github.com/go/docker@v1.12.0-rc2/integration-cli/docker_cli_by_digest_test.go (about) 1 package main 2 3 import ( 4 "encoding/json" 5 "fmt" 6 "os" 7 "path/filepath" 8 "regexp" 9 "strings" 10 11 "github.com/docker/distribution/digest" 12 "github.com/docker/distribution/manifest/schema1" 13 "github.com/docker/distribution/manifest/schema2" 14 "github.com/docker/docker/pkg/integration/checker" 15 "github.com/docker/docker/pkg/stringutils" 16 "github.com/docker/engine-api/types" 17 "github.com/go-check/check" 18 ) 19 20 var ( 21 remoteRepoName = "dockercli/busybox-by-dgst" 22 repoName = fmt.Sprintf("%s/%s", privateRegistryURL, remoteRepoName) 23 pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+") 24 digestRegex = regexp.MustCompile("Digest: ([\\S]+)") 25 ) 26 27 func setupImage(c *check.C) (digest.Digest, error) { 28 return setupImageWithTag(c, "latest") 29 } 30 31 func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) { 32 containerName := "busyboxbydigest" 33 34 dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox") 35 36 // tag the image to upload it to the private registry 37 repoAndTag := repoName + ":" + tag 38 out, _, err := dockerCmdWithError("commit", containerName, repoAndTag) 39 c.Assert(err, checker.IsNil, check.Commentf("image tagging failed: %s", out)) 40 41 // delete the container as we don't need it any more 42 err = deleteContainer(containerName) 43 c.Assert(err, checker.IsNil) 44 45 // push the image 46 out, _, err = dockerCmdWithError("push", repoAndTag) 47 c.Assert(err, checker.IsNil, check.Commentf("pushing the image to the private registry has failed: %s", out)) 48 49 // delete our local repo that we previously tagged 50 rmiout, _, err := dockerCmdWithError("rmi", repoAndTag) 51 c.Assert(err, checker.IsNil, check.Commentf("error deleting images prior to real test: %s", rmiout)) 52 53 matches := pushDigestRegex.FindStringSubmatch(out) 54 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from push output: %s", out)) 55 pushDigest := matches[1] 56 57 return digest.Digest(pushDigest), nil 58 } 59 60 func testPullByTagDisplaysDigest(c *check.C) { 61 testRequires(c, DaemonIsLinux) 62 pushDigest, err := setupImage(c) 63 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 64 65 // pull from the registry using the tag 66 out, _ := dockerCmd(c, "pull", repoName) 67 68 // the pull output includes "Digest: <digest>", so find that 69 matches := digestRegex.FindStringSubmatch(out) 70 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 71 pullDigest := matches[1] 72 73 // make sure the pushed and pull digests match 74 c.Assert(pushDigest.String(), checker.Equals, pullDigest) 75 } 76 77 func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) { 78 testPullByTagDisplaysDigest(c) 79 } 80 81 func (s *DockerSchema1RegistrySuite) TestPullByTagDisplaysDigest(c *check.C) { 82 testPullByTagDisplaysDigest(c) 83 } 84 85 func testPullByDigest(c *check.C) { 86 testRequires(c, DaemonIsLinux) 87 pushDigest, err := setupImage(c) 88 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 89 90 // pull from the registry using the <name>@<digest> reference 91 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 92 out, _ := dockerCmd(c, "pull", imageReference) 93 94 // the pull output includes "Digest: <digest>", so find that 95 matches := digestRegex.FindStringSubmatch(out) 96 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 97 pullDigest := matches[1] 98 99 // make sure the pushed and pull digests match 100 c.Assert(pushDigest.String(), checker.Equals, pullDigest) 101 } 102 103 func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) { 104 testPullByDigest(c) 105 } 106 107 func (s *DockerSchema1RegistrySuite) TestPullByDigest(c *check.C) { 108 testPullByDigest(c) 109 } 110 111 func testPullByDigestNoFallback(c *check.C) { 112 testRequires(c, DaemonIsLinux) 113 // pull from the registry using the <name>@<digest> reference 114 imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName) 115 out, _, err := dockerCmdWithError("pull", imageReference) 116 c.Assert(err, checker.NotNil, check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image")) 117 c.Assert(out, checker.Contains, "manifest unknown", check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image")) 118 } 119 120 func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) { 121 testPullByDigestNoFallback(c) 122 } 123 124 func (s *DockerSchema1RegistrySuite) TestPullByDigestNoFallback(c *check.C) { 125 testPullByDigestNoFallback(c) 126 } 127 128 func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) { 129 pushDigest, err := setupImage(c) 130 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 131 132 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 133 134 containerName := "createByDigest" 135 dockerCmd(c, "create", "--name", containerName, imageReference) 136 137 res := inspectField(c, containerName, "Config.Image") 138 c.Assert(res, checker.Equals, imageReference) 139 } 140 141 func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) { 142 pushDigest, err := setupImage(c) 143 c.Assert(err, checker.IsNil) 144 145 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 146 147 containerName := "runByDigest" 148 out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest") 149 150 foundRegex := regexp.MustCompile("found=([^\n]+)") 151 matches := foundRegex.FindStringSubmatch(out) 152 c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out)) 153 c.Assert(matches[1], checker.Equals, "1", check.Commentf("Expected %q, got %q", "1", matches[1])) 154 155 res := inspectField(c, containerName, "Config.Image") 156 c.Assert(res, checker.Equals, imageReference) 157 } 158 159 func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) { 160 digest, err := setupImage(c) 161 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 162 163 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 164 165 // pull from the registry using the <name>@<digest> reference 166 dockerCmd(c, "pull", imageReference) 167 168 // make sure inspect runs ok 169 inspectField(c, imageReference, "Id") 170 171 // do the delete 172 err = deleteImages(imageReference) 173 c.Assert(err, checker.IsNil, check.Commentf("unexpected error deleting image")) 174 175 // try to inspect again - it should error this time 176 _, err = inspectFieldWithError(imageReference, "Id") 177 //unexpected nil err trying to inspect what should be a non-existent image 178 c.Assert(err, checker.NotNil) 179 c.Assert(err.Error(), checker.Contains, "No such image") 180 } 181 182 func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) { 183 digest, err := setupImage(c) 184 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 185 186 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 187 188 // pull from the registry using the <name>@<digest> reference 189 dockerCmd(c, "pull", imageReference) 190 191 // get the image id 192 imageID := inspectField(c, imageReference, "Id") 193 194 // do the build 195 name := "buildbydigest" 196 _, err = buildImage(name, fmt.Sprintf( 197 `FROM %s 198 CMD ["/bin/echo", "Hello World"]`, imageReference), 199 true) 200 c.Assert(err, checker.IsNil) 201 202 // get the build's image id 203 res := inspectField(c, name, "Config.Image") 204 // make sure they match 205 c.Assert(res, checker.Equals, imageID) 206 } 207 208 func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) { 209 digest, err := setupImage(c) 210 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 211 212 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 213 214 // pull from the registry using the <name>@<digest> reference 215 dockerCmd(c, "pull", imageReference) 216 217 // tag it 218 tag := "tagbydigest" 219 dockerCmd(c, "tag", imageReference, tag) 220 221 expectedID := inspectField(c, imageReference, "Id") 222 223 tagID := inspectField(c, tag, "Id") 224 c.Assert(tagID, checker.Equals, expectedID) 225 } 226 227 func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) { 228 digest, err := setupImage(c) 229 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 230 231 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 232 233 // pull from the registry using the <name>@<digest> reference 234 dockerCmd(c, "pull", imageReference) 235 236 out, _ := dockerCmd(c, "images") 237 c.Assert(out, checker.Not(checker.Contains), "DIGEST", check.Commentf("list output should not have contained DIGEST header")) 238 } 239 240 func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) { 241 242 // setup image1 243 digest1, err := setupImageWithTag(c, "tag1") 244 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 245 imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1) 246 c.Logf("imageReference1 = %s", imageReference1) 247 248 // pull image1 by digest 249 dockerCmd(c, "pull", imageReference1) 250 251 // list images 252 out, _ := dockerCmd(c, "images", "--digests") 253 254 // make sure repo shown, tag=<none>, digest = $digest1 255 re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`) 256 c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out)) 257 // setup image2 258 digest2, err := setupImageWithTag(c, "tag2") 259 //error setting up image 260 c.Assert(err, checker.IsNil) 261 imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2) 262 c.Logf("imageReference2 = %s", imageReference2) 263 264 // pull image1 by digest 265 dockerCmd(c, "pull", imageReference1) 266 267 // pull image2 by digest 268 dockerCmd(c, "pull", imageReference2) 269 270 // list images 271 out, _ = dockerCmd(c, "images", "--digests") 272 273 // make sure repo shown, tag=<none>, digest = $digest1 274 c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out)) 275 276 // make sure repo shown, tag=<none>, digest = $digest2 277 re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`) 278 c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out)) 279 280 // pull tag1 281 dockerCmd(c, "pull", repoName+":tag1") 282 283 // list images 284 out, _ = dockerCmd(c, "images", "--digests") 285 286 // make sure image 1 has repo, tag, <none> AND repo, <none>, digest 287 reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*` + digest1.String() + `\s`) 288 c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out)) 289 // make sure image 2 has repo, <none>, digest 290 c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out)) 291 292 // pull tag 2 293 dockerCmd(c, "pull", repoName+":tag2") 294 295 // list images 296 out, _ = dockerCmd(c, "images", "--digests") 297 298 // make sure image 1 has repo, tag, digest 299 c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out)) 300 301 // make sure image 2 has repo, tag, digest 302 reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*` + digest2.String() + `\s`) 303 c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out)) 304 305 // list images 306 out, _ = dockerCmd(c, "images", "--digests") 307 308 // make sure image 1 has repo, tag, digest 309 c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out)) 310 // make sure image 2 has repo, tag, digest 311 c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out)) 312 // make sure busybox has tag, but not digest 313 busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`) 314 c.Assert(busyboxRe.MatchString(out), checker.True, check.Commentf("expected %q: %s", busyboxRe.String(), out)) 315 } 316 317 func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) { 318 digest, err := setupImage(c) 319 c.Assert(err, check.IsNil, check.Commentf("error setting up image")) 320 321 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 322 323 // pull from the registry using the <name>@<digest> reference 324 dockerCmd(c, "pull", imageReference) 325 326 out, _ := dockerCmd(c, "inspect", imageReference) 327 328 var imageJSON []types.ImageInspect 329 err = json.Unmarshal([]byte(out), &imageJSON) 330 c.Assert(err, checker.IsNil) 331 c.Assert(imageJSON, checker.HasLen, 1) 332 c.Assert(imageJSON[0].RepoDigests, checker.HasLen, 1) 333 c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), checker.Equals, true) 334 } 335 336 func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) { 337 digest, err := setupImage(c) 338 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 339 340 imageReference := fmt.Sprintf("%s@%s", repoName, digest) 341 342 // pull from the registry using the <name>@<digest> reference 343 dockerCmd(c, "pull", imageReference) 344 345 // build an image from it 346 imageName1 := "images_ps_filter_test" 347 _, err = buildImage(imageName1, fmt.Sprintf( 348 `FROM %s 349 LABEL match me 1`, imageReference), true) 350 c.Assert(err, checker.IsNil) 351 352 // run a container based on that 353 dockerCmd(c, "run", "--name=test1", imageReference, "echo", "hello") 354 expectedID, err := getIDByName("test1") 355 c.Assert(err, check.IsNil) 356 357 // run a container based on the a descendant of that too 358 dockerCmd(c, "run", "--name=test2", imageName1, "echo", "hello") 359 expectedID1, err := getIDByName("test2") 360 c.Assert(err, check.IsNil) 361 362 expectedIDs := []string{expectedID, expectedID1} 363 364 // Invalid imageReference 365 out, _ := dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest)) 366 // Filter container for ancestor filter should be empty 367 c.Assert(strings.TrimSpace(out), checker.Equals, "") 368 369 // Valid imageReference 370 out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference) 371 checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs) 372 } 373 374 func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) { 375 pushDigest, err := setupImage(c) 376 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 377 378 // pull from the registry using the <name>@<digest> reference 379 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 380 dockerCmd(c, "pull", imageReference) 381 // just in case... 382 383 imageID := inspectField(c, imageReference, "Id") 384 385 dockerCmd(c, "rmi", imageID) 386 } 387 388 func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndTag(c *check.C) { 389 pushDigest, err := setupImage(c) 390 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 391 392 // pull from the registry using the <name>@<digest> reference 393 imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) 394 dockerCmd(c, "pull", imageReference) 395 396 imageID := inspectField(c, imageReference, "Id") 397 398 repoTag := repoName + ":sometag" 399 repoTag2 := repoName + ":othertag" 400 dockerCmd(c, "tag", imageReference, repoTag) 401 dockerCmd(c, "tag", imageReference, repoTag2) 402 403 dockerCmd(c, "rmi", repoTag2) 404 405 // rmi should have deleted only repoTag2, because there's another tag 406 inspectField(c, repoTag, "Id") 407 408 dockerCmd(c, "rmi", repoTag) 409 410 // rmi should have deleted the tag, the digest reference, and the image itself 411 _, err = inspectFieldWithError(imageID, "Id") 412 c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted")) 413 } 414 415 // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when 416 // we have modified a manifest blob and its digest cannot be verified. 417 // This is the schema2 version of the test. 418 func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) { 419 testRequires(c, DaemonIsLinux) 420 manifestDigest, err := setupImage(c) 421 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 422 423 // Load the target manifest blob. 424 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 425 426 var imgManifest schema2.Manifest 427 err = json.Unmarshal(manifestBlob, &imgManifest) 428 c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob")) 429 430 // Change a layer in the manifest. 431 imgManifest.Layers[0].Digest = digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef") 432 433 // Move the existing data file aside, so that we can replace it with a 434 // malicious blob of data. NOTE: we defer the returned undo func. 435 undo := s.reg.tempMoveBlobData(c, manifestDigest) 436 defer undo() 437 438 alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ") 439 c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON")) 440 441 s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob) 442 443 // Now try pulling that image by digest. We should get an error about 444 // digest verification for the manifest digest. 445 446 // Pull from the registry using the <name>@<digest> reference. 447 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 448 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 449 c.Assert(exitStatus, checker.Not(check.Equals), 0) 450 451 expectedErrorMsg := fmt.Sprintf("manifest verification failed for digest %s", manifestDigest) 452 c.Assert(out, checker.Contains, expectedErrorMsg) 453 } 454 455 // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when 456 // we have modified a manifest blob and its digest cannot be verified. 457 // This is the schema1 version of the test. 458 func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) { 459 testRequires(c, DaemonIsLinux) 460 manifestDigest, err := setupImage(c) 461 c.Assert(err, checker.IsNil, check.Commentf("error setting up image")) 462 463 // Load the target manifest blob. 464 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 465 466 var imgManifest schema1.Manifest 467 err = json.Unmarshal(manifestBlob, &imgManifest) 468 c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob")) 469 470 // Change a layer in the manifest. 471 imgManifest.FSLayers[0] = schema1.FSLayer{ 472 BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"), 473 } 474 475 // Move the existing data file aside, so that we can replace it with a 476 // malicious blob of data. NOTE: we defer the returned undo func. 477 undo := s.reg.tempMoveBlobData(c, manifestDigest) 478 defer undo() 479 480 alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ") 481 c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON")) 482 483 s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob) 484 485 // Now try pulling that image by digest. We should get an error about 486 // digest verification for the manifest digest. 487 488 // Pull from the registry using the <name>@<digest> reference. 489 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 490 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 491 c.Assert(exitStatus, checker.Not(check.Equals), 0) 492 493 expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest) 494 c.Assert(out, checker.Contains, expectedErrorMsg) 495 } 496 497 // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when 498 // we have modified a layer blob and its digest cannot be verified. 499 // This is the schema2 version of the test. 500 func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) { 501 testRequires(c, DaemonIsLinux) 502 manifestDigest, err := setupImage(c) 503 c.Assert(err, checker.IsNil) 504 505 // Load the target manifest blob. 506 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 507 508 var imgManifest schema2.Manifest 509 err = json.Unmarshal(manifestBlob, &imgManifest) 510 c.Assert(err, checker.IsNil) 511 512 // Next, get the digest of one of the layers from the manifest. 513 targetLayerDigest := imgManifest.Layers[0].Digest 514 515 // Move the existing data file aside, so that we can replace it with a 516 // malicious blob of data. NOTE: we defer the returned undo func. 517 undo := s.reg.tempMoveBlobData(c, targetLayerDigest) 518 defer undo() 519 520 // Now make a fake data blob in this directory. 521 s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for.")) 522 523 // Now try pulling that image by digest. We should get an error about 524 // digest verification for the target layer digest. 525 526 // Remove distribution cache to force a re-pull of the blobs 527 if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil { 528 c.Fatalf("error clearing distribution cache: %v", err) 529 } 530 531 // Pull from the registry using the <name>@<digest> reference. 532 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 533 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 534 c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status")) 535 536 expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest) 537 c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out)) 538 } 539 540 // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when 541 // we have modified a layer blob and its digest cannot be verified. 542 // This is the schema1 version of the test. 543 func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) { 544 testRequires(c, DaemonIsLinux) 545 manifestDigest, err := setupImage(c) 546 c.Assert(err, checker.IsNil) 547 548 // Load the target manifest blob. 549 manifestBlob := s.reg.readBlobContents(c, manifestDigest) 550 551 var imgManifest schema1.Manifest 552 err = json.Unmarshal(manifestBlob, &imgManifest) 553 c.Assert(err, checker.IsNil) 554 555 // Next, get the digest of one of the layers from the manifest. 556 targetLayerDigest := imgManifest.FSLayers[0].BlobSum 557 558 // Move the existing data file aside, so that we can replace it with a 559 // malicious blob of data. NOTE: we defer the returned undo func. 560 undo := s.reg.tempMoveBlobData(c, targetLayerDigest) 561 defer undo() 562 563 // Now make a fake data blob in this directory. 564 s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for.")) 565 566 // Now try pulling that image by digest. We should get an error about 567 // digest verification for the target layer digest. 568 569 // Remove distribution cache to force a re-pull of the blobs 570 if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil { 571 c.Fatalf("error clearing distribution cache: %v", err) 572 } 573 574 // Pull from the registry using the <name>@<digest> reference. 575 imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest) 576 out, exitStatus, _ := dockerCmdWithError("pull", imageReference) 577 c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status")) 578 579 expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest) 580 c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out)) 581 }