github.com/akerouanton/docker@v1.11.0-rc3/integration-cli/docker_cli_by_digest_test.go (about) 1 package main 2 3 import ( 4 "encoding/json" 5 "fmt" 6 "os" 7 "path/filepath" 8 "regexp" 9 "strings" 10 11 "github.com/docker/distribution/digest" 12 "github.com/docker/distribution/manifest/schema1" 13 "github.com/docker/distribution/manifest/schema2" 14 "github.com/docker/docker/pkg/integration/checker" 15 "github.com/docker/docker/pkg/stringutils" 16 "github.com/docker/engine-api/types" 17 "github.com/go-check/check" 18 ) 19 20 var ( 21 remoteRepoName = "dockercli/busybox-by-dgst" 22 repoName = fmt.Sprintf("%s/%s", privateRegistryURL, remoteRepoName) 23 pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+") 24 digestRegex = regexp.MustCompile("Digest: ([\\S]+)") 25 ) 26 27 func setupImage(c *check.C) (digest.Digest, error) { 28 return setupImageWithTag(c, "latest") 29 } 30 31 func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) { 32 containerName := "busyboxbydigest" 33 34 dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox") 35 36 // tag the image to upload it to the private registry 37 repoAndTag := repoName + ":" + tag 38 out, _, err := dockerCmdWithError("commit", containerName, repoAndTag) 39 c.Assert(err, checker.IsNil, check.Commentf("image tagging failed: %s", out)) 40 41 // delete the container as we don't need it any more 42 err = deleteContainer(containerName) 43 c.Assert(err, checker.IsNil) 44 45 // push the image 46 out, _, err = dockerCmdWithError("push", repoAndTag) 47 c.Assert(err, checker.IsNil, check.Commentf("pushing the image to the private registry has failed: %s", out)) 48 49 // delete our local repo that we previously tagged 50 rmiout, _, err := dockerCmdWithError("rmi", repoAndTag) 51 c.Assert(err, checker.IsNil, check.Commentf("error deleting images prior to real test: %s", rmiout)) 52 53 matches := pushDigestRegex.FindStringSubmatch(out) 54 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from push output: %s", out)) 55 pushDigest := matches[1] 56 57 return digest.Digest(pushDigest), nil 58 } 59 60 func testPullByTagDisplaysDigest(c *check.C) { 61 testRequires(c, DaemonIsLinux) 62 pushDigest, err := setupImage(c) 63 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 64 65 // pull from the registry using the tag 66 out, _ := dockerCmd(c, "pull", repoName) 67 68 // the pull output includes "Digest: <digest>", so find that 69 matches := digestRegex.FindStringSubmatch(out) 70 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 71 pullDigest := matches[1] 72 73 // make sure the pushed and pull digests match 74 c.Assert(pushDigest.String(), checker.Equals, pullDigest) 75 } 76 77 func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) { 78 testPullByTagDisplaysDigest(c) 79 } 80 81 func (s *DockerSchema1RegistrySuite) TestPullByTagDisplaysDigest(c *check.C) { 82 testPullByTagDisplaysDigest(c) 83 } 84 85 func testPullByDigest(c *check.C) { 86 testRequires(c, DaemonIsLinux) 87 pushDigest, err := setupImage(c) 88 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 89 90 // pull from the registry using the <name>@<digest> reference 91 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 92 out, _ := dockerCmd(c, "pull", imageReference) 93 94 // the pull output includes "Digest: <digest>", so find that 95 matches := digestRegex.FindStringSubmatch(out) 96 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 97 pullDigest := matches[1] 98 99 // make sure the pushed and pull digests match 100 c.Assert(pushDigest.String(), checker.Equals, pullDigest) 101 } 102 103 func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) { 104 testPullByDigest(c) 105 } 106 107 func (s *DockerSchema1RegistrySuite) TestPullByDigest(c *check.C) { 108 testPullByDigest(c) 109 } 110 111 func testPullByDigestNoFallback(c *check.C) { 112 testRequires(c, DaemonIsLinux) 113 // pull from the registry using the <name>@<digest> reference 114 imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName) 115 out, _, err := dockerCmdWithError("pull", imageReference) 116 c.Assert(err, checker.NotNil, check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image")) 117 c.Assert(out, checker.Contains, "manifest unknown", check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image")) 118 } 119 120 func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) { 121 testPullByDigestNoFallback(c) 122 } 123 124 func (s *DockerSchema1RegistrySuite) TestPullByDigestNoFallback(c *check.C) { 125 testPullByDigestNoFallback(c) 126 } 127 128 func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) { 129 pushDigest, err := setupImage(c) 130 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 131 132 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 133 134 containerName := "createByDigest" 135 dockerCmd(c, "create", "--name", containerName, imageReference) 136 137 res := inspectField(c, containerName, "Config.Image") 138 c.Assert(res, checker.Equals, imageReference) 139 } 140 141 func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) { 142 pushDigest, err := setupImage(c) 143 c.Assert(err, checker.IsNil) 144 145 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 146 147 containerName := "runByDigest" 148 out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest") 149 150 foundRegex := regexp.MustCompile("found=([^\n]+)") 151 matches := foundRegex.FindStringSubmatch(out) 152 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 153 c.Assert(matches[1], checker.Equals, "1", check.Commentf("Expected %q, got %q", "1", matches[1])) 154 155 res := inspectField(c, containerName, "Config.Image") 156 c.Assert(res, checker.Equals, imageReference) 157 } 158 159 func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) { 160 digest, err := setupImage(c) 161 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 162 163 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 164 165 // pull from the registry using the <name>@<digest> reference 166 dockerCmd(c, "pull", imageReference) 167 168 // make sure inspect runs ok 169 inspectField(c, imageReference, "Id") 170 171 // do the delete 172 err = deleteImages(imageReference) 173 c.Assert(err, checker.IsNil, check.Commentf("unexpected error deleting image")) 174 175 // try to inspect again - it should error this time 176 _, err = inspectFieldWithError(imageReference, "Id") 177 //unexpected nil err trying to inspect what should be a non-existent image 178 c.Assert(err, checker.NotNil) 179 c.Assert(err.Error(), checker.Contains, "No such image") 180 } 181 182 func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) { 183 digest, err := setupImage(c) 184 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 185 186 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 187 188 // pull from the registry using the <name>@<digest> reference 189 dockerCmd(c, "pull", imageReference) 190 191 // get the image id 192 imageID := inspectField(c, imageReference, "Id") 193 194 // do the build 195 name := "buildbydigest" 196 _, err = buildImage(name, fmt.Sprintf( 197 `FROM %s 198 CMD ["/bin/echo", "Hello World"]`, imageReference), 199 true) 200 c.Assert(err, checker.IsNil) 201 202 // get the build's image id 203 res := inspectField(c, name, "Config.Image") 204 // make sure they match 205 c.Assert(res, checker.Equals, imageID) 206 } 207 208 func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) { 209 digest, err := setupImage(c) 210 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 211 212 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 213 214 // pull from the registry using the <name>@<digest> reference 215 dockerCmd(c, "pull", imageReference) 216 217 // tag it 218 tag := "tagbydigest" 219 dockerCmd(c, "tag", imageReference, tag) 220 221 expectedID := inspectField(c, imageReference, "Id") 222 223 tagID := inspectField(c, tag, "Id") 224 c.Assert(tagID, checker.Equals, expectedID) 225 } 226 227 func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) { 228 digest, err := setupImage(c) 229 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 230 231 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 232 233 // pull from the registry using the <name>@<digest> reference 234 dockerCmd(c, "pull", imageReference) 235 236 out, _ := dockerCmd(c, "images") 237 c.Assert(out, checker.Not(checker.Contains), "DIGEST", check.Commentf("list output should not have contained DIGEST header")) 238 } 239 240 func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) { 241 242 // setup image1 243 digest1, err := setupImageWithTag(c, "tag1") 244 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 245 imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1) 246 c.Logf("imageReference1 = %s", imageReference1) 247 248 // pull image1 by digest 249 dockerCmd(c, "pull", imageReference1) 250 251 // list images 252 out, _ := dockerCmd(c, "images", "--digests") 253 254 // make sure repo shown, tag=<none>, digest = $digest1 255 re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`) 256 c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out)) 257 // setup image2 258 digest2, err := setupImageWithTag(c, "tag2") 259 //error setting up image 260 c.Assert(err, checker.IsNil) 261 imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2) 262 c.Logf("imageReference2 = %s", imageReference2) 263 264 // pull image1 by digest 265 dockerCmd(c, "pull", imageReference1) 266 267 // pull image2 by digest 268 dockerCmd(c, "pull", imageReference2) 269 270 // list images 271 out, _ = dockerCmd(c, "images", "--digests") 272 273 // make sure repo shown, tag=<none>, digest = $digest1 274 c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out)) 275 276 // make sure repo shown, tag=<none>, digest = $digest2 277 re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`) 278 c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out)) 279 280 // pull tag1 281 dockerCmd(c, "pull", repoName+":tag1") 282 283 // list images 284 out, _ = dockerCmd(c, "images", "--digests") 285 286 // make sure image 1 has repo, tag, <none> AND repo, <none>, digest 287 reWithTag1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*<none>\s`) 288 reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`) 289 c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out)) 290 c.Assert(reWithTag1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithTag1.String(), out)) 291 // make sure image 2 has repo, <none>, digest 292 c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out)) 293 294 // pull tag 2 295 dockerCmd(c, "pull", repoName+":tag2") 296 297 // list images 298 out, _ = dockerCmd(c, "images", "--digests") 299 300 // make sure image 1 has repo, tag, digest 301 c.Assert(reWithTag1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithTag1.String(), out)) 302 303 // make sure image 2 has repo, tag, digest 304 reWithTag2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*<none>\s`) 305 reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`) 306 c.Assert(reWithTag2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithTag2.String(), out)) 307 c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out)) 308 309 // list images 310 out, _ = dockerCmd(c, "images", "--digests") 311 312 // make sure image 1 has repo, tag, digest 313 c.Assert(reWithTag1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithTag1.String(), out)) 314 // make sure image 2 has repo, tag, digest 315 c.Assert(reWithTag2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithTag2.String(), out)) 316 // make sure busybox has tag, but not digest 317 busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`) 318 c.Assert(busyboxRe.MatchString(out), checker.True, check.Commentf("expected %q: %s", busyboxRe.String(), out)) 319 } 320 321 func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) { 322 digest, err := setupImage(c) 323 c.Assert(err, check.IsNil, check.Commentf("error setting up image")) 324 325 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 326 327 // pull from the registry using the <name>@<digest> reference 328 dockerCmd(c, "pull", imageReference) 329 330 out, _ := dockerCmd(c, "inspect", imageReference) 331 332 var imageJSON []types.ImageInspect 333 err = json.Unmarshal([]byte(out), &imageJSON) 334 c.Assert(err, checker.IsNil) 335 c.Assert(imageJSON, checker.HasLen, 1) 336 c.Assert(imageJSON[0].RepoDigests, checker.HasLen, 1) 337 c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), checker.Equals, true) 338 } 339 340 func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) { 341 digest, err := setupImage(c) 342 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 343 344 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 345 346 // pull from the registry using the <name>@<digest> reference 347 dockerCmd(c, "pull", imageReference) 348 349 // build a image from it 350 imageName1 := "images_ps_filter_test" 351 _, err = buildImage(imageName1, fmt.Sprintf( 352 `FROM %s 353 LABEL match me 1`, imageReference), true) 354 c.Assert(err, checker.IsNil) 355 356 // run a container based on that 357 dockerCmd(c, "run", "--name=test1", imageReference, "echo", "hello") 358 expectedID, err := getIDByName("test1") 359 c.Assert(err, check.IsNil) 360 361 // run a container based on the a descendant of that too 362 dockerCmd(c, "run", "--name=test2", imageName1, "echo", "hello") 363 expectedID1, err := getIDByName("test2") 364 c.Assert(err, check.IsNil) 365 366 expectedIDs := []string{expectedID, expectedID1} 367 368 // Invalid imageReference 369 out, _ := dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest)) 370 // Filter container for ancestor filter should be empty 371 c.Assert(strings.TrimSpace(out), checker.Equals, "") 372 373 // Valid imageReference 374 out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference) 375 checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs) 376 } 377 378 func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) { 379 pushDigest, err := setupImage(c) 380 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 381 382 // pull from the registry using the <name>@<digest> reference 383 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 384 dockerCmd(c, "pull", imageReference) 385 // just in case... 386 387 imageID := inspectField(c, imageReference, "Id") 388 389 dockerCmd(c, "rmi", imageID) 390 } 391 392 func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndTag(c *check.C) { 393 pushDigest, err := setupImage(c) 394 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 395 396 // pull from the registry using the <name>@<digest> reference 397 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 398 dockerCmd(c, "pull", imageReference) 399 400 imageID := inspectField(c, imageReference, "Id") 401 402 repoTag := repoName + ":sometag" 403 repoTag2 := repoName + ":othertag" 404 dockerCmd(c, "tag", imageReference, repoTag) 405 dockerCmd(c, "tag", imageReference, repoTag2) 406 407 dockerCmd(c, "rmi", repoTag2) 408 409 // rmi should have deleted only repoTag2, because there's another tag 410 inspectField(c, repoTag, "Id") 411 412 dockerCmd(c, "rmi", repoTag) 413 414 // rmi should have deleted the tag, the digest reference, and the image itself 415 _, err = inspectFieldWithError(imageID, "Id") 416 c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted")) 417 } 418 419 // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when 420 // we have modified a manifest blob and its digest cannot be verified. 421 // This is the schema2 version of the test. 422 func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) { 423 testRequires(c, DaemonIsLinux) 424 manifestDigest, err := setupImage(c) 425 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 426 427 // Load the target manifest blob. 428 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 429 430 var imgManifest schema2.Manifest 431 err = json.Unmarshal(manifestBlob, &imgManifest) 432 c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob")) 433 434 // Change a layer in the manifest. 435 imgManifest.Layers[0].Digest = digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef") 436 437 // Move the existing data file aside, so that we can replace it with a 438 // malicious blob of data. NOTE: we defer the returned undo func. 439 undo := s.reg.tempMoveBlobData(c, manifestDigest) 440 defer undo() 441 442 alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ") 443 c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON")) 444 445 s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob) 446 447 // Now try pulling that image by digest. We should get an error about 448 // digest verification for the manifest digest. 449 450 // Pull from the registry using the <name>@<digest> reference. 451 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 452 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 453 c.Assert(exitStatus, checker.Not(check.Equals), 0) 454 455 expectedErrorMsg := fmt.Sprintf("manifest verification failed for digest %s", manifestDigest) 456 c.Assert(out, checker.Contains, expectedErrorMsg) 457 } 458 459 // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when 460 // we have modified a manifest blob and its digest cannot be verified. 461 // This is the schema1 version of the test. 462 func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) { 463 testRequires(c, DaemonIsLinux) 464 manifestDigest, err := setupImage(c) 465 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 466 467 // Load the target manifest blob. 468 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 469 470 var imgManifest schema1.Manifest 471 err = json.Unmarshal(manifestBlob, &imgManifest) 472 c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob")) 473 474 // Change a layer in the manifest. 475 imgManifest.FSLayers[0] = schema1.FSLayer{ 476 BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"), 477 } 478 479 // Move the existing data file aside, so that we can replace it with a 480 // malicious blob of data. NOTE: we defer the returned undo func. 481 undo := s.reg.tempMoveBlobData(c, manifestDigest) 482 defer undo() 483 484 alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ") 485 c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON")) 486 487 s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob) 488 489 // Now try pulling that image by digest. We should get an error about 490 // digest verification for the manifest digest. 491 492 // Pull from the registry using the <name>@<digest> reference. 493 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 494 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 495 c.Assert(exitStatus, checker.Not(check.Equals), 0) 496 497 expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest) 498 c.Assert(out, checker.Contains, expectedErrorMsg) 499 } 500 501 // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when 502 // we have modified a layer blob and its digest cannot be verified. 503 // This is the schema2 version of the test. 504 func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) { 505 testRequires(c, DaemonIsLinux) 506 manifestDigest, err := setupImage(c) 507 c.Assert(err, checker.IsNil) 508 509 // Load the target manifest blob. 510 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 511 512 var imgManifest schema2.Manifest 513 err = json.Unmarshal(manifestBlob, &imgManifest) 514 c.Assert(err, checker.IsNil) 515 516 // Next, get the digest of one of the layers from the manifest. 517 targetLayerDigest := imgManifest.Layers[0].Digest 518 519 // Move the existing data file aside, so that we can replace it with a 520 // malicious blob of data. NOTE: we defer the returned undo func. 521 undo := s.reg.tempMoveBlobData(c, targetLayerDigest) 522 defer undo() 523 524 // Now make a fake data blob in this directory. 525 s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for.")) 526 527 // Now try pulling that image by digest. We should get an error about 528 // digest verification for the target layer digest. 529 530 // Remove distribution cache to force a re-pull of the blobs 531 if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil { 532 c.Fatalf("error clearing distribution cache: %v", err) 533 } 534 535 // Pull from the registry using the <name>@<digest> reference. 536 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 537 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 538 c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status")) 539 540 expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest) 541 c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out)) 542 } 543 544 // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when 545 // we have modified a layer blob and its digest cannot be verified. 546 // This is the schema1 version of the test. 547 func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) { 548 testRequires(c, DaemonIsLinux) 549 manifestDigest, err := setupImage(c) 550 c.Assert(err, checker.IsNil) 551 552 // Load the target manifest blob. 553 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 554 555 var imgManifest schema1.Manifest 556 err = json.Unmarshal(manifestBlob, &imgManifest) 557 c.Assert(err, checker.IsNil) 558 559 // Next, get the digest of one of the layers from the manifest. 560 targetLayerDigest := imgManifest.FSLayers[0].BlobSum 561 562 // Move the existing data file aside, so that we can replace it with a 563 // malicious blob of data. NOTE: we defer the returned undo func. 564 undo := s.reg.tempMoveBlobData(c, targetLayerDigest) 565 defer undo() 566 567 // Now make a fake data blob in this directory. 568 s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for.")) 569 570 // Now try pulling that image by digest. We should get an error about 571 // digest verification for the target layer digest. 572 573 // Remove distribution cache to force a re-pull of the blobs 574 if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil { 575 c.Fatalf("error clearing distribution cache: %v", err) 576 } 577 578 // Pull from the registry using the <name>@<digest> reference. 579 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 580 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 581 c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status")) 582 583 expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest) 584 c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out)) 585 }