summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Merge pull request #15490 from rhatdan/codespellOpenShift Merge Robot2022-08-26
|\ | | | | Run codespell
| * Run codespellDaniel J Walsh2022-08-25
| | | | | | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | Merge pull request #15487 from mheon/image_delete_eventOpenShift Merge Robot2022-08-26
|\ \ | |/ |/| Compat API image remove events now have 'delete' status
| * Compat API image remove events now have 'delete' statusMatthew Heon2022-08-25
| | | | | | | | | | | | | | | | | | Change only the compat API, so we don't force a breaking change on Libpod API users. Partial fix for #15485 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* | Merge pull request #15466 from mtrmac/image-trust-sigstoreDaniel J Walsh2022-08-25
|\ \ | |/ |/| podman image trust overhaul, incl. sigstore
| * Preserve all unknown PolicyRequirement fields on (podman image trust set)Miloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | | | We are unmarshaling and re-marshaling JSON, which can _silently_ drop data with the Go design decision.data. Try harder, by using json.RawMessage at least for the data we care about. Alternatively, this could use json.Decoder.DisallowUnknownFields. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Reorganize the types in policy.go a bitMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | ... to go from top to bottom. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Add support for showing keyPaths in (podman image trust show)Miloslav Trmač2022-08-25
| | | | | | | | Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Support (image trust show) for sigstoreSigned entriesMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | sigstoreSigned does not have GPG IDs, so we add N/A in that column. NOTE: this does not show the use-sigstore-attachments value from registries.d. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * BREAKING CHANGE: Change how (podman image trust show) represents multiple ↵Miloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | requirements Currently - the output uses the first entry's type, even if the requirements are different (notably signedBy + sigstoreSIgned) - all public keys IDs are collected to a single line, even if some of them are interchangeable, and some are required (e.g. two signedBy requirements could require an image to be signed by (redhatProd OR redhatBeta) AND (vendor1 OR vendor2) So, stop collapsing the requirements, and return a separate entry for each one. Multiple GPG IDs on a single line used to mean AND or OR, now they always mean AND. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Reorganize descriptionsOfPolicyRequirements a bitMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | Do the registries.d lookup once, separately from building an entry, so that we can share it across entries. Also prepare a separate res to allow adding multiple entries. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Use the full descriptionsOfPolicyRequirements for the default scopeMiloslav Trmač2022-08-25
| | | | | | | | | | | | ... instead of taking a shortcut, e.g. not listing any keys if they are required. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Rename haveMatchRegistry to registriesDConfigurationForScopeMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | Just so that we don't have a boolean-named function returning a struct. Also reorder the parameters to have the container first, and the lookup key second. Shoud not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Rename tempTrustShowOutput to entryMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | Now that it is the primary return value of a small function, the long name only makes reading harder. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Split descriptionsOfPolicyRequirements out of getPolicyShowOutputMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | This will evetually allow us to use it for the default scope as well, which currently uses a simplified version. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Recognize the new lookaside names for simple signing sigstoreMiloslav Trmač2022-08-25
| | | | | | | | Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Add a unit test for trust.PolicyDescriptionMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | Add at least a basic unit test for the various entry types. So that we don't have to actually deal with GPG keys and /usr/bin/gpg*, parametrize the code with a gpgIDReader , and pass a fake one in the unit test. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Make the output of (podman image trust show) deterministicMiloslav Trmač2022-08-25
| | | | | | | | | | | | Sort map keys instead of iterating in the Go-imposed random order. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Make most of pkg/trust package-privateMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | We now have only a few entrypoints that are called externally, so make the rest private. This will make it more obvious that we are not breaking any external users. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescriptionMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | This will allow us to write unit tests without setting up the complete Podman runtime (and without the Linux dependency). Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Add support for sigstoreSigned in (podman image trust set)Miloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | NOTE: This does not edit the use-sigstore-attachments value in registries.d, similarly to how (podman image trust set) didn't set the lookaside paths for simple signing. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Create new policy entries together with validating inputMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | That way, we don't have to switch over trustType twice. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Improve validation of data in ImageEngine.SetTrustMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | - Also reject public keys with types that don't use them - Reject unknown trust types - And add unit tests Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntriesMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | | | This will allow us to write unit tests without setting up the complete Podman runtime (and without the Linux dependency). Also, actually add a basic smoke test of the core functionality. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Add a variable for scopeMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | | | | | Only process the incoming args[] (which is a single-element array for some reason) once, and use a semantic variable name for the value we care about. Should not change behavior, the only caller already supposedly ensures that len(args) == 1. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Make trust.CreateTempFile privateMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | Nothing uses it outside the package. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Reorganize pkg/trustMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | Split the existing code into policy.go and registries.go, depending on which files it concerns. Only moves unchanged code, should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Remove an unused trust.ShowOutput typeMiloslav Trmač2022-08-25
| | | | | | | | | | | | Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * Remove commented out codeMiloslav Trmač2022-08-25
| | | | | | | | | | | | | | | | | | We can always recover it from git, but it seems to serve no purpose anyway. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* | Merge pull request #15433 from arixmkii/win_compat3_rootlessOpenShift Merge Robot2022-08-24
|\ \ | | | | | | Fixes isRootful check using qemu machine on Windows
| * | Fixes isRootfull check using qemu machine on WindowsArthur Sengileyev2022-08-24
| | | | | | | | | | | | Signed-off-by: Arthur Sengileyev <arthur.sengileyev@gmail.com>
* | | Merge pull request #15434 from rhatdan/manifest1OpenShift Merge Robot2022-08-24
|\ \ \ | |_|/ |/| | Allow podman to run in an environment with keys containing spaces
| * | Allow podman to run in an environment with keys containing spacesDaniel J Walsh2022-08-23
| | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/15251 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Merge pull request #15437 from mheon/default_volume_timeoutOpenShift Merge Robot2022-08-24
|\ \ \ | | | | | | | | Add support for containers.conf volume timeouts
| * | | Add support for containers.conf volume timeoutsMatthew Heon2022-08-23
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, do a general cleanup of all the timeout code. Changes include: - Convert from int to *uint where possible. Timeouts cannot be negative, hence the uint change; and a timeout of 0 is valid, so we need a new way to detect that the user set a timeout (hence, pointer). - Change name in the database to avoid conflicts between new data type and old one. This will cause timeouts set with 4.2.0 to be lost, but considering nobody is using the feature at present (and the lack of validation means we could have invalid, negative timeouts in the DB) this feels safe. - Ensure volume plugin timeouts can only be used with volumes created using a plugin. Timeouts on the local driver are nonsensical. - Remove the existing test, as it did not use a volume plugin. Write a new test that does. The actual plumbing of the containers.conf timeout in is one line in volume_api.go; the remainder are the above-described cleanups. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | Merge pull request #15443 from flouthoc/env-merge-supportOpenShift Merge Robot2022-08-24
|\ \ \ | | | | | | | | run,create: add support for `--env-merge` for preprocessing default environment variables
| * | | run,create: add support for --env-merge for preprocessing varsAditya R2022-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow end users to preprocess default environment variables before injecting them into container using `--env-merge` Usage ``` podman run -it --rm --env-merge some=${some}-edit --env-merge some2=${some2}-edit2 myimage sh ``` Closes: https://github.com/containers/podman/issues/15288 Signed-off-by: Aditya R <arajan@redhat.com>
* | | | Merge pull request #15351 from marshall-lee/images-pull-simpleOpenShift Merge Robot2022-08-24
|\ \ \ \ | |/ / / |/| | | Simplify ImagesPull for when Quiet flag is on
| * | | Add ProgressWriter to PullOptionsVladimir Kochnev2022-08-19
| | | | | | | | | | | | | | | | Signed-off-by: Vladimir Kochnev <hashtable@yandex.ru>
| * | | Use request Context() in API handlersVladimir Kochnev2022-08-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Request object has its own context which must be used during a request lifetime instead of just context.Background() [NO NEW TESTS NEEDED] Signed-off-by: Vladimir Kochnev <hashtable@yandex.ru>
| * | | Simplify ImagesPull for when Quiet flag is onVladimir Kochnev2022-08-18
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | Refactor ImagesPull the same way the ImagesPush and ManifestPush are done. [NO NEW TESTS NEEDED] Signed-off-by: Vladimir Kochnev <hashtable@yandex.ru>
* | | Merge pull request #15372 from arixmkii/win_compatOpenShift Merge Robot2022-08-23
|\ \ \ | |_|/ |/| | Improved Windows compatibility
| * | Improved Windows compatibilityArthur Sengileyev2022-08-23
| |/ | | | | | | Signed-off-by: Arthur Sengileyev <arthur.sengileyev@gmail.com>
* | Merge pull request #15421 from sstosh/refactor-rawinputOpenShift Merge Robot2022-08-23
|\ \ | | | | | | Refactor: About the RawInput process
| * | Refactor: About the RawInput processToshiki Sonoda2022-08-23
| |/ | | | | | | | | | | | | | | | | | | Refactor the RawInput process of the `rm` and `start` subcommands, like the other subcommands such as `restart, stop, etc`. [NO NEW TESTS NEEDED] Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | Merge pull request #15415 from cdoern/cloneOpenShift Merge Robot2022-08-23
|\ \ | | | | | | pass environment variables to container clone
| * | pass environment variables to container cloneCharlie Doern2022-08-22
| |/ | | | | | | | | | | | | | | the env vars are held in the spec rather than the config, so they need to be mapped manually. They are also of a different format so special handling needed to be added. All env from the parent container will now be passed to the clone. resolves #15242 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* / Warning messages are printed and ignored if we use an unsupported optionToshiki Sonoda2022-08-23
|/ | | | | | | | | | | | | | | | | | | When an unsupported limit on cgroups V1 rootless systems is requested, podman prints an warning message and ignores the option/flag. ``` Target options/flags: --cpu-period, --cpu-quota, --cpu-rt-period, --cpu-rt-runtime, --cpus, --cpu-shares, --cpuset-cpus, --cpuset-mems, --memory, --memory-reservation, --memory-swap, --memory-swappiness, --blkio-weight, --device-read-bps, --device-write-bps, --device-read-iops, --device-write-iops, --blkio-weight-device ``` Related to https://github.com/containers/podman/discussions/10152 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* Merge pull request #15368 from m0duspwnens/api_sort_hc_bindsOpenShift Merge Robot2022-08-17
|\ | | | | sort hc.Binds returned from compat api
| * sort hc.Binds returned from compat apiJosh Patterson2022-08-17
| | | | | | | | Signed-off-by: Josh Patterson <josh.patterson@securityonionsolutions.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-05 09:21:55 +0000