aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* BREAKING CHANGE: Change how (podman image trust show) represents multiple ↵Miloslav Trmač2022-08-29
| | | | | | | | | | | | | | | | requirements Currently - the output uses the first entry's type, even if the requirements are different (notably signedBy + sigstoreSIgned) - all public keys IDs are collected to a single line, even if some of them are interchangeable, and some are required (e.g. two signedBy requirements could require an image to be signed by (redhatProd OR redhatBeta) AND (vendor1 OR vendor2) So, stop collapsing the requirements, and return a separate entry for each one. Multiple GPG IDs on a single line used to mean AND or OR, now they always mean AND. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Reorganize descriptionsOfPolicyRequirements a bitMiloslav Trmač2022-08-29
| | | | | | | | | Do the registries.d lookup once, separately from building an entry, so that we can share it across entries. Also prepare a separate res to allow adding multiple entries. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Use the full descriptionsOfPolicyRequirements for the default scopeMiloslav Trmač2022-08-29
| | | | | | ... instead of taking a shortcut, e.g. not listing any keys if they are required. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Rename haveMatchRegistry to registriesDConfigurationForScopeMiloslav Trmač2022-08-29
| | | | | | | | | | Just so that we don't have a boolean-named function returning a struct. Also reorder the parameters to have the container first, and the lookup key second. Shoud not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Rename tempTrustShowOutput to entryMiloslav Trmač2022-08-29
| | | | | | | | | Now that it is the primary return value of a small function, the long name only makes reading harder. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Split descriptionsOfPolicyRequirements out of getPolicyShowOutputMiloslav Trmač2022-08-29
| | | | | | | | | This will evetually allow us to use it for the default scope as well, which currently uses a simplified version. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Recognize the new lookaside names for simple signing sigstoreMiloslav Trmač2022-08-29
| | | | Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Add a unit test for trust.PolicyDescriptionMiloslav Trmač2022-08-29
| | | | | | | | | | Add at least a basic unit test for the various entry types. So that we don't have to actually deal with GPG keys and /usr/bin/gpg*, parametrize the code with a gpgIDReader , and pass a fake one in the unit test. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Make the output of (podman image trust show) deterministicMiloslav Trmač2022-08-29
| | | | | | Sort map keys instead of iterating in the Go-imposed random order. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Make most of pkg/trust package-privateMiloslav Trmač2022-08-29
| | | | | | | | We now have only a few entrypoints that are called externally, so make the rest private. This will make it more obvious that we are not breaking any external users. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescriptionMiloslav Trmač2022-08-29
| | | | | | | | | This will allow us to write unit tests without setting up the complete Podman runtime (and without the Linux dependency). Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Add support for sigstoreSigned in (podman image trust set)Miloslav Trmač2022-08-29
| | | | | | | | NOTE: This does not edit the use-sigstore-attachments value in registries.d, similarly to how (podman image trust set) didn't set the lookaside paths for simple signing. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Create new policy entries together with validating inputMiloslav Trmač2022-08-29
| | | | | | | | That way, we don't have to switch over trustType twice. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Improve validation of data in ImageEngine.SetTrustMiloslav Trmač2022-08-29
| | | | | | | | - Also reject public keys with types that don't use them - Reject unknown trust types - And add unit tests Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntriesMiloslav Trmač2022-08-29
| | | | | | | | | | | This will allow us to write unit tests without setting up the complete Podman runtime (and without the Linux dependency). Also, actually add a basic smoke test of the core functionality. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Add a variable for scopeMiloslav Trmač2022-08-29
| | | | | | | | | | | Only process the incoming args[] (which is a single-element array for some reason) once, and use a semantic variable name for the value we care about. Should not change behavior, the only caller already supposedly ensures that len(args) == 1. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Make trust.CreateTempFile privateMiloslav Trmač2022-08-29
| | | | | | | | Nothing uses it outside the package. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Reorganize pkg/trustMiloslav Trmač2022-08-29
| | | | | | | | | Split the existing code into policy.go and registries.go, depending on which files it concerns. Only moves unchanged code, should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Remove an unused trust.ShowOutput typeMiloslav Trmač2022-08-29
| | | | | | Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Remove commented out codeMiloslav Trmač2022-08-29
| | | | | | | | | We can always recover it from git, but it seems to serve no purpose anyway. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* Merge pull request #15326 from edsantiago/rhel8_test_skipOpenShift Merge Robot2022-08-16
|\ | | | | [v4.2] Skip / update some tests under runc
| * Skip / update some tests under runcEd Santiago2022-08-15
|/ | | | | | | | | | | | | | | | | | | Two fixes done in #14972 (the "oops test under runc again" PR which was not backported into 4.2): - "survive service stop" - skip. Test is only applicable under crun. - "volume exec/noexec" - update the expected error message One hail-mary fix for a test failure seen in RHEL87 gating: - "nonexistent labels" - slight tweak to expected error message None of these fixes will actually be tested in CI, because v4.2 does not run any runc tests. We'll have to wait and see what happens on the next RHEL build. Signed-off-by: Ed Santiago <santiago@redhat.com>
* Merge pull request #15279 from mheon/bump_420_finalOpenShift Merge Robot2022-08-11
|\ | | | | Final Backports and Bump to v4.2.0
| * Bump to v4.2.1-devMatthew Heon2022-08-10
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Bump to v4.2.0v4.2.0Matthew Heon2022-08-10
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Final release notes for v4.2.0Matthew Heon2022-08-10
| | | | | | | | Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Document behavior of --timestamp when only FROM is usedTomas Volf2022-08-10
| | | | | | | | | | | | Fixes: #15171 Signed-off-by: Tomas Volf <tomas.volf@showmax.com>
| * check memory test based on rangeBrent Baude2022-08-10
| | | | | | | | | | | | | | | | | | when verifying that the memory was set correctly for a podman machine instance, we check if the number is between a range because based on architecture, operating system, and memory itself this number can differ significantly. Signed-off-by: Brent Baude <bbaude@redhat.com>
| * specgen: use sandbox id instead of name for annotationGiuseppe Scrivano2022-08-10
| | | | | | | | | | | | | | | | | | | | | | use the sandbox id instead of the name for the io.kubernetes.cri-o.SandboxID annotation used by gVisor. Closes: https://github.com/containers/podman/issues/15223 [NO NEW TESTS NEEDED] it is specific to gVisor Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * cmd: refuse --userns if a mapping is specifiedGiuseppe Scrivano2022-08-10
| | | | | | | | | | | | | | | | | | if an explicit mapping is specified, do not accept `--userns` since it overriden to "private". Closes: https://github.com/containers/podman/issues/15233 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
| * e2e: Add rootless mount cleanup testToshiki Sonoda2022-08-10
| | | | | | | | | | | | `podman run -d mount cleanup test` adapt to rootless environment. Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
| * [CI:COPR] podman.spec.rpkg: add python3 dependency for el8Lokesh Mandvekar2022-08-10
| | | | | | | | | | | | | | | | | | | | EL8 builds are failing because hack/markdown-preprocess needs python3 which AFAICT isn't included by default in EL8 build environments. This commit also includes an additional `[CI:COPR]` mode which is currently runs the same tests as `[CI:DOCS]` but could differ in future. Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
| * start filter flag changesKarthik Elango2022-08-10
| | | | | | | | | | | | Tying filtering logic for podman stop and start to same place in getContainersAndInputByContext() to reduce code redundancy Signed-off-by: Karthik Elango <kelango@redhat.com>
| * Cirrus: Run Cross builds in [CI:DOCS] modeChris Evich2022-08-10
| | | | | | | | | | | | | | | | | | | | | | Fixes: #15189 A while ago I updated the only_if/skip options and forgot that several "cross build" tasks also build documentation in addition to binaries. Re-enable them to execute all the time, except when Cirrus-cron is making our multi-arch images. Signed-off-by: Chris Evich <cevich@redhat.com>
| * podman info: hide `--debug`Valentin Rothberg2022-08-10
| | | | | | | | | | | | | | | | | | It's a NOP since Podman v2.0 (#5738). [NO NEW TESTS NEEDED] - does not change behavior. Fixes: #15185 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
| * ISSUE TEMPLATE: remove `--debug` from `podman info`Valentin Rothberg2022-08-10
| | | | | | | | | | | | `--debug` is a NOP and will be hidden in a later commit. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
| * Cirrus: use dnf instead of rpm to install packagesLokesh Mandvekar2022-08-10
| | | | | | | | Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
| * Cirrus: Fix e2e tests for "mount_rootless_test"Toshiki Sonoda2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | e2e `mount_rootless_test` did not load `podman binary path` successfully. This PR fix this problem. [It] podman unshare podman mount: ``` [+1596s] Running: ... unshare mount <cid> [+1596s] Error: exec: no command [+1596s] output: ``` [It] podman unshare image podman mount: ``` [+1599s] Running: ... unshare image mount quay.io/libpod/alpine:latest [+1599s] Error: exec: no command [+1599s] output: ``` Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
| * podman generate systemd --new: allow -h hostnamePaul Holzinger2022-08-10
| | | | | | | | | | | | | | | | | | | | podman run/create can accept `-h <hostname>` as argument. When parsing flags -h throws an help requested error from pflag. To prevent this error we have to define the help flag. Fixes #15124 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * test: verify manifest inspect must contain OCI annotationsAditya R2022-08-10
| | | | | | | | Signed-off-by: Aditya R <arajan@redhat.com>
| * podman-volume-import: Reword "precendence"Felix Stupp2022-08-10
| | | | | | Signed-off-by: Felix Stupp <me+github@banananet.work>
| * man podman-volume-import: Clarify that merge happensFelix Stupp2022-08-10
| | | | | | | | | | Current directories and files stay the same with the current implementation as long as the tarball does not contain a directories or files with the same name. Signed-off-by: Felix Stupp <me+github@banananet.work>
| * podman generate systemd: handle --sdnotify correctlyPaul Holzinger2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | When a container was created with `--sdnotify value` we would remove this arg instead of using it like with `--sdnotfiy=value`. Also when the arg is set to ignore we should force conmon in order to make the resulting Type=notify units work. Fixes #15052 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
| * Bump google.golang.org/protobuf from 1.28.0 to 1.28.1dependabot[bot]2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) from 1.28.0 to 1.28.1. - [Release notes](https://github.com/protocolbuffers/protobuf-go/releases) - [Changelog](https://github.com/protocolbuffers/protobuf-go/blob/master/release.bash) - [Commits](https://github.com/protocolbuffers/protobuf-go/compare/v1.28.0...v1.28.1) --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
| * Use 8k buffer to help clients w/ broken parsingJason T. Greene2022-08-10
| | | | | | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
| * With --rm option remove container if podman run failsDaniel J Walsh2022-08-10
| | | | | | | | | | | | | | | | | | | | Fixes https://github.com/containers/podman/issues/15049 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> <MH: Fixed cherry-pick conflicts> Signed-off-by: Matthew Heon <mheon@redhat.com>
| * Bump golang.org/x/tools from 0.1.11 to 0.1.12 in /test/toolsdependabot[bot]2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.1.11 to 0.1.12. - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.1.11...v0.1.12) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
| * syncContainer: transition from `stopping` to `exited`Valentin Rothberg2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow the cleanup process (and others) to transition the container from `stopping` to `exited`. This fixes a race condition detected in #14859 where the cleanup process kicks in _before_ the stopping process can read the exit file. Prior to this fix, the cleanup process left the container in the `stopping` state and removed the conmon files, such that the stopping process also left the container in this state as it could not read the exit files. Hence, `podman wait` timed out (see the 23 seconds execution time of the test [1]) due to the unexpected/invalid state and the test failed. Further turn the warning during stop to a debug message since it's a natural race due to the daemonless/concurrent architecture and nothing to worry about. [NO NEW TESTS NEEDED] since we can only monitor if #14859 continues flaking or not. [1] https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/6210434704343040/html/sys-remote-fedora-36-rootless-host.log.html#t--00205 Fixes: #14859 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
| * Fix: manifest push --rm removes a correct manifest listToshiki Sonoda2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bug is reproduced when we execute the following command: 1. podman manifest add <manifest list> <images exist on local storage> 2. podman manifest push --rm <manifest list> dir:<directory> If pushing succeeds, it is expected to remove only a manifest list. However, manifest list remains on local storage and images are removed. This commit fixes `podman manifest push --rm` to remove only a manifest list. And, supports `manifest push --rm option` in remote environment, like host environment. Fixes: https://github.com/containers/podman/issues/15033 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
| * Fix: Restore a container which name is equal to a image nameToshiki Sonoda2022-08-10
| | | | | | | | | | | | | | | | If there is a match for both container and image, we restore the container. Fixes: https://github.com/containers/podman/issues/15055 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-04-09 10:42:53 +0000