+
if err := m.validate(w); err != nil {
124+
return err
125+
}
126+
}
98127
}
128+
99129
if out != nil {
100130
out.Printf("reference %q: OK", ref)
101131
}
@@ -139,16 +169,51 @@ func unpack(w walker, dest, refName string) error {
139169
return err
140170
}
141171

142-
m, err := findManifest(w, ref)
143-
if err != nil {
144-
return err
172+
if ref.MediaType == validRefMediaTypes[0] {
173+
m, err := findManifest(w, ref)
174+
if err != nil {
175+
return err
176+
}
177+
178+
if err := m.validate(w); err != nil {
179+
return err
180+
}
181+
182+
return m.unpack(w, dest)
145183
}
146184

147-
if err = m.validate(w); err != nil {
148-
return err
185+
if ref.MediaType == validRefMediaTypes[1] {
186+
index, err := findIndex(w, ref)
187+
if err != nil {
188+
return err
189+
}
190+
191+
if err := validateIndex(index, w); err != nil {
192+
return err
193+
}
194+
195+
if len(index.Manifests) == 0 {
196+
fmt.Println("warning: no manifests found")
197+
return nil
198+
}
199+
200+
for _, manifest := range index.Manifests {
201+
m, err := findManifest(w, &(manifest.Descriptor))
202+
if err != nil {
203+
return err
204+
}
205+
206+
if err := m.validate(w); err != nil {
207+
return err
208+
}
209+
210+
if err := m.unpack(w, dest); err != nil {
211+
return err
212+
}
213+
}
149214
}
150215

151-
return m.unpack(w, dest)
216+
return nil
152217
}
153218

154219
// CreateRuntimeBundleLayout walks through the file tree given by src and
@@ -187,15 +252,54 @@ func createRuntimeBundle(w walker, dest, refName, rootfs string) error {
187252
return err
188253
}
189254

190-
m, err := findManifest(w, ref)
191-
if err != nil {
192-
return err
255+
if ref.MediaType == validRefMediaTypes[0] {
256+
m, err := findManifest(w, ref)
257+
if err != nil {
258+
return err
259+
}
260+
261+
if err := m.validate(w); err != nil {
262+
return err
263+
}
264+
265+
return createRuntimebundle(w, m, dest, rootfs)
193266
}
194267

195-
if err = m.validate(w); err != nil {
196-
return err
268+
if ref.MediaType == validRefMediaTypes[1] {
269+
index, err := findIndex(w, ref)
270+
if err != nil {
271+
return err
272+
}
273+
274+
if err := validateIndex(index, w); err != nil {
275+
return err
276+
}
277+
278+
if len(index.Manifests) == 0 {
279+
fmt.Println("warning: no manifests found")
280+
return nil
281+
}
282+
283+
for _, manifest := range index.Manifests {
284+
m, err := findManifest(w, &(manifest.Descriptor))
285+
if err != nil {
286+
return err
287+
}
288+
289+
if err := m.validate(w); err != nil {
290+
return err
291+
}
292+
293+
if err := createRuntimebundle(w, m, dest, rootfs); err != nil {
294+
return err
295+
}
296+
}
197297
}
198298

299+
return nil
300+
}
301+
302+
func createRuntimebundle(w walker, m *manifest, dest, rootfs string) error {
199303
c, err := findConfig(w, &m.Config)
200304
if err != nil {
201305
return err

‎image/index.go‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Copyright 2016 The Linux Foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package image
16+
17+
import (
18+
"bytes"
19+
"encoding/json"
20+
"fmt"
21+
"io"
22+
"io/ioutil"
23+
"os"
24+
"path/filepath"
25+
26+
"github.com/opencontainers/image-spec/schema"
27+
"github.com/opencontainers/image-spec/specs-go/v1"
28+
"github.com/pkg/errors"
29+
)
30+
31+
func findIndex(w walker, d *v1.Descriptor) (*v1.ImageIndex, error) {
32+
var index v1.ImageIndex
33+
34+
switch err := w.walk(func(path string, info os.FileInfo, r io.Reader) error {
35+
if info.IsDir() || filepath.Clean(path) != indexPath {
36+
return nil
37+
}
38+
39+
buf, err := ioutil.ReadAll(r)
40+
if err != nil {
41+
return errors.Wrapf(err, "%s: error reading index", path)
42+
}
43+
44+
if err := schema.ValidatorMediaTypeImageIndex.Validate(bytes.NewReader(buf)); err != nil {
45+
return errors.Wrapf(err, "%s: index validation failed", path)
46+
}
47+
48+
if err := json.Unmarshal(buf, &index); err != nil {
49+
return err
50+
}
51+
52+
return errEOW
53+
}); err {
54+
case errEOW:
55+
return &index, nil
56+
case nil:
57+
return nil, fmt.Errorf("index.json not found")
58+
default:
59+
return nil, err
60+
}
61+
}
62+
63+
func validateIndex(index *v1.ImageIndex, w walker) error {
64+
for _, manifest := range index.Manifests {
65+
if err := validateDescriptor(&manifest.Descriptor, w, []string{v1.MediaTypeImageManifest}); err != nil {
66+
return errors.Wrap(err, "manifest validation failed")
67+
}
68+
}
69+
return nil
70+
}

0 commit comments

Comments
 (0)