docker

Documentation

Overview

Package docker resolves container image versions from a registry's tags, using Docker Hub's API for hub.docker.com and the OCI registry v2 bearer-token challenge elsewhere, piggybacking on the user's existing docker login for credentials.

Index

• type Option
  • func WithAttestor(attestor *attest.Verifier) Option
  • func WithKeychain(kc authn.Keychain) Option
  • func WithTransport(rt http.RoundTripper) Option
• type Provider
  • func New(opts ...Option) *Provider
  • func (p *Provider) Color(dark bool) color.Color
  • func (p *Provider) Dated()
  • func (p *Provider) Describe(r provider.Resource) string
  • func (p *Provider) Digest(ctx context.Context, r provider.Resource, tag string) (string, error)
  • func (p *Provider) Discover(ctx context.Context, r provider.Resource) ([]model.Candidate, error)
  • func (p *Provider) Identify(r provider.Resource) (string, string)
  • func (p *Provider) Keys() []provider.Key
  • func (p *Provider) Name() string
  • func (p *Provider) Resource(d directive.Directive) (provider.Resource, error)
  • func (p *Provider) VerifyAttestation(ctx context.Context, r provider.Resource, digest string, ...) (bool, error)

Types

type Option

type Option func(*Provider)

Option configures a Provider.

func WithAttestor

func WithAttestor(attestor *attest.Verifier) Option

WithAttestor overrides Sigstore bundle verification, for tests.

func WithKeychain

func WithKeychain(kc authn.Keychain) Option

WithKeychain overrides the credential keychain, for tests.

func WithTransport

func WithTransport(rt http.RoundTripper) Option

WithTransport overrides the HTTP transport, for tests.

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider resolves versions from a container image registry's tags. The OCI registry protocol is shared with other providers via an oci.Client; docker adds Docker Hub's richer web API on top, whose token is resolved once and shared across a run.

func New

func New(opts ...Option) *Provider

New returns the Docker provider, defaulting to the keychain that reads the user's existing docker login (config.json plus any docker-credential-* helper), so clover piggybacks on credentials docker already stores.

func (*Provider) Color

func (p *Provider) Color(dark bool) color.Color

Color is the provider's brand color. See provider.Provider.Color.

func (*Provider) Dated

func (p *Provider) Dated()

Dated marks the listing as date-bearing: Docker Hub tags carry a last-updated date. Bare OCI registry tags do not, and fall to the post-discovery date check.

func (*Provider) Describe

func (p *Provider) Describe(r provider.Resource) string

Describe returns a human-readable label for a resource.

func (*Provider) Digest

func (p *Provider) Digest(ctx context.Context, r provider.Resource, tag string) (string, error)

Digest resolves the content digest a tag points at, delegating to the shared OCI client. A Hub reference resolves via the registry (not the web API), with credentials keyed under the Hub auth host - see [reference.manifestRepo].

func (*Provider) Discover

func (p *Provider) Discover(ctx context.Context, r provider.Resource) ([]model.Candidate, error)

Discover lists candidate versions for a resource from its registry tags, routing Docker Hub to its richer API and every other registry to the shared OCI registry v2 tags endpoint.

func (*Provider) Identify

func (p *Provider) Identify(r provider.Resource) (string, string)

Identify returns the image reference and its registry landing page.

func (*Provider) Keys

func (p *Provider) Keys() []provider.Key

Keys reports the directive keys docker accepts, in canonical order.

func (*Provider) Name

func (p *Provider) Name() string

Name identifies the provider.

func (*Provider) Resource

func (p *Provider) Resource(d directive.Directive) (provider.Resource, error)

Resource validates a directive into a Docker resource.

func (*Provider) VerifyAttestation

func (p *Provider) VerifyAttestation(
	ctx context.Context,
	r provider.Resource,
	digest string,
	policy provider.AttestationPolicy,
) (bool, error)

VerifyAttestation verifies a digest's Sigstore attestation against its signer policy, delegating registry access and cryptographic verification.