github.com/jiasir/docker@v1.3.3-0.20170609024000-252e610103e7/integration-cli/docker_cli_by_digest_test.go (about)

     1  package main
     2  
     3  import (
     4  	"encoding/json"
     5  	"fmt"
     6  	"os"
     7  	"path/filepath"
     8  	"regexp"
     9  	"strings"
    10  
    11  	"github.com/docker/distribution/manifest/schema1"
    12  	"github.com/docker/distribution/manifest/schema2"
    13  	"github.com/docker/docker/api/types"
    14  	"github.com/docker/docker/integration-cli/checker"
    15  	"github.com/docker/docker/integration-cli/cli"
    16  	"github.com/docker/docker/integration-cli/cli/build"
    17  	"github.com/docker/docker/pkg/stringutils"
    18  	"github.com/go-check/check"
    19  	"github.com/opencontainers/go-digest"
    20  )
    21  
    22  var (
    23  	remoteRepoName  = "dockercli/busybox-by-dgst"
    24  	repoName        = fmt.Sprintf("%s/%s", privateRegistryURL, remoteRepoName)
    25  	pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+")
    26  	digestRegex     = regexp.MustCompile("Digest: ([\\S]+)")
    27  )
    28  
    29  func setupImage(c *check.C) (digest.Digest, error) {
    30  	return setupImageWithTag(c, "latest")
    31  }
    32  
    33  func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) {
    34  	containerName := "busyboxbydigest"
    35  
    36  	// new file is committed because this layer is used for detecting malicious
    37  	// changes. if this was committed as empty layer it would be skipped on pull
    38  	// and malicious changes would never be detected.
    39  	cli.DockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox", "touch", "anewfile")
    40  
    41  	// tag the image to upload it to the private registry
    42  	repoAndTag := repoName + ":" + tag
    43  	cli.DockerCmd(c, "commit", containerName, repoAndTag)
    44  
    45  	// delete the container as we don't need it any more
    46  	cli.DockerCmd(c, "rm", "-fv", containerName)
    47  
    48  	// push the image
    49  	out := cli.DockerCmd(c, "push", repoAndTag).Combined()
    50  
    51  	// delete our local repo that we previously tagged
    52  	cli.DockerCmd(c, "rmi", repoAndTag)
    53  
    54  	matches := pushDigestRegex.FindStringSubmatch(out)
    55  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from push output: %s", out))
    56  	pushDigest := matches[1]
    57  
    58  	return digest.Digest(pushDigest), nil
    59  }
    60  
    61  func testPullByTagDisplaysDigest(c *check.C) {
    62  	testRequires(c, DaemonIsLinux)
    63  	pushDigest, err := setupImage(c)
    64  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
    65  
    66  	// pull from the registry using the tag
    67  	out, _ := dockerCmd(c, "pull", repoName)
    68  
    69  	// the pull output includes "Digest: <digest>", so find that
    70  	matches := digestRegex.FindStringSubmatch(out)
    71  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
    72  	pullDigest := matches[1]
    73  
    74  	// make sure the pushed and pull digests match
    75  	c.Assert(pushDigest.String(), checker.Equals, pullDigest)
    76  }
    77  
    78  func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
    79  	testPullByTagDisplaysDigest(c)
    80  }
    81  
    82  func (s *DockerSchema1RegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
    83  	testPullByTagDisplaysDigest(c)
    84  }
    85  
    86  func testPullByDigest(c *check.C) {
    87  	testRequires(c, DaemonIsLinux)
    88  	pushDigest, err := setupImage(c)
    89  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
    90  
    91  	// pull from the registry using the <name>@<digest> reference
    92  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
    93  	out, _ := dockerCmd(c, "pull", imageReference)
    94  
    95  	// the pull output includes "Digest: <digest>", so find that
    96  	matches := digestRegex.FindStringSubmatch(out)
    97  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
    98  	pullDigest := matches[1]
    99  
   100  	// make sure the pushed and pull digests match
   101  	c.Assert(pushDigest.String(), checker.Equals, pullDigest)
   102  }
   103  
   104  func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) {
   105  	testPullByDigest(c)
   106  }
   107  
   108  func (s *DockerSchema1RegistrySuite) TestPullByDigest(c *check.C) {
   109  	testPullByDigest(c)
   110  }
   111  
   112  func testPullByDigestNoFallback(c *check.C) {
   113  	testRequires(c, DaemonIsLinux)
   114  	// pull from the registry using the <name>@<digest> reference
   115  	imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName)
   116  	out, _, err := dockerCmdWithError("pull", imageReference)
   117  	c.Assert(err, checker.NotNil, check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
   118  	c.Assert(out, checker.Contains, fmt.Sprintf("manifest for %s not found", imageReference), check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
   119  }
   120  
   121  func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) {
   122  	testPullByDigestNoFallback(c)
   123  }
   124  
   125  func (s *DockerSchema1RegistrySuite) TestPullByDigestNoFallback(c *check.C) {
   126  	testPullByDigestNoFallback(c)
   127  }
   128  
   129  func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) {
   130  	pushDigest, err := setupImage(c)
   131  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   132  
   133  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   134  
   135  	containerName := "createByDigest"
   136  	dockerCmd(c, "create", "--name", containerName, imageReference)
   137  
   138  	res := inspectField(c, containerName, "Config.Image")
   139  	c.Assert(res, checker.Equals, imageReference)
   140  }
   141  
   142  func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) {
   143  	pushDigest, err := setupImage(c)
   144  	c.Assert(err, checker.IsNil)
   145  
   146  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   147  
   148  	containerName := "runByDigest"
   149  	out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest")
   150  
   151  	foundRegex := regexp.MustCompile("found=([^\n]+)")
   152  	matches := foundRegex.FindStringSubmatch(out)
   153  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
   154  	c.Assert(matches[1], checker.Equals, "1", check.Commentf("Expected %q, got %q", "1", matches[1]))
   155  
   156  	res := inspectField(c, containerName, "Config.Image")
   157  	c.Assert(res, checker.Equals, imageReference)
   158  }
   159  
   160  func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) {
   161  	digest, err := setupImage(c)
   162  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   163  
   164  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   165  
   166  	// pull from the registry using the <name>@<digest> reference
   167  	dockerCmd(c, "pull", imageReference)
   168  
   169  	// make sure inspect runs ok
   170  	inspectField(c, imageReference, "Id")
   171  
   172  	// do the delete
   173  	err = deleteImages(imageReference)
   174  	c.Assert(err, checker.IsNil, check.Commentf("unexpected error deleting image"))
   175  
   176  	// try to inspect again - it should error this time
   177  	_, err = inspectFieldWithError(imageReference, "Id")
   178  	//unexpected nil err trying to inspect what should be a non-existent image
   179  	c.Assert(err, checker.NotNil)
   180  	c.Assert(err.Error(), checker.Contains, "No such object")
   181  }
   182  
   183  func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) {
   184  	digest, err := setupImage(c)
   185  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   186  
   187  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   188  
   189  	// pull from the registry using the <name>@<digest> reference
   190  	dockerCmd(c, "pull", imageReference)
   191  
   192  	// get the image id
   193  	imageID := inspectField(c, imageReference, "Id")
   194  
   195  	// do the build
   196  	name := "buildbydigest"
   197  	buildImageSuccessfully(c, name, build.WithDockerfile(fmt.Sprintf(
   198  		`FROM %s
   199       CMD ["/bin/echo", "Hello World"]`, imageReference)))
   200  	c.Assert(err, checker.IsNil)
   201  
   202  	// get the build's image id
   203  	res := inspectField(c, name, "Config.Image")
   204  	// make sure they match
   205  	c.Assert(res, checker.Equals, imageID)
   206  }
   207  
   208  func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) {
   209  	digest, err := setupImage(c)
   210  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   211  
   212  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   213  
   214  	// pull from the registry using the <name>@<digest> reference
   215  	dockerCmd(c, "pull", imageReference)
   216  
   217  	// tag it
   218  	tag := "tagbydigest"
   219  	dockerCmd(c, "tag", imageReference, tag)
   220  
   221  	expectedID := inspectField(c, imageReference, "Id")
   222  
   223  	tagID := inspectField(c, tag, "Id")
   224  	c.Assert(tagID, checker.Equals, expectedID)
   225  }
   226  
   227  func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) {
   228  	digest, err := setupImage(c)
   229  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   230  
   231  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   232  
   233  	// pull from the registry using the <name>@<digest> reference
   234  	dockerCmd(c, "pull", imageReference)
   235  
   236  	out, _ := dockerCmd(c, "images")
   237  	c.Assert(out, checker.Not(checker.Contains), "DIGEST", check.Commentf("list output should not have contained DIGEST header"))
   238  }
   239  
   240  func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) {
   241  
   242  	// setup image1
   243  	digest1, err := setupImageWithTag(c, "tag1")
   244  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   245  	imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
   246  	c.Logf("imageReference1 = %s", imageReference1)
   247  
   248  	// pull image1 by digest
   249  	dockerCmd(c, "pull", imageReference1)
   250  
   251  	// list images
   252  	out, _ := dockerCmd(c, "images", "--digests")
   253  
   254  	// make sure repo shown, tag=<none>, digest = $digest1
   255  	re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
   256  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   257  	// setup image2
   258  	digest2, err := setupImageWithTag(c, "tag2")
   259  	//error setting up image
   260  	c.Assert(err, checker.IsNil)
   261  	imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
   262  	c.Logf("imageReference2 = %s", imageReference2)
   263  
   264  	// pull image1 by digest
   265  	dockerCmd(c, "pull", imageReference1)
   266  
   267  	// pull image2 by digest
   268  	dockerCmd(c, "pull", imageReference2)
   269  
   270  	// list images
   271  	out, _ = dockerCmd(c, "images", "--digests")
   272  
   273  	// make sure repo shown, tag=<none>, digest = $digest1
   274  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   275  
   276  	// make sure repo shown, tag=<none>, digest = $digest2
   277  	re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
   278  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   279  
   280  	// pull tag1
   281  	dockerCmd(c, "pull", repoName+":tag1")
   282  
   283  	// list images
   284  	out, _ = dockerCmd(c, "images", "--digests")
   285  
   286  	// make sure image 1 has repo, tag, <none> AND repo, <none>, digest
   287  	reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*` + digest1.String() + `\s`)
   288  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   289  	// make sure image 2 has repo, <none>, digest
   290  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   291  
   292  	// pull tag 2
   293  	dockerCmd(c, "pull", repoName+":tag2")
   294  
   295  	// list images
   296  	out, _ = dockerCmd(c, "images", "--digests")
   297  
   298  	// make sure image 1 has repo, tag, digest
   299  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   300  
   301  	// make sure image 2 has repo, tag, digest
   302  	reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*` + digest2.String() + `\s`)
   303  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   304  
   305  	// list images
   306  	out, _ = dockerCmd(c, "images", "--digests")
   307  
   308  	// make sure image 1 has repo, tag, digest
   309  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   310  	// make sure image 2 has repo, tag, digest
   311  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   312  	// make sure busybox has tag, but not digest
   313  	busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`)
   314  	c.Assert(busyboxRe.MatchString(out), checker.True, check.Commentf("expected %q: %s", busyboxRe.String(), out))
   315  }
   316  
   317  func (s *DockerRegistrySuite) TestListDanglingImagesWithDigests(c *check.C) {
   318  	// setup image1
   319  	digest1, err := setupImageWithTag(c, "dangle1")
   320  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   321  	imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
   322  	c.Logf("imageReference1 = %s", imageReference1)
   323  
   324  	// pull image1 by digest
   325  	dockerCmd(c, "pull", imageReference1)
   326  
   327  	// list images
   328  	out, _ := dockerCmd(c, "images", "--digests")
   329  
   330  	// make sure repo shown, tag=<none>, digest = $digest1
   331  	re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
   332  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   333  	// setup image2
   334  	digest2, err := setupImageWithTag(c, "dangle2")
   335  	//error setting up image
   336  	c.Assert(err, checker.IsNil)
   337  	imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
   338  	c.Logf("imageReference2 = %s", imageReference2)
   339  
   340  	// pull image1 by digest
   341  	dockerCmd(c, "pull", imageReference1)
   342  
   343  	// pull image2 by digest
   344  	dockerCmd(c, "pull", imageReference2)
   345  
   346  	// list images
   347  	out, _ = dockerCmd(c, "images", "--digests", "--filter=dangling=true")
   348  
   349  	// make sure repo shown, tag=<none>, digest = $digest1
   350  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   351  
   352  	// make sure repo shown, tag=<none>, digest = $digest2
   353  	re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
   354  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   355  
   356  	// pull dangle1 tag
   357  	dockerCmd(c, "pull", repoName+":dangle1")
   358  
   359  	// list images
   360  	out, _ = dockerCmd(c, "images", "--digests", "--filter=dangling=true")
   361  
   362  	// make sure image 1 has repo, tag, <none> AND repo, <none>, digest
   363  	reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*dangle1\s*` + digest1.String() + `\s`)
   364  	c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
   365  	// make sure image 2 has repo, <none>, digest
   366  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   367  
   368  	// pull dangle2 tag
   369  	dockerCmd(c, "pull", repoName+":dangle2")
   370  
   371  	// list images, show tagged images
   372  	out, _ = dockerCmd(c, "images", "--digests")
   373  
   374  	// make sure image 1 has repo, tag, digest
   375  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   376  
   377  	// make sure image 2 has repo, tag, digest
   378  	reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*dangle2\s*` + digest2.String() + `\s`)
   379  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   380  
   381  	// list images, no longer dangling, should not match
   382  	out, _ = dockerCmd(c, "images", "--digests", "--filter=dangling=true")
   383  
   384  	// make sure image 1 has repo, tag, digest
   385  	c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
   386  	// make sure image 2 has repo, tag, digest
   387  	c.Assert(reWithDigest2.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest2.String(), out))
   388  }
   389  
   390  func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) {
   391  	digest, err := setupImage(c)
   392  	c.Assert(err, check.IsNil, check.Commentf("error setting up image"))
   393  
   394  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   395  
   396  	// pull from the registry using the <name>@<digest> reference
   397  	dockerCmd(c, "pull", imageReference)
   398  
   399  	out, _ := dockerCmd(c, "inspect", imageReference)
   400  
   401  	var imageJSON []types.ImageInspect
   402  	err = json.Unmarshal([]byte(out), &imageJSON)
   403  	c.Assert(err, checker.IsNil)
   404  	c.Assert(imageJSON, checker.HasLen, 1)
   405  	c.Assert(imageJSON[0].RepoDigests, checker.HasLen, 1)
   406  	c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), checker.Equals, true)
   407  }
   408  
   409  func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) {
   410  	digest, err := setupImage(c)
   411  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   412  
   413  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   414  
   415  	// pull from the registry using the <name>@<digest> reference
   416  	dockerCmd(c, "pull", imageReference)
   417  
   418  	// build an image from it
   419  	imageName1 := "images_ps_filter_test"
   420  	buildImageSuccessfully(c, imageName1, build.WithDockerfile(fmt.Sprintf(
   421  		`FROM %s
   422  		 LABEL match me 1`, imageReference)))
   423  
   424  	// run a container based on that
   425  	dockerCmd(c, "run", "--name=test1", imageReference, "echo", "hello")
   426  	expectedID := getIDByName(c, "test1")
   427  
   428  	// run a container based on the a descendant of that too
   429  	dockerCmd(c, "run", "--name=test2", imageName1, "echo", "hello")
   430  	expectedID1 := getIDByName(c, "test2")
   431  
   432  	expectedIDs := []string{expectedID, expectedID1}
   433  
   434  	// Invalid imageReference
   435  	out, _ := dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest))
   436  	// Filter container for ancestor filter should be empty
   437  	c.Assert(strings.TrimSpace(out), checker.Equals, "")
   438  
   439  	// Valid imageReference
   440  	out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference)
   441  	checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs)
   442  }
   443  
   444  func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) {
   445  	pushDigest, err := setupImage(c)
   446  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   447  
   448  	// pull from the registry using the <name>@<digest> reference
   449  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   450  	dockerCmd(c, "pull", imageReference)
   451  	// just in case...
   452  
   453  	dockerCmd(c, "tag", imageReference, repoName+":sometag")
   454  
   455  	imageID := inspectField(c, imageReference, "Id")
   456  
   457  	dockerCmd(c, "rmi", imageID)
   458  
   459  	_, err = inspectFieldWithError(imageID, "Id")
   460  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   461  }
   462  
   463  func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndTag(c *check.C) {
   464  	pushDigest, err := setupImage(c)
   465  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   466  
   467  	// pull from the registry using the <name>@<digest> reference
   468  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   469  	dockerCmd(c, "pull", imageReference)
   470  
   471  	imageID := inspectField(c, imageReference, "Id")
   472  
   473  	repoTag := repoName + ":sometag"
   474  	repoTag2 := repoName + ":othertag"
   475  	dockerCmd(c, "tag", imageReference, repoTag)
   476  	dockerCmd(c, "tag", imageReference, repoTag2)
   477  
   478  	dockerCmd(c, "rmi", repoTag2)
   479  
   480  	// rmi should have deleted only repoTag2, because there's another tag
   481  	inspectField(c, repoTag, "Id")
   482  
   483  	dockerCmd(c, "rmi", repoTag)
   484  
   485  	// rmi should have deleted the tag, the digest reference, and the image itself
   486  	_, err = inspectFieldWithError(imageID, "Id")
   487  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   488  }
   489  
   490  func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndMultiRepoTag(c *check.C) {
   491  	pushDigest, err := setupImage(c)
   492  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   493  
   494  	repo2 := fmt.Sprintf("%s/%s", repoName, "repo2")
   495  
   496  	// pull from the registry using the <name>@<digest> reference
   497  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   498  	dockerCmd(c, "pull", imageReference)
   499  
   500  	imageID := inspectField(c, imageReference, "Id")
   501  
   502  	repoTag := repoName + ":sometag"
   503  	repoTag2 := repo2 + ":othertag"
   504  	dockerCmd(c, "tag", imageReference, repoTag)
   505  	dockerCmd(c, "tag", imageReference, repoTag2)
   506  
   507  	dockerCmd(c, "rmi", repoTag)
   508  
   509  	// rmi should have deleted repoTag and image reference, but left repoTag2
   510  	inspectField(c, repoTag2, "Id")
   511  	_, err = inspectFieldWithError(imageReference, "Id")
   512  	c.Assert(err, checker.NotNil, check.Commentf("image digest reference should have been removed"))
   513  
   514  	_, err = inspectFieldWithError(repoTag, "Id")
   515  	c.Assert(err, checker.NotNil, check.Commentf("image tag reference should have been removed"))
   516  
   517  	dockerCmd(c, "rmi", repoTag2)
   518  
   519  	// rmi should have deleted the tag, the digest reference, and the image itself
   520  	_, err = inspectFieldWithError(imageID, "Id")
   521  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   522  }
   523  
   524  // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
   525  // we have modified a manifest blob and its digest cannot be verified.
   526  // This is the schema2 version of the test.
   527  func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
   528  	testRequires(c, DaemonIsLinux)
   529  	manifestDigest, err := setupImage(c)
   530  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   531  
   532  	// Load the target manifest blob.
   533  	manifestBlob := s.reg.ReadBlobContents(c, manifestDigest)
   534  
   535  	var imgManifest schema2.Manifest
   536  	err = json.Unmarshal(manifestBlob, &imgManifest)
   537  	c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
   538  
   539  	// Change a layer in the manifest.
   540  	imgManifest.Layers[0].Digest = digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
   541  
   542  	// Move the existing data file aside, so that we can replace it with a
   543  	// malicious blob of data. NOTE: we defer the returned undo func.
   544  	undo := s.reg.TempMoveBlobData(c, manifestDigest)
   545  	defer undo()
   546  
   547  	alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", "   ")
   548  	c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
   549  
   550  	s.reg.WriteBlobContents(c, manifestDigest, alteredManifestBlob)
   551  
   552  	// Now try pulling that image by digest. We should get an error about
   553  	// digest verification for the manifest digest.
   554  
   555  	// Pull from the registry using the <name>@<digest> reference.
   556  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   557  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   558  	c.Assert(exitStatus, checker.Not(check.Equals), 0)
   559  
   560  	expectedErrorMsg := fmt.Sprintf("manifest verification failed for digest %s", manifestDigest)
   561  	c.Assert(out, checker.Contains, expectedErrorMsg)
   562  }
   563  
   564  // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
   565  // we have modified a manifest blob and its digest cannot be verified.
   566  // This is the schema1 version of the test.
   567  func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
   568  	testRequires(c, DaemonIsLinux)
   569  	manifestDigest, err := setupImage(c)
   570  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   571  
   572  	// Load the target manifest blob.
   573  	manifestBlob := s.reg.ReadBlobContents(c, manifestDigest)
   574  
   575  	var imgManifest schema1.Manifest
   576  	err = json.Unmarshal(manifestBlob, &imgManifest)
   577  	c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
   578  
   579  	// Change a layer in the manifest.
   580  	imgManifest.FSLayers[0] = schema1.FSLayer{
   581  		BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
   582  	}
   583  
   584  	// Move the existing data file aside, so that we can replace it with a
   585  	// malicious blob of data. NOTE: we defer the returned undo func.
   586  	undo := s.reg.TempMoveBlobData(c, manifestDigest)
   587  	defer undo()
   588  
   589  	alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", "   ")
   590  	c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
   591  
   592  	s.reg.WriteBlobContents(c, manifestDigest, alteredManifestBlob)
   593  
   594  	// Now try pulling that image by digest. We should get an error about
   595  	// digest verification for the manifest digest.
   596  
   597  	// Pull from the registry using the <name>@<digest> reference.
   598  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   599  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   600  	c.Assert(exitStatus, checker.Not(check.Equals), 0)
   601  
   602  	expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest)
   603  	c.Assert(out, checker.Contains, expectedErrorMsg)
   604  }
   605  
   606  // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
   607  // we have modified a layer blob and its digest cannot be verified.
   608  // This is the schema2 version of the test.
   609  func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
   610  	testRequires(c, DaemonIsLinux)
   611  	manifestDigest, err := setupImage(c)
   612  	c.Assert(err, checker.IsNil)
   613  
   614  	// Load the target manifest blob.
   615  	manifestBlob := s.reg.ReadBlobContents(c, manifestDigest)
   616  
   617  	var imgManifest schema2.Manifest
   618  	err = json.Unmarshal(manifestBlob, &imgManifest)
   619  	c.Assert(err, checker.IsNil)
   620  
   621  	// Next, get the digest of one of the layers from the manifest.
   622  	targetLayerDigest := imgManifest.Layers[0].Digest
   623  
   624  	// Move the existing data file aside, so that we can replace it with a
   625  	// malicious blob of data. NOTE: we defer the returned undo func.
   626  	undo := s.reg.TempMoveBlobData(c, targetLayerDigest)
   627  	defer undo()
   628  
   629  	// Now make a fake data blob in this directory.
   630  	s.reg.WriteBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
   631  
   632  	// Now try pulling that image by digest. We should get an error about
   633  	// digest verification for the target layer digest.
   634  
   635  	// Remove distribution cache to force a re-pull of the blobs
   636  	if err := os.RemoveAll(filepath.Join(testEnv.DockerBasePath(), "image", s.d.StorageDriver(), "distribution")); err != nil {
   637  		c.Fatalf("error clearing distribution cache: %v", err)
   638  	}
   639  
   640  	// Pull from the registry using the <name>@<digest> reference.
   641  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   642  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   643  	c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a non-zero exit status"))
   644  
   645  	expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
   646  	c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
   647  }
   648  
   649  // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
   650  // we have modified a layer blob and its digest cannot be verified.
   651  // This is the schema1 version of the test.
   652  func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
   653  	testRequires(c, DaemonIsLinux)
   654  	manifestDigest, err := setupImage(c)
   655  	c.Assert(err, checker.IsNil)
   656  
   657  	// Load the target manifest blob.
   658  	manifestBlob := s.reg.ReadBlobContents(c, manifestDigest)
   659  
   660  	var imgManifest schema1.Manifest
   661  	err = json.Unmarshal(manifestBlob, &imgManifest)
   662  	c.Assert(err, checker.IsNil)
   663  
   664  	// Next, get the digest of one of the layers from the manifest.
   665  	targetLayerDigest := imgManifest.FSLayers[0].BlobSum
   666  
   667  	// Move the existing data file aside, so that we can replace it with a
   668  	// malicious blob of data. NOTE: we defer the returned undo func.
   669  	undo := s.reg.TempMoveBlobData(c, targetLayerDigest)
   670  	defer undo()
   671  
   672  	// Now make a fake data blob in this directory.
   673  	s.reg.WriteBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
   674  
   675  	// Now try pulling that image by digest. We should get an error about
   676  	// digest verification for the target layer digest.
   677  
   678  	// Remove distribution cache to force a re-pull of the blobs
   679  	if err := os.RemoveAll(filepath.Join(testEnv.DockerBasePath(), "image", s.d.StorageDriver(), "distribution")); err != nil {
   680  		c.Fatalf("error clearing distribution cache: %v", err)
   681  	}
   682  
   683  	// Pull from the registry using the <name>@<digest> reference.
   684  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   685  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   686  	c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a non-zero exit status"))
   687  
   688  	expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
   689  	c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
   690  }