From 21629b0501c62a991eef536765b7320bc2d45763 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Thu, 18 Nov 2021 20:47:33 -0500
Subject: podman-remote does not support signature-policy
Fixes: https://github.com/containers/podman/issues/12357
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
cmd/podman/common/create.go | 13 +++++++------
cmd/podman/containers/runlabel.go | 7 ++++---
cmd/podman/images/import.go | 6 ++++--
cmd/podman/images/load.go | 6 ++++--
cmd/podman/images/pull.go | 6 ++++--
cmd/podman/images/push.go | 6 ++++--
cmd/podman/play/kube.go | 9 ++++++---
test/e2e/create_test.go | 8 ++++++--
test/e2e/import_test.go | 6 ++++++
test/e2e/load_test.go | 10 +++++++++-
test/e2e/run_test.go | 8 ++++++--
test/e2e/save_test.go | 18 ++++++++++--------
12 files changed, 70 insertions(+), 33 deletions(-)
diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go
index d73fa653f..dad79348d 100644
--- a/cmd/podman/common/create.go
+++ b/cmd/podman/common/create.go
@@ -551,11 +551,6 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
_ = cmd.RegisterFlagCompletionFunc(shmSizeFlagName, completion.AutocompleteNone)
stopSignalFlagName := "stop-signal"
- createFlags.StringVar(
- &cf.SignaturePolicy,
- "signature-policy", "",
- "`Pathname` of signature policy file (not usually used)",
- )
createFlags.StringVar(
&cf.StopSignal,
stopSignalFlagName, "",
@@ -702,10 +697,16 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
"Write the container process ID to the file")
_ = cmd.RegisterFlagCompletionFunc(pidFileFlagName, completion.AutocompleteDefault)
- _ = createFlags.MarkHidden("signature-policy")
if registry.IsRemote() {
_ = createFlags.MarkHidden("env-host")
_ = createFlags.MarkHidden("http-proxy")
+ } else {
+ createFlags.StringVar(
+ &cf.SignaturePolicy,
+ "signature-policy", "",
+ "`Pathname` of signature policy file (not usually used)",
+ )
+ _ = createFlags.MarkHidden("signature-policy")
}
createFlags.BoolVar(
diff --git a/cmd/podman/containers/runlabel.go b/cmd/podman/containers/runlabel.go
index 85f3785be..e60fcbe72 100644
--- a/cmd/podman/containers/runlabel.go
+++ b/cmd/podman/containers/runlabel.go
@@ -70,7 +70,6 @@ func init() {
flags.BoolVarP(&runlabelOptions.Pull, "pull", "p", true, "Pull the image if it does not exist locally prior to executing the label contents")
flags.BoolVarP(&runlabelOptions.Quiet, "quiet", "q", false, "Suppress output information when installing images")
flags.BoolVar(&runlabelOptions.Replace, "replace", false, "Replace existing container with a new one from the image")
- flags.StringVar(&runlabelOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
flags.BoolVar(&runlabelOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
// Hide the optional flags.
@@ -78,8 +77,10 @@ func init() {
_ = flags.MarkHidden("opt2")
_ = flags.MarkHidden("opt3")
_ = flags.MarkHidden("pull")
- _ = flags.MarkHidden("signature-policy")
-
+ if !registry.IsRemote() {
+ flags.StringVar(&runlabelOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+ _ = flags.MarkHidden("signature-policy")
+ }
if err := flags.MarkDeprecated("pull", "podman will pull if not found in local storage"); err != nil {
logrus.Error("unable to mark pull flag deprecated")
}
diff --git a/cmd/podman/images/import.go b/cmd/podman/images/import.go
index d4bc0f610..3b6788f4a 100644
--- a/cmd/podman/images/import.go
+++ b/cmd/podman/images/import.go
@@ -77,8 +77,10 @@ func importFlags(cmd *cobra.Command) {
_ = cmd.RegisterFlagCompletionFunc(messageFlagName, completion.AutocompleteNone)
flags.BoolVarP(&importOpts.Quiet, "quiet", "q", false, "Suppress output")
- flags.StringVar(&importOpts.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
- _ = flags.MarkHidden("signature-policy")
+ if !registry.IsRemote() {
+ flags.StringVar(&importOpts.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
+ _ = flags.MarkHidden("signature-policy")
+ }
}
func importCon(cmd *cobra.Command, args []string) error {
diff --git a/cmd/podman/images/load.go b/cmd/podman/images/load.go
index c39ae624e..5cd410f5c 100644
--- a/cmd/podman/images/load.go
+++ b/cmd/podman/images/load.go
@@ -64,8 +64,10 @@ func loadFlags(cmd *cobra.Command) {
_ = cmd.RegisterFlagCompletionFunc(inputFlagName, completion.AutocompleteDefault)
flags.BoolVarP(&loadOpts.Quiet, "quiet", "q", false, "Suppress the output")
- flags.StringVar(&loadOpts.SignaturePolicy, "signature-policy", "", "Pathname of signature policy file")
- _ = flags.MarkHidden("signature-policy")
+ if !registry.IsRemote() {
+ flags.StringVar(&loadOpts.SignaturePolicy, "signature-policy", "", "Pathname of signature policy file")
+ _ = flags.MarkHidden("signature-policy")
+ }
}
func load(cmd *cobra.Command, args []string) error {
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index a990d1626..2a5fd86cc 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -101,7 +101,6 @@ func pullFlags(cmd *cobra.Command) {
flags.Bool("disable-content-trust", false, "This is a Docker specific option and is a NOOP")
flags.BoolVarP(&pullOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
- flags.StringVar(&pullOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
flags.BoolVar(&pullOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
authfileFlagName := "authfile"
@@ -113,7 +112,10 @@ func pullFlags(cmd *cobra.Command) {
flags.StringVar(&pullOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
_ = cmd.RegisterFlagCompletionFunc(certDirFlagName, completion.AutocompleteDefault)
}
- _ = flags.MarkHidden("signature-policy")
+ if !registry.IsRemote() {
+ flags.StringVar(&pullOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+ _ = flags.MarkHidden("signature-policy")
+ }
}
// imagePull is implement the command for pulling images.
diff --git a/cmd/podman/images/push.go b/cmd/podman/images/push.go
index a13976612..cf787a71f 100644
--- a/cmd/podman/images/push.go
+++ b/cmd/podman/images/push.go
@@ -101,7 +101,6 @@ func pushFlags(cmd *cobra.Command) {
flags.BoolVarP(&pushOptions.Quiet, "quiet", "q", false, "Suppress output information when pushing images")
flags.BoolVar(&pushOptions.RemoveSignatures, "remove-signatures", false, "Discard any pre-existing signatures in the image")
- flags.StringVar(&pushOptions.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
signByFlagName := "sign-by"
flags.StringVar(&pushOptions.SignBy, signByFlagName, "", "Add a signature at the destination using the specified key")
@@ -117,7 +116,10 @@ func pushFlags(cmd *cobra.Command) {
_ = flags.MarkHidden("remove-signatures")
_ = flags.MarkHidden("sign-by")
}
- _ = flags.MarkHidden("signature-policy")
+ if !registry.IsRemote() {
+ flags.StringVar(&pushOptions.SignaturePolicy, "signature-policy", "", "Path to a signature-policy file")
+ _ = flags.MarkHidden("signature-policy")
+ }
}
// imagePush is implement the command for pushing images.
diff --git a/cmd/podman/play/kube.go b/cmd/podman/play/kube.go
index 581b29113..11b5d7d34 100644
--- a/cmd/podman/play/kube.go
+++ b/cmd/podman/play/kube.go
@@ -108,8 +108,6 @@ func init() {
flags.StringVar(&kubeOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
_ = kubeCmd.RegisterFlagCompletionFunc(certDirFlagName, completion.AutocompleteDefault)
- flags.StringVar(&kubeOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
-
seccompProfileRootFlagName := "seccomp-profile-root"
flags.StringVar(&kubeOptions.SeccompProfileRoot, seccompProfileRootFlagName, defaultSeccompRoot, "Directory path for seccomp profiles")
_ = kubeCmd.RegisterFlagCompletionFunc(seccompProfileRootFlagName, completion.AutocompleteDefault)
@@ -121,7 +119,12 @@ func init() {
buildFlagName := "build"
flags.BoolVar(&kubeOptions.Build, buildFlagName, false, "Build all images in a YAML (given Containerfiles exist)")
}
- _ = flags.MarkHidden("signature-policy")
+
+ if !registry.IsRemote() {
+ flags.StringVar(&kubeOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
+
+ _ = flags.MarkHidden("signature-policy")
+ }
}
func kube(cmd *cobra.Command, args []string) error {
diff --git a/test/e2e/create_test.go b/test/e2e/create_test.go
index d20dc8874..e6e8dcdb1 100644
--- a/test/e2e/create_test.go
+++ b/test/e2e/create_test.go
@@ -363,14 +363,18 @@ var _ = Describe("Podman create", func() {
})
It("podman create --signature-policy", func() {
- SkipIfRemote("SigPolicy not handled by remote")
session := podmanTest.Podman([]string{"create", "--pull=always", "--signature-policy", "/no/such/file", ALPINE})
session.WaitWithDefaultTimeout()
Expect(session).To(ExitWithError())
session = podmanTest.Podman([]string{"create", "--pull=always", "--signature-policy", "/etc/containers/policy.json", ALPINE})
session.WaitWithDefaultTimeout()
- Expect(session).Should(Exit(0))
+ if IsRemote() {
+ Expect(session).To(ExitWithError())
+ Expect(session.ErrorToString()).To(ContainSubstring("unknown flag"))
+ } else {
+ Expect(session).Should(Exit(0))
+ }
})
It("podman create with unset label", func() {
diff --git a/test/e2e/import_test.go b/test/e2e/import_test.go
index 519a7290c..d5b9efaf7 100644
--- a/test/e2e/import_test.go
+++ b/test/e2e/import_test.go
@@ -170,6 +170,12 @@ var _ = Describe("Podman import", func() {
result := podmanTest.Podman([]string{"import", "--signature-policy", "/etc/containers/policy.json", outfile})
result.WaitWithDefaultTimeout()
+ if IsRemote() {
+ Expect(result).To(ExitWithError())
+ Expect(result.ErrorToString()).To(ContainSubstring("unknown flag"))
+ result := podmanTest.Podman([]string{"import", outfile})
+ result.WaitWithDefaultTimeout()
+ }
Expect(result).Should(Exit(0))
})
})
diff --git a/test/e2e/load_test.go b/test/e2e/load_test.go
index a3ee1814a..3cf24037e 100644
--- a/test/e2e/load_test.go
+++ b/test/e2e/load_test.go
@@ -104,7 +104,15 @@ var _ = Describe("Podman load", func() {
result := podmanTest.Podman([]string{"load", "--signature-policy", "/etc/containers/policy.json", "-i", outfile})
result.WaitWithDefaultTimeout()
- Expect(result).Should(Exit(0))
+ if IsRemote() {
+ Expect(result).To(ExitWithError())
+ Expect(result.ErrorToString()).To(ContainSubstring("unknown flag"))
+ result = podmanTest.Podman([]string{"load", "-i", outfile})
+ result.WaitWithDefaultTimeout()
+ Expect(result).Should(Exit(0))
+ } else {
+ Expect(result).Should(Exit(0))
+ }
})
It("podman load with quiet flag", func() {
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 05cb986c6..d3e64c6f7 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -83,14 +83,18 @@ var _ = Describe("Podman run", func() {
})
It("podman run --signature-policy", func() {
- SkipIfRemote("SigPolicy not handled by remote")
session := podmanTest.Podman([]string{"run", "--pull=always", "--signature-policy", "/no/such/file", ALPINE})
session.WaitWithDefaultTimeout()
Expect(session).To(ExitWithError())
session = podmanTest.Podman([]string{"run", "--pull=always", "--signature-policy", "/etc/containers/policy.json", ALPINE})
session.WaitWithDefaultTimeout()
- Expect(session).Should(Exit(0))
+ if IsRemote() {
+ Expect(session).To(ExitWithError())
+ Expect(session.ErrorToString()).To(ContainSubstring("unknown flag"))
+ } else {
+ Expect(session).Should(Exit(0))
+ }
})
It("podman run --rm with --restart", func() {
diff --git a/test/e2e/save_test.go b/test/e2e/save_test.go
index 0b3a88da3..cdc5e7f1e 100644
--- a/test/e2e/save_test.go
+++ b/test/e2e/save_test.go
@@ -194,14 +194,16 @@ default-docker:
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
- session = podmanTest.Podman([]string{"pull", "--tls-verify=false", "--signature-policy=sign/policy.json", "localhost:5000/alpine"})
- session.WaitWithDefaultTimeout()
- Expect(session).Should(Exit(0))
-
- outfile := filepath.Join(podmanTest.TempDir, "temp.tar")
- save := podmanTest.Podman([]string{"save", "remove-signatures=true", "-o", outfile, "localhost:5000/alpine"})
- save.WaitWithDefaultTimeout()
- Expect(save).To(ExitWithError())
+ if !IsRemote() {
+ session = podmanTest.Podman([]string{"pull", "--tls-verify=false", "--signature-policy=sign/policy.json", "localhost:5000/alpine"})
+ session.WaitWithDefaultTimeout()
+ Expect(session).Should(Exit(0))
+
+ outfile := filepath.Join(podmanTest.TempDir, "temp.tar")
+ save := podmanTest.Podman([]string{"save", "remove-signatures=true", "-o", outfile, "localhost:5000/alpine"})
+ save.WaitWithDefaultTimeout()
+ Expect(save).To(ExitWithError())
+ }
})
It("podman save image with digest reference", func() {
--
cgit v1.2.3-54-g00ecf