docker_cli_pull_trusted_test.go 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255
  1. package main
  2. import (
  3. "fmt"
  4. "io/ioutil"
  5. "os/exec"
  6. "strings"
  7. "time"
  8. "github.com/docker/docker/pkg/integration/checker"
  9. "github.com/go-check/check"
  10. )
  11. func (s *DockerTrustSuite) TestTrustedPull(c *check.C) {
  12. repoName := s.setupTrustedImage(c, "trusted-pull")
  13. // Try pull
  14. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  15. s.trustedCmd(pullCmd)
  16. out, _, err := runCommandWithOutput(pullCmd)
  17. c.Assert(err, check.IsNil, check.Commentf(out))
  18. c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))
  19. dockerCmd(c, "rmi", repoName)
  20. // Try untrusted pull to ensure we pushed the tag to the registry
  21. pullCmd = exec.Command(dockerBinary, "pull", "--disable-content-trust=true", repoName)
  22. s.trustedCmd(pullCmd)
  23. out, _, err = runCommandWithOutput(pullCmd)
  24. c.Assert(err, check.IsNil, check.Commentf(out))
  25. c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))
  26. }
  27. func (s *DockerTrustSuite) TestTrustedIsolatedPull(c *check.C) {
  28. repoName := s.setupTrustedImage(c, "trusted-isolated-pull")
  29. // Try pull (run from isolated directory without trust information)
  30. pullCmd := exec.Command(dockerBinary, "--config", "/tmp/docker-isolated", "pull", repoName)
  31. s.trustedCmd(pullCmd)
  32. out, _, err := runCommandWithOutput(pullCmd)
  33. c.Assert(err, check.IsNil, check.Commentf(out))
  34. c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(string(out)))
  35. dockerCmd(c, "rmi", repoName)
  36. }
  37. func (s *DockerTrustSuite) TestUntrustedPull(c *check.C) {
  38. repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)
  39. // tag the image and upload it to the private registry
  40. dockerCmd(c, "tag", "busybox", repoName)
  41. dockerCmd(c, "push", repoName)
  42. dockerCmd(c, "rmi", repoName)
  43. // Try trusted pull on untrusted tag
  44. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  45. s.trustedCmd(pullCmd)
  46. out, _, err := runCommandWithOutput(pullCmd)
  47. c.Assert(err, check.NotNil, check.Commentf(out))
  48. c.Assert(string(out), checker.Contains, "Error: remote trust data repository not initialized", check.Commentf(out))
  49. }
  50. func (s *DockerTrustSuite) TestPullWhenCertExpired(c *check.C) {
  51. c.Skip("Currently changes system time, causing instability")
  52. repoName := s.setupTrustedImage(c, "trusted-cert-expired")
  53. // Certificates have 10 years of expiration
  54. elevenYearsFromNow := time.Now().Add(time.Hour * 24 * 365 * 11)
  55. runAtDifferentDate(elevenYearsFromNow, func() {
  56. // Try pull
  57. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  58. s.trustedCmd(pullCmd)
  59. out, _, err := runCommandWithOutput(pullCmd)
  60. c.Assert(err, check.NotNil, check.Commentf(out))
  61. c.Assert(string(out), checker.Contains, "could not validate the path to a trusted root", check.Commentf(out))
  62. })
  63. runAtDifferentDate(elevenYearsFromNow, func() {
  64. // Try pull
  65. pullCmd := exec.Command(dockerBinary, "pull", "--disable-content-trust", repoName)
  66. s.trustedCmd(pullCmd)
  67. out, _, err := runCommandWithOutput(pullCmd)
  68. c.Assert(err, check.IsNil, check.Commentf(out))
  69. c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))
  70. })
  71. }
  72. func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {
  73. repoName := fmt.Sprintf("%v/dockerclievilpull/trusted:latest", privateRegistryURL)
  74. evilLocalConfigDir, err := ioutil.TempDir("", "evil-local-config-dir")
  75. if err != nil {
  76. c.Fatalf("Failed to create local temp dir")
  77. }
  78. // tag the image and upload it to the private registry
  79. dockerCmd(c, "tag", "busybox", repoName)
  80. pushCmd := exec.Command(dockerBinary, "push", repoName)
  81. s.trustedCmd(pushCmd)
  82. out, _, err := runCommandWithOutput(pushCmd)
  83. c.Assert(err, check.IsNil, check.Commentf(out))
  84. c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))
  85. dockerCmd(c, "rmi", repoName)
  86. // Try pull
  87. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  88. s.trustedCmd(pullCmd)
  89. out, _, err = runCommandWithOutput(pullCmd)
  90. c.Assert(err, check.IsNil, check.Commentf(out))
  91. c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))
  92. dockerCmd(c, "rmi", repoName)
  93. // Kill the notary server, start a new "evil" one.
  94. s.not.Close()
  95. s.not, err = newTestNotary(c)
  96. c.Assert(err, check.IsNil, check.Commentf("Restarting notary server failed."))
  97. // In order to make an evil server, lets re-init a client (with a different trust dir) and push new data.
  98. // tag an image and upload it to the private registry
  99. dockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)
  100. // Push up to the new server
  101. pushCmd = exec.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName)
  102. s.trustedCmd(pushCmd)
  103. out, _, err = runCommandWithOutput(pushCmd)
  104. c.Assert(err, check.IsNil, check.Commentf(out))
  105. c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))
  106. // Now, try pulling with the original client from this new trust server. This should fail.
  107. pullCmd = exec.Command(dockerBinary, "pull", repoName)
  108. s.trustedCmd(pullCmd)
  109. out, _, err = runCommandWithOutput(pullCmd)
  110. c.Assert(err, check.NotNil, check.Commentf(out))
  111. c.Assert(string(out), checker.Contains, "failed to validate data with current trusted certificates", check.Commentf(out))
  112. }
  113. func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {
  114. c.Skip("Currently changes system time, causing instability")
  115. repoName := fmt.Sprintf("%v/dockercliexpiredtimestamppull/trusted:latest", privateRegistryURL)
  116. // tag the image and upload it to the private registry
  117. dockerCmd(c, "tag", "busybox", repoName)
  118. // Push with default passphrases
  119. pushCmd := exec.Command(dockerBinary, "push", repoName)
  120. s.trustedCmd(pushCmd)
  121. out, _, err := runCommandWithOutput(pushCmd)
  122. c.Assert(err, check.IsNil, check.Commentf(out))
  123. c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))
  124. dockerCmd(c, "rmi", repoName)
  125. // Snapshots last for three years. This should be expired
  126. fourYearsLater := time.Now().Add(time.Hour * 24 * 365 * 4)
  127. runAtDifferentDate(fourYearsLater, func() {
  128. // Try pull
  129. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  130. s.trustedCmd(pullCmd)
  131. out, _, err = runCommandWithOutput(pullCmd)
  132. c.Assert(err, check.NotNil, check.Commentf("Missing expected error running trusted pull with expired snapshots"))
  133. c.Assert(string(out), checker.Contains, "repository out-of-date", check.Commentf(out))
  134. })
  135. }
  136. func (s *DockerTrustSuite) TestTrustedOfflinePull(c *check.C) {
  137. repoName := s.setupTrustedImage(c, "trusted-offline-pull")
  138. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  139. s.trustedCmdWithServer(pullCmd, "https://invalidnotaryserver")
  140. out, _, err := runCommandWithOutput(pullCmd)
  141. c.Assert(err, check.NotNil, check.Commentf(out))
  142. c.Assert(string(out), checker.Contains, "error contacting notary server", check.Commentf(out))
  143. // Do valid trusted pull to warm cache
  144. pullCmd = exec.Command(dockerBinary, "pull", repoName)
  145. s.trustedCmd(pullCmd)
  146. out, _, err = runCommandWithOutput(pullCmd)
  147. c.Assert(err, check.IsNil, check.Commentf(out))
  148. c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))
  149. dockerCmd(c, "rmi", repoName)
  150. // Try pull again with invalid notary server, should use cache
  151. pullCmd = exec.Command(dockerBinary, "pull", repoName)
  152. s.trustedCmdWithServer(pullCmd, "https://invalidnotaryserver")
  153. out, _, err = runCommandWithOutput(pullCmd)
  154. c.Assert(err, check.IsNil, check.Commentf(out))
  155. c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))
  156. }
  157. func (s *DockerTrustSuite) TestTrustedPullDelete(c *check.C) {
  158. repoName := fmt.Sprintf("%v/dockercli/%s:latest", privateRegistryURL, "trusted-pull-delete")
  159. // tag the image and upload it to the private registry
  160. _, err := buildImage(repoName, `
  161. FROM busybox
  162. CMD echo trustedpulldelete
  163. `, true)
  164. pushCmd := exec.Command(dockerBinary, "push", repoName)
  165. s.trustedCmd(pushCmd)
  166. out, _, err := runCommandWithOutput(pushCmd)
  167. if err != nil {
  168. c.Fatalf("Error running trusted push: %s\n%s", err, out)
  169. }
  170. if !strings.Contains(string(out), "Signing and pushing trust metadata") {
  171. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  172. }
  173. if out, status := dockerCmd(c, "rmi", repoName); status != 0 {
  174. c.Fatalf("Error removing image %q\n%s", repoName, out)
  175. }
  176. // Try pull
  177. pullCmd := exec.Command(dockerBinary, "pull", repoName)
  178. s.trustedCmd(pullCmd)
  179. out, _, err = runCommandWithOutput(pullCmd)
  180. c.Assert(err, check.IsNil, check.Commentf(out))
  181. matches := digestRegex.FindStringSubmatch(out)
  182. c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
  183. pullDigest := matches[1]
  184. imageID, err := inspectField(repoName, "Id")
  185. c.Assert(err, checker.IsNil, check.Commentf("error inspecting image id"))
  186. imageByDigest := repoName + "@" + pullDigest
  187. byDigestID, err := inspectField(imageByDigest, "Id")
  188. c.Assert(err, checker.IsNil, check.Commentf("error inspecting image id"))
  189. c.Assert(byDigestID, checker.Equals, imageID)
  190. // rmi of tag should also remove the digest reference
  191. dockerCmd(c, "rmi", repoName)
  192. _, err = inspectField(imageByDigest, "Id")
  193. c.Assert(err, checker.NotNil, check.Commentf("digest reference should have been removed"))
  194. _, err = inspectField(imageID, "Id")
  195. c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
  196. }