portainer/portainer

package images

import (
    "context"
    "strings"
    "time"

    dockerclient "github.com/portainer/portainer/api/docker/client"

    "github.com/containers/image/v5/docker"
    imagetypes "github.com/containers/image/v5/types"
    "github.com/docker/docker/api/types"
    "github.com/opencontainers/go-digest"
    "github.com/pkg/errors"
    "github.com/rs/zerolog/log"
)

// Options holds docker registry object options
type Options struct {
    Auth    imagetypes.DockerAuthConfig
    Timeout time.Duration
}

type DigestClient struct {
    clientFactory  *dockerclient.ClientFactory
    opts           Options
    sysCtx         *imagetypes.SystemContext
    registryClient *RegistryClient
}

func NewClientWithRegistry(registryClient *RegistryClient, clientFactory *dockerclient.ClientFactory) *DigestClient {
    return &DigestClient{
        clientFactory:  clientFactory,
        registryClient: registryClient,
    }
}

func (c *DigestClient) RemoteDigest(image Image) (digest.Digest, error) {
    ctx, cancel := c.timeoutContext()
    defer cancel()
    // Docker references with both a tag and digest are currently not supported
    if image.Tag != "" && image.Digest != "" {
        err := image.trimDigest()
        if err != nil {
            return "", err
        }
    }

    rmRef, err := ParseReference(image.String())
    if err != nil {
        return "", errors.Wrap(err, "Cannot parse the image reference")
    }

    sysCtx := c.sysCtx
    if c.registryClient != nil {
        username, password, err := c.registryClient.RegistryAuth(image)
        if err != nil {
            log.Info().Str("image up to date indicator", image.String()).Msg("No environment registry credentials found, using anonymous access")
        } else {
            sysCtx = &imagetypes.SystemContext{
                DockerAuthConfig: &imagetypes.DockerAuthConfig{
                    Username: username,
                    Password: password,
                },
            }
        }
    }

    // Retrieve remote digest through HEAD request
    rmDigest, err := docker.GetDigest(ctx, sysCtx, rmRef)
    if err != nil {
        // fallback to public registry for hub
        if image.HubLink != "" {
            rmDigest, err = docker.GetDigest(ctx, c.sysCtx, rmRef)
            if err == nil {
                return rmDigest, nil
            }
        }

        log.Debug().Err(err).Msg("get remote digest error")

        return "", errors.Wrap(err, "Cannot get image digest from HEAD request")
    }

    return rmDigest, nil
}

func ParseLocalImage(inspect types.ImageInspect) (*Image, error) {
    if IsLocalImage(inspect) || IsDanglingImage(inspect) {
        return nil, errors.New("the image is not regular")
    }

    fromRepoDigests, err := ParseImage(ParseImageOptions{
        // including image name but no tag
        Name: inspect.RepoDigests[0],
    })
    if err != nil {
        return nil, err
    }

    if IsNoTagImage(inspect) {
        return &fromRepoDigests, nil
    }

    fromRepoTags, err := ParseImage(ParseImageOptions{
        Name: inspect.RepoTags[0],
    })
    if err != nil {
        return nil, err
    }

    fromRepoDigests.Tag = fromRepoTags.Tag

    return &fromRepoDigests, nil
}

func ParseRepoDigests(repoDigests []string) []digest.Digest {
    digests := make([]digest.Digest, 0)
    for _, repoDigest := range repoDigests {
        d := ParseRepoDigest(repoDigest)
        if d == "" {
            continue
        }

        digests = append(digests, d)
    }

    return digests
}

func ParseRepoTags(repoTags []string) []*Image {
    images := make([]*Image, 0)
    for _, repoTag := range repoTags {
        image := ParseRepoTag(repoTag)
        if image != nil {
            images = append(images, image)
        }
    }

    return images
}

func ParseRepoDigest(repoDigest string) digest.Digest {
    if !strings.ContainsAny(repoDigest, "@") {
        return ""
    }

    d, err := digest.Parse(strings.Split(repoDigest, "@")[1])
    if err != nil {
        log.Warn().Msgf("Skip invalid repo digest item: %s [error: %v]", repoDigest, err)

        return ""
    }

    return d
}

func ParseRepoTag(repoTag string) *Image {
    if repoTag == "" {
        return nil
    }

    image, err := ParseImage(ParseImageOptions{
        Name: repoTag,
    })
    if err != nil {
        log.Warn().Err(err).Str("repoTag", repoTag).Msg("RepoTag cannot be parsed.")

        return nil
    }

    return &image
}

func (c *DigestClient) timeoutContext() (context.Context, context.CancelFunc) {
    ctx := context.Background()
    var cancel context.CancelFunc = func() {}

    if c.opts.Timeout > 0 {
        ctx, cancel = context.WithTimeout(ctx, c.opts.Timeout)
    }

    return ctx, cancel
}