mirror of
https://github.com/docker/cli.git
synced 2026-01-26 15:41:42 +03:00
c9bb291154
move the `trust` subcommands to a plugin, so that the subcommands can
be installed separate from the `docker trust` integration in push/pull
(for situations where trust verification happens on the daemon side).
make binary
go build -o /usr/libexec/docker/cli-plugins/docker-trust ./cmd/docker-trust
docker info
Client:
Version: 28.2.0-dev
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.24.0
Path: /usr/libexec/docker/cli-plugins/docker-buildx
trust: Manage trust on Docker images (Docker Inc.)
Version: unknown-version
Path: /usr/libexec/docker/cli-plugins/docker-trust
docker trust --help
Usage: docker trust [OPTIONS] COMMAND
Extended build capabilities with BuildKit
Options:
-D, --debug Enable debug logging
Management Commands:
key Manage keys for signing Docker images
signer Manage entities who can sign Docker images
Commands:
inspect Return low-level information about keys and signatures
revoke Remove trust for an image
sign Sign an image
Run 'docker trust COMMAND --help' for more information on a command.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
package trust
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/docker/cli/cmd/docker-trust/internal/trust"
|
|
"github.com/theupdateframework/notary/client"
|
|
"github.com/theupdateframework/notary/tuf/data"
|
|
)
|
|
|
|
const (
|
|
releasedRoleName = "Repo Admin"
|
|
releasesRoleTUFName = "targets/releases"
|
|
)
|
|
|
|
// isReleasedTarget checks if a role name is "released":
|
|
// either targets/releases or targets TUF roles
|
|
func isReleasedTarget(role data.RoleName) bool {
|
|
return role == data.CanonicalTargetsRole || role == trust.ReleasesRole
|
|
}
|
|
|
|
// notaryRoleToSigner converts TUF role name to a human-understandable signer name
|
|
func notaryRoleToSigner(tufRole data.RoleName) string {
|
|
// don't show a signer for "targets" or "targets/releases"
|
|
if isReleasedTarget(data.RoleName(tufRole.String())) {
|
|
return releasedRoleName
|
|
}
|
|
return strings.TrimPrefix(tufRole.String(), "targets/")
|
|
}
|
|
|
|
// clearChangeList clears the notary staging changelist.
|
|
func clearChangeList(notaryRepo client.Repository) error {
|
|
cl, err := notaryRepo.GetChangelist()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return cl.Clear("")
|
|
}
|
|
|
|
// getOrGenerateRootKeyAndInitRepo initializes the notary repository
|
|
// with a remotely managed snapshot key. The initialization will use
|
|
// an existing root key if one is found, else a new one will be generated.
|
|
func getOrGenerateRootKeyAndInitRepo(notaryRepo client.Repository) error {
|
|
rootKey, err := getOrGenerateNotaryKey(notaryRepo, data.CanonicalRootRole)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return notaryRepo.Initialize([]string{rootKey.ID()}, data.CanonicalSnapshotRole)
|
|
}
|
|
|
|
const testPass = "password"
|
|
|
|
func testPassRetriever(string, string, bool, int) (string, bool, error) {
|
|
return testPass, false, nil
|
|
}
|