Merge pull request #15933 from vrothberg/fix-15879

auto-update: validate container image

3 files changed, 5 insertions, 91 deletions

diff --git a/pkg/autoupdate/autoupdate.go b/pkg/autoupdate/autoupdate.go
index 9cf77d135..a0ed8ccba 100644
--- a/pkg/autoupdate/autoupdate.go
+++ b/pkg/autoupdate/autoupdate.go
@@ -9,8 +9,6 @@ import (
 	"github.com/containers/common/libimage"
 	"github.com/containers/common/pkg/config"
 	"github.com/containers/image/v5/docker"
-	"github.com/containers/image/v5/docker/reference"
-	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/podman/v4/libpod"
 	"github.com/containers/podman/v4/libpod/define"
 	"github.com/containers/podman/v4/libpod/events"
@@ -21,14 +19,6 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-// Label denotes the container/pod label key to specify auto-update policies in
-// container labels.
-const Label = "io.containers.autoupdate"
-
-// Label denotes the container label key to specify authfile in
-// container labels.
-const AuthfileLabel = "io.containers.autoupdate.authfile"
-
 // Policy represents an auto-update policy.
 type Policy string
 
@@ -102,32 +92,7 @@ func LookupPolicy(s string) (Policy, error) {
 	return "", fmt.Errorf("invalid auto-update policy %q: valid policies are %+q", s, keys)
 }
 
-// ValidateImageReference checks if the specified imageName is a fully-qualified
-// image reference to the docker transport (without digest).  Such a reference
-// includes a domain, name and tag (e.g., quay.io/podman/stable:latest).  The
-// reference may also be prefixed with "docker://" explicitly indicating that
-// it's a reference to the docker transport.
-func ValidateImageReference(imageName string) error {
-	// Make sure the input image is a docker.
-	imageRef, err := alltransports.ParseImageName(imageName)
-	if err == nil && imageRef.Transport().Name() != docker.Transport.Name() {
-		return fmt.Errorf("auto updates require the docker image transport but image is of transport %q", imageRef.Transport().Name())
-	} else if err != nil {
-		repo, err := reference.Parse(imageName)
-		if err != nil {
-			return fmt.Errorf("enforcing fully-qualified docker transport reference for auto updates: %w", err)
-		}
-		if _, ok := repo.(reference.NamedTagged); !ok {
-			return fmt.Errorf("auto updates require fully-qualified image references (no tag): %q", imageName)
-		}
-		if _, ok := repo.(reference.Digested); ok {
-			return fmt.Errorf("auto updates require fully-qualified image references without digest: %q", imageName)
-		}
-	}
-	return nil
-}
-
-// AutoUpdate looks up containers with a specified auto-update policy and acts
+/// AutoUpdate looks up containers with a specified auto-update policy and acts
 // accordingly.
 //
 // If the policy is set to PolicyRegistryImage, it checks if the image
@@ -418,7 +383,7 @@ func (u *updater) assembleTasks(ctx context.Context) []error {
 		// Check the container's auto-update policy which is configured
 		// as a label.
 		labels := ctr.Labels()
-		value, exists := labels[Label]
+		value, exists := labels[define.AutoUpdateLabel]
 		if !exists {
 			continue
 		}
@@ -454,7 +419,7 @@ func (u *updater) assembleTasks(ctx context.Context) []error {
 		}
 
 		t := task{
-			authfile:     labels[AuthfileLabel],
+			authfile:     labels[define.AutoUpdateAuthfileLabel],
 			auto:         u,
 			container:    ctr,
 			policy:       policy,
diff --git a/pkg/autoupdate/autoupdate_test.go b/pkg/autoupdate/autoupdate_test.go
deleted file mode 100644
index 7a5da5bb0..000000000
--- a/pkg/autoupdate/autoupdate_test.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package autoupdate
-
-import (
-	"testing"
-)
-
-func TestValidateImageReference(t *testing.T) {
-	tests := []struct {
-		input string
-		valid bool
-	}{
-		{ // Fully-qualified reference
-			input: "quay.io/foo/bar:tag",
-			valid: true,
-		},
-		{ // Fully-qualified reference in transport notation
-			input: "docker://quay.io/foo/bar:tag",
-			valid: true,
-		},
-		{ // Fully-qualified reference but with digest
-			input: "quay.io/foo/bar@sha256:c9b1b535fdd91a9855fb7f82348177e5f019329a58c53c47272962dd60f71fc9",
-			valid: false,
-		},
-		{ // Reference with missing tag
-			input: "quay.io/foo/bar",
-			valid: false,
-		},
-		{ // Short name
-			input: "alpine",
-			valid: false,
-		},
-		{ // Short name with repo
-			input: "library/alpine",
-			valid: false,
-		},
-		{ // Wrong transport
-			input: "docker-archive:/some/path.tar",
-			valid: false,
-		},
-	}
-
-	for _, test := range tests {
-		err := ValidateImageReference(test.input)
-		if test.valid && err != nil {
-			t.Fatalf("parsing %q should have succeeded: %v", test.input, err)
-		} else if !test.valid && err == nil {
-			t.Fatalf("parsing %q should have failed", test.input)
-		}
-	}
-}
diff --git a/pkg/domain/infra/abi/play.go b/pkg/domain/infra/abi/play.go
index bd9117f72..4a83cb464 100644
--- a/pkg/domain/infra/abi/play.go
+++ b/pkg/domain/infra/abi/play.go
@@ -20,7 +20,6 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v4/libpod"
 	"github.com/containers/podman/v4/libpod/define"
-	"github.com/containers/podman/v4/pkg/autoupdate"
 	"github.com/containers/podman/v4/pkg/domain/entities"
 	v1apps "github.com/containers/podman/v4/pkg/k8s.io/api/apps/v1"
 	v1 "github.com/containers/podman/v4/pkg/k8s.io/api/core/v1"
@@ -816,8 +815,8 @@ func (ic *ContainerEngine) getImageAndLabelInfo(ctx context.Context, cwd string,
 		}
 	}
 
-	setLabel(autoupdate.Label)
-	setLabel(autoupdate.AuthfileLabel)
+	setLabel(define.AutoUpdateLabel)
+	setLabel(define.AutoUpdateAuthfileLabel)
 
 	return pulledImage, labels, nil
 }