search

cnabio / cnab-go

A Go implementation of CNAB Core 1.0
MIT License
69 stars 37 forks source link

WIP: Introduce a digest validation interface and docker implementation #113

Closed jeremyrickard closed 2 years ago

jeremyrickard commented 5 years ago

This introduces a Validate interface for image contentDigest validation, along with an implementation for Docker and OCI images that uses github.com/pivotal/image-relocation to obtain the digest based on the specified image image (thanks for the suggestion @glyn). This also allows us to implement additional validators down the road.

By default, validation will fail if a digest is not provided in the Image struct. This can be overridden by setting allowMissingDigests to true.

Note: this doesn't actually change any of the drivers/operation code. Clients of cnab-go will need to invoke the validation before calling an operation. This is done in order to allow validation of ALL the images referenced in the bundle. Currently, Operation only knows about the invocation image. This also allows clients to handle things like relocation mapping or any other mapping of bundle image to actual image that might be run. It also didn't feel appropriate to place the validation calls in the driver's themselves, as a given operation might actually need to validate multiple image types down the road (example: we use a Docker based invocation image that deploys OVA files to some VMware infrastructure) and it seemed like a cleaner separation to not mix with the drivers. Also allows this to be called outside of the context of a call to a driver Run(..), but I'm happy to wire it up to the Operations if desired.

Closes #101

technosophos commented 4 years ago

What should we do with this PR?

carolynvs commented 2 years ago

Closing since this PR is stale and we don't have anyone at the moment interested in finishing it. If anyone would like this functionality, let's start a fresh PR from the most recent release.