containers: Patch skopeo to have `--deny-default-insecure`

[cgwalters]

We should add skopeo copy --deny-default-insecure to implement SignatureSource::ContainerPolicy properly, which tries to deny fetching unsigned images.

I started on this:

diff --git a/signature/policy_eval.go b/signature/policy_eval.go
index edcbf52..dfec8f5 100644
--- a/signature/policy_eval.go
+++ b/signature/policy_eval.go
@@ -131,7 +131,7 @@ func policyIdentityLogName(ref types.ImageReference) string {
 }

 // requirementsForImageRef selects the appropriate requirements for ref.
-func (pc *PolicyContext) requirementsForImageRef(ref types.ImageReference) PolicyRequirements {
+func (pc *PolicyContext) requirementsForImageRef(ref types.ImageReference, allowDefault bool) PolicyRequirements {
    // Do we have a PolicyTransportScopes for this transport?
    transportName := ref.Transport().Name()
    if transportScopes, ok := pc.Policy.Transports[transportName]; ok {
@@ -157,8 +157,11 @@ func (pc *PolicyContext) requirementsForImageRef(ref types.ImageReference) Polic
        }
    }

-   logrus.Debugf(" Using default policy section")
-   return pc.Policy.Default
+   if allowDefault {
+       logrus.Debugf(" Using default policy section")
+       return pc.Policy.Default
+   }
+   return []PolicyRequirement{}
 }

 // GetSignaturesWithAcceptedAuthor returns those signatures from an image
@@ -186,7 +189,7 @@ func (pc *PolicyContext) GetSignaturesWithAcceptedAuthor(ctx context.Context, im
    }()

    logrus.Debugf("GetSignaturesWithAcceptedAuthor for image %s", policyIdentityLogName(image.Reference()))
-   reqs := pc.requirementsForImageRef(image.Reference())
+   reqs := pc.requirementsForImageRef(image.Reference(), true)

    // FIXME: rename Signatures to UnverifiedSignatures
    // FIXME: pass context.Context
@@ -250,12 +253,7 @@ func (pc *PolicyContext) GetSignaturesWithAcceptedAuthor(ctx context.Context, im
    return res, nil
 }

-// IsRunningImageAllowed returns true iff the policy allows running the image.
-// If it returns false, err must be non-nil, and should be an PolicyRequirementError if evaluation
-// succeeded but the result was rejection.
-// WARNING: This validates signatures and the manifest, but does not download or validate the
-// layers. Users must validate that the layers match their expected digests.
-func (pc *PolicyContext) IsRunningImageAllowed(ctx context.Context, image types.UnparsedImage) (res bool, finalErr error) {
+func (pc *PolicyContext) isRunningImageAllowedImpl(ctx context.Context, image types.UnparsedImage, allowDefault bool) (res bool, finalErr error) {
    if err := pc.changeState(pcReady, pcInUse); err != nil {
        return false, err
    }
@@ -267,7 +265,7 @@ func (pc *PolicyContext) IsRunningImageAllowed(ctx context.Context, image types.
    }()

    logrus.Debugf("IsRunningImageAllowed for image %s", policyIdentityLogName(image.Reference()))
-   reqs := pc.requirementsForImageRef(image.Reference())
+   reqs := pc.requirementsForImageRef(image.Reference(), allowDefault)

    if len(reqs) == 0 {
        return false, PolicyRequirementError("List of verification policy requirements must not be empty")
@@ -286,3 +284,18 @@ func (pc *PolicyContext) IsRunningImageAllowed(ctx context.Context, image types.
    logrus.Debugf("Overall: allowed")
    return true, nil
 }
+
+// IsRunningImageAllowed returns true iff the policy allows running the image.
+// If it returns false, err must be non-nil, and should be an PolicyRequirementError if evaluation
+// succeeded but the result was rejection.
+// WARNING: This validates signatures and the manifest, but does not download or validate the
+// layers. Users must validate that the layers match their expected digests.
+func (pc *PolicyContext) IsRunningImageAllowed(ctx context.Context, image types.UnparsedImage) (res bool, finalErr error) {
+   return pc.isRunningImageAllowedImpl(ctx, image, true)
+}
+
+// IsRunningImageExplicitlyAllowed returns true iff the policy allows running the image without falling through to the global `default`.
+// This is a variation of IsRunningImageAllowed - see that function for more information.
+func (pc *PolicyContext) IsRunningImageExplictlyAllowed(ctx context.Context, image types.UnparsedImage) (res bool, finalErr error) {
+   return pc.isRunningImageAllowedImpl(ctx, image, false)
+}
diff --git a/signature/policy_eval_test.go b/signature/policy_eval_test.go
index 8cabb3e..77a16d9 100644
--- a/signature/policy_eval_test.go
+++ b/signature/policy_eval_test.go
@@ -135,7 +135,7 @@ func TestPolicyContextRequirementsForImageRefNotRegisteredTransport(t *testing.T
    require.NoError(t, err)
    ref, err := reference.ParseNormalizedNamed("registry.access.redhat.com/rhel7:latest")
    require.NoError(t, err)
-   reqs := pc.requirementsForImageRef(pcImageReferenceMock{"docker", ref})
+   reqs := pc.requirementsForImageRef(pcImageReferenceMock{"docker", ref}, true)
    assert.True(t, &(reqs[0]) == &(pr[0]))
    assert.True(t, len(reqs) == len(pr))

@@ -204,7 +204,7 @@ func TestPolicyContextRequirementsForImageRef(t *testing.T) {

        ref, err := reference.ParseNormalizedNamed(c.input)
        require.NoError(t, err)
-       reqs := pc.requirementsForImageRef(pcImageReferenceMock{c.inputTransport, ref})
+       reqs := pc.requirementsForImageRef(pcImageReferenceMock{c.inputTransport, ref}, true)
        comment := fmt.Sprintf("case %s:%s: %#v", c.inputTransport, c.input, reqs[0])
        // Do not use assert.Equal, which would do a deep contents comparison; we want to compare
        // the pointers. Also, == does not work on slices; so test that the slices start at the

[cgwalters]

This should actually become a feature of https://github.com/cgwalters/container-image-proxy instead. (May require containers/image work)