|
| 1 | +// Licensed to Apache Software Foundation (ASF) under one or more contributor |
| 2 | +// license agreements. See the NOTICE file distributed with |
| 3 | +// this work for additional information regarding copyright |
| 4 | +// ownership. Apache Software Foundation (ASF) licenses this file to you under |
| 5 | +// the Apache License, Version 2.0 (the "License"); you may |
| 6 | +// not use this file except in compliance with the License. |
| 7 | +// You may obtain a copy of the License at |
| 8 | +// |
| 9 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +// |
| 11 | +// Unless required by applicable law or agreed to in writing, |
| 12 | +// software distributed under the License is distributed on an |
| 13 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +// KIND, either express or implied. See the License for the |
| 15 | +// specific language governing permissions and limitations |
| 16 | +// under the License. |
| 17 | +// |
| 18 | + |
| 19 | +package setup |
| 20 | + |
| 21 | +import ( |
| 22 | + "archive/tar" |
| 23 | + "bytes" |
| 24 | + "encoding/json" |
| 25 | + "errors" |
| 26 | + "fmt" |
| 27 | + "io" |
| 28 | + "os" |
| 29 | + "path/filepath" |
| 30 | + "strings" |
| 31 | + |
| 32 | + ocispec "github.com/opencontainers/image-spec/specs-go/v1" |
| 33 | +) |
| 34 | + |
| 35 | +const ( |
| 36 | + ociIndexFile = "index.json" |
| 37 | + // manifestSubjectAnnotation marks a top-level descriptor of an image archive |
| 38 | + // as a referrer of another manifest, such as an attestation or a signature. |
| 39 | + manifestSubjectAnnotation = "io.containerd.manifest.subject" |
| 40 | + imageNameAnnotation = "io.containerd.image.name" |
| 41 | +) |
| 42 | + |
| 43 | +// dropReferrers removes the referrers from the top-level index of an image |
| 44 | +// archive saved by docker, and leaves the archive untouched when it has none. |
| 45 | +// |
| 46 | +// docker's containerd image store saves the referrers of an image, such as its |
| 47 | +// attestations and their signatures, beside it in the top-level index, marked |
| 48 | +// with manifestSubjectAnnotation. kind imports the archive with `ctr images |
| 49 | +// import --all-platforms --digests`: containerd 1.7 (node images built by kind |
| 50 | +// v0.20 to v0.26) creates an image for every top-level descriptor and unpacks |
| 51 | +// it, and as a referrer has no filesystem layers, the import fails with |
| 52 | +// "mismatched image rootfs and manifest layers"; containerd 2 only unpacks |
| 53 | +// manifests that have filesystem layers. A descriptor that names an image is |
| 54 | +// kept even when marked. The blobs of the referrers stay in the archive, |
| 55 | +// unreferenced. |
| 56 | +func dropReferrers(path string) (int, error) { |
| 57 | + data, err := readArchiveFile(path, ociIndexFile) |
| 58 | + if err != nil || data == nil { |
| 59 | + return 0, err |
| 60 | + } |
| 61 | + var index map[string]json.RawMessage |
| 62 | + if err := json.Unmarshal(data, &index); err != nil { |
| 63 | + return 0, fmt.Errorf("parse %s of the image archive error: %w", ociIndexFile, err) |
| 64 | + } |
| 65 | + var manifests []json.RawMessage |
| 66 | + if raw, ok := index["manifests"]; ok { |
| 67 | + if err := json.Unmarshal(raw, &manifests); err != nil { |
| 68 | + return 0, fmt.Errorf("parse %s of the image archive error: %w", ociIndexFile, err) |
| 69 | + } |
| 70 | + } |
| 71 | + |
| 72 | + // The kept descriptors are copied as saved, so no field of theirs is lost. |
| 73 | + kept := make([]json.RawMessage, 0, len(manifests)) |
| 74 | + for _, m := range manifests { |
| 75 | + var desc struct { |
| 76 | + Annotations map[string]string `json:"annotations"` |
| 77 | + } |
| 78 | + if err := json.Unmarshal(m, &desc); err != nil { |
| 79 | + return 0, fmt.Errorf("parse %s of the image archive error: %w", ociIndexFile, err) |
| 80 | + } |
| 81 | + _, referrer := desc.Annotations[manifestSubjectAnnotation] |
| 82 | + _, named := desc.Annotations[imageNameAnnotation] |
| 83 | + _, refNamed := desc.Annotations[ocispec.AnnotationRefName] |
| 84 | + if !referrer || named || refNamed { |
| 85 | + kept = append(kept, m) |
| 86 | + } |
| 87 | + } |
| 88 | + dropped := len(manifests) - len(kept) |
| 89 | + if dropped == 0 { |
| 90 | + return 0, nil |
| 91 | + } |
| 92 | + |
| 93 | + if index["manifests"], err = json.Marshal(kept); err != nil { |
| 94 | + return 0, err |
| 95 | + } |
| 96 | + newIndex, err := json.Marshal(index) |
| 97 | + if err != nil { |
| 98 | + return 0, err |
| 99 | + } |
| 100 | + return dropped, rewriteArchiveFile(path, ociIndexFile, newIndex) |
| 101 | +} |
| 102 | + |
| 103 | +// readArchiveFile returns the content of a file in a tar archive, or nil when |
| 104 | +// the archive does not have it. |
| 105 | +func readArchiveFile(path, name string) ([]byte, error) { |
| 106 | + f, err := os.Open(path) |
| 107 | + if err != nil { |
| 108 | + return nil, fmt.Errorf("open image archive error: %w", err) |
| 109 | + } |
| 110 | + defer func() { |
| 111 | + _ = f.Close() |
| 112 | + }() |
| 113 | + tr := tar.NewReader(f) |
| 114 | + for { |
| 115 | + hdr, err := tr.Next() |
| 116 | + if errors.Is(err, io.EOF) { |
| 117 | + return nil, nil |
| 118 | + } |
| 119 | + if err != nil { |
| 120 | + return nil, fmt.Errorf("read image archive error: %w", err) |
| 121 | + } |
| 122 | + if strings.TrimPrefix(hdr.Name, "./") == name { |
| 123 | + data, err := io.ReadAll(tr) |
| 124 | + if err != nil { |
| 125 | + return nil, fmt.Errorf("read %s of the image archive error: %w", name, err) |
| 126 | + } |
| 127 | + return data, nil |
| 128 | + } |
| 129 | + } |
| 130 | +} |
| 131 | + |
| 132 | +// rewriteArchiveFile replaces the content of one file of a tar archive, copying |
| 133 | +// every other entry as it is. |
| 134 | +func rewriteArchiveFile(path, name string, content []byte) error { |
| 135 | + dst, err := os.CreateTemp(filepath.Dir(path), filepath.Base(path)+".*") |
| 136 | + if err != nil { |
| 137 | + return fmt.Errorf("create image archive error: %w", err) |
| 138 | + } |
| 139 | + err = copyArchive(path, dst, name, content) |
| 140 | + if closeErr := dst.Close(); err == nil && closeErr != nil { |
| 141 | + err = fmt.Errorf("write image archive error: %w", closeErr) |
| 142 | + } |
| 143 | + // Both archives are closed by now: Windows cannot replace an open file. |
| 144 | + if err == nil { |
| 145 | + err = os.Rename(dst.Name(), path) |
| 146 | + } |
| 147 | + if err != nil { |
| 148 | + _ = os.Remove(dst.Name()) |
| 149 | + } |
| 150 | + return err |
| 151 | +} |
| 152 | + |
| 153 | +func copyArchive(path string, dst io.Writer, name string, content []byte) error { |
| 154 | + src, err := os.Open(path) |
| 155 | + if err != nil { |
| 156 | + return fmt.Errorf("open image archive error: %w", err) |
| 157 | + } |
| 158 | + defer func() { |
| 159 | + _ = src.Close() |
| 160 | + }() |
| 161 | + tr := tar.NewReader(src) |
| 162 | + tw := tar.NewWriter(dst) |
| 163 | + for { |
| 164 | + hdr, err := tr.Next() |
| 165 | + if errors.Is(err, io.EOF) { |
| 166 | + break |
| 167 | + } |
| 168 | + if err != nil { |
| 169 | + return fmt.Errorf("read image archive error: %w", err) |
| 170 | + } |
| 171 | + var body io.Reader = tr |
| 172 | + if strings.TrimPrefix(hdr.Name, "./") == name { |
| 173 | + hdr.Size = int64(len(content)) |
| 174 | + body = bytes.NewReader(content) |
| 175 | + } |
| 176 | + if err := tw.WriteHeader(hdr); err != nil { |
| 177 | + return fmt.Errorf("write image archive error: %w", err) |
| 178 | + } |
| 179 | + if _, err := io.Copy(tw, body); err != nil { |
| 180 | + return fmt.Errorf("write image archive error: %w", err) |
| 181 | + } |
| 182 | + } |
| 183 | + if err := tw.Close(); err != nil { |
| 184 | + return fmt.Errorf("write image archive error: %w", err) |
| 185 | + } |
| 186 | + return nil |
| 187 | +} |
0 commit comments