Open imjasonh opened 1 year ago
We (edit: don't) need separate data sources for validating images and indexes.
image
is a misnomer though, maybe digest
instead?
data "oci_ref" "alpine" {
ref = "alpine"
}
data "oci_validate" "validate" {
image = oci_ref.alpine.image_ref
test {
rule = keys(oci_ref.alpine.manifests) = ["linux/amd64", "linux/arm64"]
}
# TODO: test index annotations and SBOM
}
data "oci_validate" "validate" {
# test each platform
for_each = keys(oci_ref.alpine.manifests)
image = each.value.image_ref
test {
path = "/etc/passwd"
contains = "nobody"
}
# TODO: test image annotations and SBOM
}
Prior art: https://github.com/GoogleContainerTools/container-structure-test
Something like:
We can also consider command tests that effectively
docker run <image>
and inspect the result.