github.com/portworx/docker@v1.12.1/integration-cli/docker_cli_by_digest_test.go (about)

     1  package main
     2  
     3  import (
     4  	"encoding/json"
     5  	"fmt"
     6  	"os"
     7  	"path/filepath"
     8  	"regexp"
     9  	"strings"
    10  
    11  	"github.com/docker/distribution/digest"
    12  	"github.com/docker/distribution/manifest/schema1"
    13  	"github.com/docker/distribution/manifest/schema2"
    14  	"github.com/docker/docker/pkg/integration/checker"
    15  	"github.com/docker/docker/pkg/stringutils"
    16  	"github.com/docker/engine-api/types"
    17  	"github.com/go-check/check"
    18  )
    19  
    20  var (
    21  	remoteRepoName  = "dockercli/busybox-by-dgst"
    22  	repoName        = fmt.Sprintf("%s/%s", privateRegistryURL, remoteRepoName)
    23  	pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+")
    24  	digestRegex     = regexp.MustCompile("Digest: ([\\S]+)")
    25  )
    26  
    27  func setupImage(c *check.C) (digest.Digest, error) {
    28  	return setupImageWithTag(c, "latest")
    29  }
    30  
    31  func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) {
    32  	containerName := "busyboxbydigest"
    33  
    34  	dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox")
    35  
    36  	// tag the image to upload it to the private registry
    37  	repoAndTag := repoName + ":" + tag
    38  	out, _, err := dockerCmdWithError("commit", containerName, repoAndTag)
    39  	c.Assert(err, checker.IsNil, check.Commentf("image tagging failed: %s", out))
    40  
    41  	// delete the container as we don't need it any more
    42  	err = deleteContainer(containerName)
    43  	c.Assert(err, checker.IsNil)
    44  
    45  	// push the image
    46  	out, _, err = dockerCmdWithError("push", repoAndTag)
    47  	c.Assert(err, checker.IsNil, check.Commentf("pushing the image to the private registry has failed: %s", out))
    48  
    49  	// delete our local repo that we previously tagged
    50  	rmiout, _, err := dockerCmdWithError("rmi", repoAndTag)
    51  	c.Assert(err, checker.IsNil, check.Commentf("error deleting images prior to real test: %s", rmiout))
    52  
    53  	matches := pushDigestRegex.FindStringSubmatch(out)
    54  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from push output: %s", out))
    55  	pushDigest := matches[1]
    56  
    57  	return digest.Digest(pushDigest), nil
    58  }
    59  
    60  func testPullByTagDisplaysDigest(c *check.C) {
    61  	testRequires(c, DaemonIsLinux)
    62  	pushDigest, err := setupImage(c)
    63  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
    64  
    65  	// pull from the registry using the tag
    66  	out, _ := dockerCmd(c, "pull", repoName)
    67  
    68  	// the pull output includes "Digest: <digest>", so find that
    69  	matches := digestRegex.FindStringSubmatch(out)
    70  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
    71  	pullDigest := matches[1]
    72  
    73  	// make sure the pushed and pull digests match
    74  	c.Assert(pushDigest.String(), checker.Equals, pullDigest)
    75  }
    76  
    77  func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
    78  	testPullByTagDisplaysDigest(c)
    79  }
    80  
    81  func (s *DockerSchema1RegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
    82  	testPullByTagDisplaysDigest(c)
    83  }
    84  
    85  func testPullByDigest(c *check.C) {
    86  	testRequires(c, DaemonIsLinux)
    87  	pushDigest, err := setupImage(c)
    88  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
    89  
    90  	// pull from the registry using the <name>@<digest> reference
    91  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
    92  	out, _ := dockerCmd(c, "pull", imageReference)
    93  
    94  	// the pull output includes "Digest: <digest>", so find that
    95  	matches := digestRegex.FindStringSubmatch(out)
    96  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
    97  	pullDigest := matches[1]
    98  
    99  	// make sure the pushed and pull digests match
   100  	c.Assert(pushDigest.String(), checker.Equals, pullDigest)
   101  }
   102  
   103  func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) {
   104  	testPullByDigest(c)
   105  }
   106  
   107  func (s *DockerSchema1RegistrySuite) TestPullByDigest(c *check.C) {
   108  	testPullByDigest(c)
   109  }
   110  
   111  func testPullByDigestNoFallback(c *check.C) {
   112  	testRequires(c, DaemonIsLinux)
   113  	// pull from the registry using the <name>@<digest> reference
   114  	imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName)
   115  	out, _, err := dockerCmdWithError("pull", imageReference)
   116  	c.Assert(err, checker.NotNil, check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
   117  	c.Assert(out, checker.Contains, "manifest unknown", check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
   118  }
   119  
   120  func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) {
   121  	testPullByDigestNoFallback(c)
   122  }
   123  
   124  func (s *DockerSchema1RegistrySuite) TestPullByDigestNoFallback(c *check.C) {
   125  	testPullByDigestNoFallback(c)
   126  }
   127  
   128  func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) {
   129  	pushDigest, err := setupImage(c)
   130  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   131  
   132  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   133  
   134  	containerName := "createByDigest"
   135  	dockerCmd(c, "create", "--name", containerName, imageReference)
   136  
   137  	res := inspectField(c, containerName, "Config.Image")
   138  	c.Assert(res, checker.Equals, imageReference)
   139  }
   140  
   141  func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) {
   142  	pushDigest, err := setupImage(c)
   143  	c.Assert(err, checker.IsNil)
   144  
   145  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   146  
   147  	containerName := "runByDigest"
   148  	out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest")
   149  
   150  	foundRegex := regexp.MustCompile("found=([^\n]+)")
   151  	matches := foundRegex.FindStringSubmatch(out)
   152  	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
   153  	c.Assert(matches[1], checker.Equals, "1", check.Commentf("Expected %q, got %q", "1", matches[1]))
   154  
   155  	res := inspectField(c, containerName, "Config.Image")
   156  	c.Assert(res, checker.Equals, imageReference)
   157  }
   158  
   159  func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) {
   160  	digest, err := setupImage(c)
   161  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   162  
   163  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   164  
   165  	// pull from the registry using the <name>@<digest> reference
   166  	dockerCmd(c, "pull", imageReference)
   167  
   168  	// make sure inspect runs ok
   169  	inspectField(c, imageReference, "Id")
   170  
   171  	// do the delete
   172  	err = deleteImages(imageReference)
   173  	c.Assert(err, checker.IsNil, check.Commentf("unexpected error deleting image"))
   174  
   175  	// try to inspect again - it should error this time
   176  	_, err = inspectFieldWithError(imageReference, "Id")
   177  	//unexpected nil err trying to inspect what should be a non-existent image
   178  	c.Assert(err, checker.NotNil)
   179  	c.Assert(err.Error(), checker.Contains, "No such image")
   180  }
   181  
   182  func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) {
   183  	digest, err := setupImage(c)
   184  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   185  
   186  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   187  
   188  	// pull from the registry using the <name>@<digest> reference
   189  	dockerCmd(c, "pull", imageReference)
   190  
   191  	// get the image id
   192  	imageID := inspectField(c, imageReference, "Id")
   193  
   194  	// do the build
   195  	name := "buildbydigest"
   196  	_, err = buildImage(name, fmt.Sprintf(
   197  		`FROM %s
   198       CMD ["/bin/echo", "Hello World"]`, imageReference),
   199  		true)
   200  	c.Assert(err, checker.IsNil)
   201  
   202  	// get the build's image id
   203  	res := inspectField(c, name, "Config.Image")
   204  	// make sure they match
   205  	c.Assert(res, checker.Equals, imageID)
   206  }
   207  
   208  func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) {
   209  	digest, err := setupImage(c)
   210  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   211  
   212  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   213  
   214  	// pull from the registry using the <name>@<digest> reference
   215  	dockerCmd(c, "pull", imageReference)
   216  
   217  	// tag it
   218  	tag := "tagbydigest"
   219  	dockerCmd(c, "tag", imageReference, tag)
   220  
   221  	expectedID := inspectField(c, imageReference, "Id")
   222  
   223  	tagID := inspectField(c, tag, "Id")
   224  	c.Assert(tagID, checker.Equals, expectedID)
   225  }
   226  
   227  func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) {
   228  	digest, err := setupImage(c)
   229  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   230  
   231  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   232  
   233  	// pull from the registry using the <name>@<digest> reference
   234  	dockerCmd(c, "pull", imageReference)
   235  
   236  	out, _ := dockerCmd(c, "images")
   237  	c.Assert(out, checker.Not(checker.Contains), "DIGEST", check.Commentf("list output should not have contained DIGEST header"))
   238  }
   239  
   240  func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) {
   241  
   242  	// setup image1
   243  	digest1, err := setupImageWithTag(c, "tag1")
   244  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   245  	imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
   246  	c.Logf("imageReference1 = %s", imageReference1)
   247  
   248  	// pull image1 by digest
   249  	dockerCmd(c, "pull", imageReference1)
   250  
   251  	// list images
   252  	out, _ := dockerCmd(c, "images", "--digests")
   253  
   254  	// make sure repo shown, tag=<none>, digest = $digest1
   255  	re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
   256  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   257  	// setup image2
   258  	digest2, err := setupImageWithTag(c, "tag2")
   259  	//error setting up image
   260  	c.Assert(err, checker.IsNil)
   261  	imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
   262  	c.Logf("imageReference2 = %s", imageReference2)
   263  
   264  	// pull image1 by digest
   265  	dockerCmd(c, "pull", imageReference1)
   266  
   267  	// pull image2 by digest
   268  	dockerCmd(c, "pull", imageReference2)
   269  
   270  	// list images
   271  	out, _ = dockerCmd(c, "images", "--digests")
   272  
   273  	// make sure repo shown, tag=<none>, digest = $digest1
   274  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   275  
   276  	// make sure repo shown, tag=<none>, digest = $digest2
   277  	re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
   278  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   279  
   280  	// pull tag1
   281  	dockerCmd(c, "pull", repoName+":tag1")
   282  
   283  	// list images
   284  	out, _ = dockerCmd(c, "images", "--digests")
   285  
   286  	// make sure image 1 has repo, tag, <none> AND repo, <none>, digest
   287  	reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*` + digest1.String() + `\s`)
   288  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   289  	// make sure image 2 has repo, <none>, digest
   290  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   291  
   292  	// pull tag 2
   293  	dockerCmd(c, "pull", repoName+":tag2")
   294  
   295  	// list images
   296  	out, _ = dockerCmd(c, "images", "--digests")
   297  
   298  	// make sure image 1 has repo, tag, digest
   299  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   300  
   301  	// make sure image 2 has repo, tag, digest
   302  	reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*` + digest2.String() + `\s`)
   303  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   304  
   305  	// list images
   306  	out, _ = dockerCmd(c, "images", "--digests")
   307  
   308  	// make sure image 1 has repo, tag, digest
   309  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   310  	// make sure image 2 has repo, tag, digest
   311  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   312  	// make sure busybox has tag, but not digest
   313  	busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`)
   314  	c.Assert(busyboxRe.MatchString(out), checker.True, check.Commentf("expected %q: %s", busyboxRe.String(), out))
   315  }
   316  
   317  func (s *DockerRegistrySuite) TestListDanglingImagesWithDigests(c *check.C) {
   318  	// setup image1
   319  	digest1, err := setupImageWithTag(c, "dangle1")
   320  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   321  	imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
   322  	c.Logf("imageReference1 = %s", imageReference1)
   323  
   324  	// pull image1 by digest
   325  	dockerCmd(c, "pull", imageReference1)
   326  
   327  	// list images
   328  	out, _ := dockerCmd(c, "images", "--digests")
   329  
   330  	// make sure repo shown, tag=<none>, digest = $digest1
   331  	re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
   332  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   333  	// setup image2
   334  	digest2, err := setupImageWithTag(c, "dangle2")
   335  	//error setting up image
   336  	c.Assert(err, checker.IsNil)
   337  	imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
   338  	c.Logf("imageReference2 = %s", imageReference2)
   339  
   340  	// pull image1 by digest
   341  	dockerCmd(c, "pull", imageReference1)
   342  
   343  	// pull image2 by digest
   344  	dockerCmd(c, "pull", imageReference2)
   345  
   346  	// list images
   347  	out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
   348  
   349  	// make sure repo shown, tag=<none>, digest = $digest1
   350  	c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
   351  
   352  	// make sure repo shown, tag=<none>, digest = $digest2
   353  	re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
   354  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   355  
   356  	// pull dangle1 tag
   357  	dockerCmd(c, "pull", repoName+":dangle1")
   358  
   359  	// list images
   360  	out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
   361  
   362  	// make sure image 1 has repo, tag, <none> AND repo, <none>, digest
   363  	reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*dangle1\s*` + digest1.String() + `\s`)
   364  	c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
   365  	// make sure image 2 has repo, <none>, digest
   366  	c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
   367  
   368  	// pull dangle2 tag
   369  	dockerCmd(c, "pull", repoName+":dangle2")
   370  
   371  	// list images, show tagged images
   372  	out, _ = dockerCmd(c, "images", "--digests")
   373  
   374  	// make sure image 1 has repo, tag, digest
   375  	c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
   376  
   377  	// make sure image 2 has repo, tag, digest
   378  	reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*dangle2\s*` + digest2.String() + `\s`)
   379  	c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
   380  
   381  	// list images, no longer dangling, should not match
   382  	out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
   383  
   384  	// make sure image 1 has repo, tag, digest
   385  	c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
   386  	// make sure image 2 has repo, tag, digest
   387  	c.Assert(reWithDigest2.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest2.String(), out))
   388  }
   389  
   390  func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) {
   391  	digest, err := setupImage(c)
   392  	c.Assert(err, check.IsNil, check.Commentf("error setting up image"))
   393  
   394  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   395  
   396  	// pull from the registry using the <name>@<digest> reference
   397  	dockerCmd(c, "pull", imageReference)
   398  
   399  	out, _ := dockerCmd(c, "inspect", imageReference)
   400  
   401  	var imageJSON []types.ImageInspect
   402  	err = json.Unmarshal([]byte(out), &imageJSON)
   403  	c.Assert(err, checker.IsNil)
   404  	c.Assert(imageJSON, checker.HasLen, 1)
   405  	c.Assert(imageJSON[0].RepoDigests, checker.HasLen, 1)
   406  	c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), checker.Equals, true)
   407  }
   408  
   409  func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) {
   410  	digest, err := setupImage(c)
   411  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   412  
   413  	imageReference := fmt.Sprintf("%s@%s", repoName, digest)
   414  
   415  	// pull from the registry using the <name>@<digest> reference
   416  	dockerCmd(c, "pull", imageReference)
   417  
   418  	// build an image from it
   419  	imageName1 := "images_ps_filter_test"
   420  	_, err = buildImage(imageName1, fmt.Sprintf(
   421  		`FROM %s
   422  		 LABEL match me 1`, imageReference), true)
   423  	c.Assert(err, checker.IsNil)
   424  
   425  	// run a container based on that
   426  	dockerCmd(c, "run", "--name=test1", imageReference, "echo", "hello")
   427  	expectedID, err := getIDByName("test1")
   428  	c.Assert(err, check.IsNil)
   429  
   430  	// run a container based on the a descendant of that too
   431  	dockerCmd(c, "run", "--name=test2", imageName1, "echo", "hello")
   432  	expectedID1, err := getIDByName("test2")
   433  	c.Assert(err, check.IsNil)
   434  
   435  	expectedIDs := []string{expectedID, expectedID1}
   436  
   437  	// Invalid imageReference
   438  	out, _ := dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest))
   439  	// Filter container for ancestor filter should be empty
   440  	c.Assert(strings.TrimSpace(out), checker.Equals, "")
   441  
   442  	// Valid imageReference
   443  	out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference)
   444  	checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs)
   445  }
   446  
   447  func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) {
   448  	pushDigest, err := setupImage(c)
   449  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   450  
   451  	// pull from the registry using the <name>@<digest> reference
   452  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   453  	dockerCmd(c, "pull", imageReference)
   454  	// just in case...
   455  
   456  	dockerCmd(c, "tag", imageReference, repoName+":sometag")
   457  
   458  	imageID := inspectField(c, imageReference, "Id")
   459  
   460  	dockerCmd(c, "rmi", imageID)
   461  
   462  	_, err = inspectFieldWithError(imageID, "Id")
   463  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   464  }
   465  
   466  func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndTag(c *check.C) {
   467  	pushDigest, err := setupImage(c)
   468  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   469  
   470  	// pull from the registry using the <name>@<digest> reference
   471  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   472  	dockerCmd(c, "pull", imageReference)
   473  
   474  	imageID := inspectField(c, imageReference, "Id")
   475  
   476  	repoTag := repoName + ":sometag"
   477  	repoTag2 := repoName + ":othertag"
   478  	dockerCmd(c, "tag", imageReference, repoTag)
   479  	dockerCmd(c, "tag", imageReference, repoTag2)
   480  
   481  	dockerCmd(c, "rmi", repoTag2)
   482  
   483  	// rmi should have deleted only repoTag2, because there's another tag
   484  	inspectField(c, repoTag, "Id")
   485  
   486  	dockerCmd(c, "rmi", repoTag)
   487  
   488  	// rmi should have deleted the tag, the digest reference, and the image itself
   489  	_, err = inspectFieldWithError(imageID, "Id")
   490  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   491  }
   492  
   493  func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndMultiRepoTag(c *check.C) {
   494  	pushDigest, err := setupImage(c)
   495  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   496  
   497  	repo2 := fmt.Sprintf("%s/%s", repoName, "repo2")
   498  
   499  	// pull from the registry using the <name>@<digest> reference
   500  	imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
   501  	dockerCmd(c, "pull", imageReference)
   502  
   503  	imageID := inspectField(c, imageReference, "Id")
   504  
   505  	repoTag := repoName + ":sometag"
   506  	repoTag2 := repo2 + ":othertag"
   507  	dockerCmd(c, "tag", imageReference, repoTag)
   508  	dockerCmd(c, "tag", imageReference, repoTag2)
   509  
   510  	dockerCmd(c, "rmi", repoTag)
   511  
   512  	// rmi should have deleted repoTag and image reference, but left repoTag2
   513  	inspectField(c, repoTag2, "Id")
   514  	_, err = inspectFieldWithError(imageReference, "Id")
   515  	c.Assert(err, checker.NotNil, check.Commentf("image digest reference should have been removed"))
   516  
   517  	_, err = inspectFieldWithError(repoTag, "Id")
   518  	c.Assert(err, checker.NotNil, check.Commentf("image tag reference should have been removed"))
   519  
   520  	dockerCmd(c, "rmi", repoTag2)
   521  
   522  	// rmi should have deleted the tag, the digest reference, and the image itself
   523  	_, err = inspectFieldWithError(imageID, "Id")
   524  	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
   525  }
   526  
   527  // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
   528  // we have modified a manifest blob and its digest cannot be verified.
   529  // This is the schema2 version of the test.
   530  func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
   531  	testRequires(c, DaemonIsLinux)
   532  	manifestDigest, err := setupImage(c)
   533  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   534  
   535  	// Load the target manifest blob.
   536  	manifestBlob := s.reg.readBlobContents(c, manifestDigest)
   537  
   538  	var imgManifest schema2.Manifest
   539  	err = json.Unmarshal(manifestBlob, &imgManifest)
   540  	c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
   541  
   542  	// Change a layer in the manifest.
   543  	imgManifest.Layers[0].Digest = digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
   544  
   545  	// Move the existing data file aside, so that we can replace it with a
   546  	// malicious blob of data. NOTE: we defer the returned undo func.
   547  	undo := s.reg.tempMoveBlobData(c, manifestDigest)
   548  	defer undo()
   549  
   550  	alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", "   ")
   551  	c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
   552  
   553  	s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob)
   554  
   555  	// Now try pulling that image by digest. We should get an error about
   556  	// digest verification for the manifest digest.
   557  
   558  	// Pull from the registry using the <name>@<digest> reference.
   559  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   560  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   561  	c.Assert(exitStatus, checker.Not(check.Equals), 0)
   562  
   563  	expectedErrorMsg := fmt.Sprintf("manifest verification failed for digest %s", manifestDigest)
   564  	c.Assert(out, checker.Contains, expectedErrorMsg)
   565  }
   566  
   567  // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
   568  // we have modified a manifest blob and its digest cannot be verified.
   569  // This is the schema1 version of the test.
   570  func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
   571  	testRequires(c, DaemonIsLinux)
   572  	manifestDigest, err := setupImage(c)
   573  	c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
   574  
   575  	// Load the target manifest blob.
   576  	manifestBlob := s.reg.readBlobContents(c, manifestDigest)
   577  
   578  	var imgManifest schema1.Manifest
   579  	err = json.Unmarshal(manifestBlob, &imgManifest)
   580  	c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
   581  
   582  	// Change a layer in the manifest.
   583  	imgManifest.FSLayers[0] = schema1.FSLayer{
   584  		BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
   585  	}
   586  
   587  	// Move the existing data file aside, so that we can replace it with a
   588  	// malicious blob of data. NOTE: we defer the returned undo func.
   589  	undo := s.reg.tempMoveBlobData(c, manifestDigest)
   590  	defer undo()
   591  
   592  	alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", "   ")
   593  	c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
   594  
   595  	s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob)
   596  
   597  	// Now try pulling that image by digest. We should get an error about
   598  	// digest verification for the manifest digest.
   599  
   600  	// Pull from the registry using the <name>@<digest> reference.
   601  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   602  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   603  	c.Assert(exitStatus, checker.Not(check.Equals), 0)
   604  
   605  	expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest)
   606  	c.Assert(out, checker.Contains, expectedErrorMsg)
   607  }
   608  
   609  // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
   610  // we have modified a layer blob and its digest cannot be verified.
   611  // This is the schema2 version of the test.
   612  func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
   613  	testRequires(c, DaemonIsLinux)
   614  	manifestDigest, err := setupImage(c)
   615  	c.Assert(err, checker.IsNil)
   616  
   617  	// Load the target manifest blob.
   618  	manifestBlob := s.reg.readBlobContents(c, manifestDigest)
   619  
   620  	var imgManifest schema2.Manifest
   621  	err = json.Unmarshal(manifestBlob, &imgManifest)
   622  	c.Assert(err, checker.IsNil)
   623  
   624  	// Next, get the digest of one of the layers from the manifest.
   625  	targetLayerDigest := imgManifest.Layers[0].Digest
   626  
   627  	// Move the existing data file aside, so that we can replace it with a
   628  	// malicious blob of data. NOTE: we defer the returned undo func.
   629  	undo := s.reg.tempMoveBlobData(c, targetLayerDigest)
   630  	defer undo()
   631  
   632  	// Now make a fake data blob in this directory.
   633  	s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
   634  
   635  	// Now try pulling that image by digest. We should get an error about
   636  	// digest verification for the target layer digest.
   637  
   638  	// Remove distribution cache to force a re-pull of the blobs
   639  	if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil {
   640  		c.Fatalf("error clearing distribution cache: %v", err)
   641  	}
   642  
   643  	// Pull from the registry using the <name>@<digest> reference.
   644  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   645  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   646  	c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status"))
   647  
   648  	expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
   649  	c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
   650  }
   651  
   652  // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
   653  // we have modified a layer blob and its digest cannot be verified.
   654  // This is the schema1 version of the test.
   655  func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
   656  	testRequires(c, DaemonIsLinux)
   657  	manifestDigest, err := setupImage(c)
   658  	c.Assert(err, checker.IsNil)
   659  
   660  	// Load the target manifest blob.
   661  	manifestBlob := s.reg.readBlobContents(c, manifestDigest)
   662  
   663  	var imgManifest schema1.Manifest
   664  	err = json.Unmarshal(manifestBlob, &imgManifest)
   665  	c.Assert(err, checker.IsNil)
   666  
   667  	// Next, get the digest of one of the layers from the manifest.
   668  	targetLayerDigest := imgManifest.FSLayers[0].BlobSum
   669  
   670  	// Move the existing data file aside, so that we can replace it with a
   671  	// malicious blob of data. NOTE: we defer the returned undo func.
   672  	undo := s.reg.tempMoveBlobData(c, targetLayerDigest)
   673  	defer undo()
   674  
   675  	// Now make a fake data blob in this directory.
   676  	s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
   677  
   678  	// Now try pulling that image by digest. We should get an error about
   679  	// digest verification for the target layer digest.
   680  
   681  	// Remove distribution cache to force a re-pull of the blobs
   682  	if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil {
   683  		c.Fatalf("error clearing distribution cache: %v", err)
   684  	}
   685  
   686  	// Pull from the registry using the <name>@<digest> reference.
   687  	imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
   688  	out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
   689  	c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a zero exit status"))
   690  
   691  	expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
   692  	c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
   693  }