container

Documentation

Overview

Package container provides a client for interacting with container images

Index

• Variables
• func ExtractIdentityFromCertificate(manifest containerregistry.Manifest) (string, string, error)
• func FindSignatureTag(tags []string) string
• func GetArtifactSignatureAndWorkflowInfo(ctx context.Context, cli provifv1.Provider, ...) (sigInfo json.RawMessage, workflowInfo json.RawMessage, err error)
• func GetImageManifest(imageRef name.Reference, username string, token string) (containerregistry.Manifest, error)
• func GetKeysFromVerified(verified []oci.Signature) ([]payload.SimpleContainerImage, error)
• func GetSignatureTag(imageRef name.Reference, username string, token string) (name.Reference, error)
• func TagsContainSignature(tags []string) bool
• func ValidateSignature(ctx context.Context, accessToken string, package_owner string, ...) (*pb.SignatureVerification, *pb.GithubWorkflow, error)
• func VerifyFromIdentity(ctx context.Context, imageRef string, owner string, token string, ...) (bool, bool, map[string]interface{}, error)

Variables

var (
	// ErrSigValidation is returned when signature validation fails
	ErrSigValidation = errors.New("error validating signature")
	// ErrProtoParse is returned when parsing the protobuf representation of signature or workflow fails
	ErrProtoParse = errors.New("error getting bytes from proto")
)

var REGISTRY = "ghcr.io"

REGISTRY is the default registry

Functions

func ExtractIdentityFromCertificate

func ExtractIdentityFromCertificate(manifest containerregistry.Manifest) (string, string, error)

ExtractIdentityFromCertificate returns the identity and issuer from the certificate

func FindSignatureTag

func FindSignatureTag(tags []string) string

FindSignatureTag returns the signature tag for a given image if exists

func GetArtifactSignatureAndWorkflowInfo

func GetArtifactSignatureAndWorkflowInfo(
	ctx context.Context,
	cli provifv1.Provider,
	ownerLogin, artifactName, versionName string,
) (sigInfo json.RawMessage, workflowInfo json.RawMessage, err error)

GetArtifactSignatureAndWorkflowInfo returns the signature and workflow information as raw JSON for a given artifact

func GetImageManifest

func GetImageManifest(imageRef name.Reference, username string, token string) (containerregistry.Manifest, error)

GetImageManifest returns the manifest for the given image

func GetKeysFromVerified

func GetKeysFromVerified(verified []oci.Signature) ([]payload.SimpleContainerImage, error)

GetKeysFromVerified returns the keys from the verified signatures nolint: gocyclo

func GetSignatureTag

func GetSignatureTag(imageRef name.Reference, username string, token string) (name.Reference, error)

GetSignatureTag returns the signature tag for a given image if exists

func TagsContainSignature

func TagsContainSignature(tags []string) bool

TagsContainSignature if tag contains the .sig suffix it's a signature, as cosign stores signatures in that format

func ValidateSignature

func ValidateSignature(ctx context.Context, accessToken string, package_owner string,
	package_url string) (*pb.SignatureVerification, *pb.GithubWorkflow, error)

ValidateSignature returns information about signature validation of a package

func VerifyFromIdentity

func VerifyFromIdentity(ctx context.Context, imageRef string, owner string, token string,
	identity string, issuer string) (bool, bool, map[string]interface{}, error)

VerifyFromIdentity verifies the image from the identity and extracts the keys