a2b0c977 |
package main
import ( |
de52a3bc |
"encoding/json" |
a2b0c977 |
"fmt"
"regexp"
"strings"
|
de52a3bc |
"github.com/docker/distribution/digest"
"github.com/docker/distribution/manifest" |
7ff56c56 |
"github.com/docker/docker/api/types"
"github.com/docker/docker/pkg/stringutils" |
a2b0c977 |
"github.com/docker/docker/utils" |
dc944ea7 |
"github.com/go-check/check" |
a2b0c977 |
)
var ( |
de52a3bc |
remoteRepoName = "dockercli/busybox-by-dgst"
repoName = fmt.Sprintf("%v/%s", privateRegistryURL, remoteRepoName) |
ed13c3ab |
pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+")
digestRegex = regexp.MustCompile("Digest: ([\\S]+)") |
a2b0c977 |
)
|
de52a3bc |
func setupImage(c *check.C) (digest.Digest, error) { |
5c295460 |
return setupImageWithTag(c, "latest") |
a2b0c977 |
}
|
de52a3bc |
func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) { |
a2b0c977 |
containerName := "busyboxbydigest"
|
5c295460 |
dockerCmd(c, "run", "-d", "-e", "digest=1", "--name", containerName, "busybox") |
a2b0c977 |
// tag the image to upload it to the private registry
repoAndTag := utils.ImageReference(repoName, tag) |
693ba98c |
if out, _, err := dockerCmdWithError("commit", containerName, repoAndTag); err != nil { |
a2b0c977 |
return "", fmt.Errorf("image tagging failed: %s, %v", out, err)
}
// delete the container as we don't need it any more
if err := deleteContainer(containerName); err != nil {
return "", err
}
// push the image |
693ba98c |
out, _, err := dockerCmdWithError("push", repoAndTag) |
a2b0c977 |
if err != nil {
return "", fmt.Errorf("pushing the image to the private registry has failed: %s, %v", out, err)
}
// delete our local repo that we previously tagged |
693ba98c |
if rmiout, _, err := dockerCmdWithError("rmi", repoAndTag); err != nil { |
5c295460 |
return "", fmt.Errorf("error deleting images prior to real test: %s, %v", rmiout, err) |
a2b0c977 |
}
|
ed13c3ab |
matches := pushDigestRegex.FindStringSubmatch(out) |
a2b0c977 |
if len(matches) != 2 {
return "", fmt.Errorf("unable to parse digest from push output: %s", out)
}
pushDigest := matches[1]
|
de52a3bc |
return digest.Digest(pushDigest), nil |
a2b0c977 |
}
|
f696b107 |
func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) { |
f9a3558a |
testRequires(c, DaemonIsLinux) |
5c295460 |
pushDigest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
// pull from the registry using the tag |
5c295460 |
out, _ := dockerCmd(c, "pull", repoName) |
a2b0c977 |
// the pull output includes "Digest: <digest>", so find that
matches := digestRegex.FindStringSubmatch(out)
if len(matches) != 2 { |
dc944ea7 |
c.Fatalf("unable to parse digest from pull output: %s", out) |
a2b0c977 |
}
pullDigest := matches[1]
// make sure the pushed and pull digests match |
de52a3bc |
if pushDigest.String() != pullDigest { |
dc944ea7 |
c.Fatalf("push digest %q didn't match pull digest %q", pushDigest, pullDigest) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) { |
f9a3558a |
testRequires(c, DaemonIsLinux) |
5c295460 |
pushDigest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
// pull from the registry using the <name>@<digest> reference
imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) |
5c295460 |
out, _ := dockerCmd(c, "pull", imageReference) |
a2b0c977 |
// the pull output includes "Digest: <digest>", so find that
matches := digestRegex.FindStringSubmatch(out)
if len(matches) != 2 { |
dc944ea7 |
c.Fatalf("unable to parse digest from pull output: %s", out) |
a2b0c977 |
}
pullDigest := matches[1]
// make sure the pushed and pull digests match |
de52a3bc |
if pushDigest.String() != pullDigest { |
dc944ea7 |
c.Fatalf("push digest %q didn't match pull digest %q", pushDigest, pullDigest) |
a2b0c977 |
}
}
|
642e6a37 |
func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) { |
f9a3558a |
testRequires(c, DaemonIsLinux) |
642e6a37 |
// pull from the registry using the <name>@<digest> reference
imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName) |
693ba98c |
out, _, err := dockerCmdWithError("pull", imageReference) |
19515a7a |
if err == nil || !strings.Contains(out, "manifest unknown") { |
642e6a37 |
c.Fatalf("expected non-zero exit status and correct error message when pulling non-existing image: %s", out)
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) { |
5c295460 |
pushDigest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
containerName := "createByDigest" |
5c295460 |
out, _ := dockerCmd(c, "create", "--name", containerName, imageReference) |
a2b0c977 |
res, err := inspectField(containerName, "Config.Image")
if err != nil { |
dc944ea7 |
c.Fatalf("failed to get Config.Image: %s, %v", out, err) |
a2b0c977 |
}
if res != imageReference { |
dc944ea7 |
c.Fatalf("unexpected Config.Image: %s (expected %s)", res, imageReference) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) { |
5c295460 |
pushDigest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
containerName := "runByDigest" |
5c295460 |
out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest") |
a2b0c977 |
foundRegex := regexp.MustCompile("found=([^\n]+)")
matches := foundRegex.FindStringSubmatch(out)
if len(matches) != 2 { |
dc944ea7 |
c.Fatalf("error locating expected 'found=1' output: %s", out) |
a2b0c977 |
}
if matches[1] != "1" { |
dc944ea7 |
c.Fatalf("Expected %q, got %q", "1", matches[1]) |
a2b0c977 |
}
res, err := inspectField(containerName, "Config.Image")
if err != nil { |
dc944ea7 |
c.Fatalf("failed to get Config.Image: %s, %v", out, err) |
a2b0c977 |
}
if res != imageReference { |
dc944ea7 |
c.Fatalf("unexpected Config.Image: %s (expected %s)", res, imageReference) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) { |
5c295460 |
digest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference |
5c295460 |
dockerCmd(c, "pull", imageReference) |
a2b0c977 |
// make sure inspect runs ok
if _, err := inspectField(imageReference, "Id"); err != nil { |
dc944ea7 |
c.Fatalf("failed to inspect image: %v", err) |
a2b0c977 |
}
// do the delete
if err := deleteImages(imageReference); err != nil { |
dc944ea7 |
c.Fatalf("unexpected error deleting image: %v", err) |
a2b0c977 |
}
// try to inspect again - it should error this time
if _, err := inspectField(imageReference, "Id"); err == nil { |
dc944ea7 |
c.Fatalf("unexpected nil err trying to inspect what should be a non-existent image") |
a2b0c977 |
} else if !strings.Contains(err.Error(), "No such image") { |
dc944ea7 |
c.Fatalf("expected 'No such image' output, got %v", err) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) { |
5c295460 |
digest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference |
5c295460 |
dockerCmd(c, "pull", imageReference) |
a2b0c977 |
// get the image id
imageID, err := inspectField(imageReference, "Id")
if err != nil { |
dc944ea7 |
c.Fatalf("error getting image id: %v", err) |
a2b0c977 |
}
// do the build
name := "buildbydigest"
_, err = buildImage(name, fmt.Sprintf(
`FROM %s
CMD ["/bin/echo", "Hello World"]`, imageReference),
true)
if err != nil { |
dc944ea7 |
c.Fatal(err) |
a2b0c977 |
}
// get the build's image id
res, err := inspectField(name, "Config.Image")
if err != nil { |
dc944ea7 |
c.Fatal(err) |
a2b0c977 |
}
// make sure they match
if res != imageID { |
dc944ea7 |
c.Fatalf("Image %s, expected %s", res, imageID) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) { |
5c295460 |
digest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference |
5c295460 |
dockerCmd(c, "pull", imageReference) |
a2b0c977 |
// tag it
tag := "tagbydigest" |
5c295460 |
dockerCmd(c, "tag", imageReference, tag) |
a2b0c977 |
expectedID, err := inspectField(imageReference, "Id")
if err != nil { |
dc944ea7 |
c.Fatalf("error getting original image id: %v", err) |
a2b0c977 |
}
tagID, err := inspectField(tag, "Id")
if err != nil { |
dc944ea7 |
c.Fatalf("error getting tagged image id: %v", err) |
a2b0c977 |
}
if tagID != expectedID { |
dc944ea7 |
c.Fatalf("expected image id %q, got %q", expectedID, tagID) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) { |
5c295460 |
digest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference |
5c295460 |
dockerCmd(c, "pull", imageReference) |
a2b0c977 |
|
5c295460 |
out, _ := dockerCmd(c, "images") |
a2b0c977 |
if strings.Contains(out, "DIGEST") { |
dc944ea7 |
c.Fatalf("list output should not have contained DIGEST header: %s", out) |
a2b0c977 |
}
}
|
f696b107 |
func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) { |
a2b0c977 |
// setup image1 |
5c295460 |
digest1, err := setupImageWithTag(c, "tag1") |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1) |
dc944ea7 |
c.Logf("imageReference1 = %s", imageReference1) |
a2b0c977 |
// pull image1 by digest |
5c295460 |
dockerCmd(c, "pull", imageReference1) |
a2b0c977 |
// list images |
5c295460 |
out, _ := dockerCmd(c, "images", "--digests") |
a2b0c977 |
// make sure repo shown, tag=<none>, digest = $digest1 |
de52a3bc |
re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`) |
a2b0c977 |
if !re1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re1.String(), out) |
a2b0c977 |
}
// setup image2 |
5c295460 |
digest2, err := setupImageWithTag(c, "tag2") |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2) |
dc944ea7 |
c.Logf("imageReference2 = %s", imageReference2) |
a2b0c977 |
// pull image1 by digest |
5c295460 |
dockerCmd(c, "pull", imageReference1) |
a2b0c977 |
// pull image2 by digest |
5c295460 |
dockerCmd(c, "pull", imageReference2) |
a2b0c977 |
// list images |
5c295460 |
out, _ = dockerCmd(c, "images", "--digests") |
a2b0c977 |
// make sure repo shown, tag=<none>, digest = $digest1
if !re1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re1.String(), out) |
a2b0c977 |
}
// make sure repo shown, tag=<none>, digest = $digest2 |
de52a3bc |
re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`) |
a2b0c977 |
if !re2.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re2.String(), out) |
a2b0c977 |
}
// pull tag1 |
5c295460 |
dockerCmd(c, "pull", repoName+":tag1") |
a2b0c977 |
// list images |
5c295460 |
out, _ = dockerCmd(c, "images", "--digests") |
a2b0c977 |
// make sure image 1 has repo, tag, <none> AND repo, <none>, digest
reWithTag1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*<none>\s`) |
de52a3bc |
reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`) |
a2b0c977 |
if !reWithTag1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", reWithTag1.String(), out) |
a2b0c977 |
}
if !reWithDigest1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", reWithDigest1.String(), out) |
a2b0c977 |
}
// make sure image 2 has repo, <none>, digest
if !re2.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re2.String(), out) |
a2b0c977 |
}
// pull tag 2 |
5c295460 |
dockerCmd(c, "pull", repoName+":tag2") |
a2b0c977 |
// list images |
5c295460 |
out, _ = dockerCmd(c, "images", "--digests") |
a2b0c977 |
// make sure image 1 has repo, tag, digest
if !reWithTag1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re1.String(), out) |
a2b0c977 |
}
// make sure image 2 has repo, tag, digest
reWithTag2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*<none>\s`) |
de52a3bc |
reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`) |
a2b0c977 |
if !reWithTag2.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", reWithTag2.String(), out) |
a2b0c977 |
}
if !reWithDigest2.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", reWithDigest2.String(), out) |
a2b0c977 |
}
// list images |
5c295460 |
out, _ = dockerCmd(c, "images", "--digests") |
a2b0c977 |
// make sure image 1 has repo, tag, digest
if !reWithTag1.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re1.String(), out) |
a2b0c977 |
}
// make sure image 2 has repo, tag, digest
if !reWithTag2.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", re2.String(), out) |
a2b0c977 |
}
// make sure busybox has tag, but not digest
busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`)
if !busyboxRe.MatchString(out) { |
dc944ea7 |
c.Fatalf("expected %q: %s", busyboxRe.String(), out) |
a2b0c977 |
}
}
|
7ff56c56 |
func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) {
digest, err := setupImage(c)
c.Assert(err, check.IsNil, check.Commentf("error setting up image: %v", err))
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference
dockerCmd(c, "pull", imageReference)
out, _ := dockerCmd(c, "inspect", imageReference)
var imageJSON []types.ImageInspect
if err = json.Unmarshal([]byte(out), &imageJSON); err != nil {
c.Fatalf("unable to unmarshal body for latest version: %v", err)
}
c.Assert(len(imageJSON), check.Equals, 1)
c.Assert(len(imageJSON[0].RepoDigests), check.Equals, 1)
c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), check.Equals, true)
}
|
c1af0ac0 |
func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) {
digest, err := setupImage(c)
c.Assert(err, check.IsNil, check.Commentf("error setting up image: %v", err))
imageReference := fmt.Sprintf("%s@%s", repoName, digest)
// pull from the registry using the <name>@<digest> reference
dockerCmd(c, "pull", imageReference)
// build a image from it
imageName1 := "images_ps_filter_test"
_, err = buildImage(imageName1, fmt.Sprintf(
`FROM %s
LABEL match me 1`, imageReference), true)
c.Assert(err, check.IsNil)
// run a container based on that
out, _ := dockerCmd(c, "run", "-d", imageReference, "echo", "hello")
expectedID := strings.TrimSpace(out)
// run a container based on the a descendant of that too
out, _ = dockerCmd(c, "run", "-d", imageName1, "echo", "hello")
expectedID1 := strings.TrimSpace(out)
expectedIDs := []string{expectedID, expectedID1}
// Invalid imageReference
out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest))
if strings.TrimSpace(out) != "" {
c.Fatalf("Expected filter container for %s ancestor filter to be empty, got %v", fmt.Sprintf("busybox@%s", digest), strings.TrimSpace(out))
}
// Valid imageReference
out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference)
checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs)
}
|
f696b107 |
func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) { |
5c295460 |
pushDigest, err := setupImage(c) |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error setting up image: %v", err) |
a2b0c977 |
}
// pull from the registry using the <name>@<digest> reference
imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest) |
5c295460 |
dockerCmd(c, "pull", imageReference) |
a2b0c977 |
// just in case...
|
67058e38 |
imageID, err := inspectField(imageReference, "Id") |
a2b0c977 |
if err != nil { |
dc944ea7 |
c.Fatalf("error inspecting image id: %v", err) |
a2b0c977 |
}
|
5c295460 |
dockerCmd(c, "rmi", imageID) |
a2b0c977 |
} |
de52a3bc |
// TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
// we have modified a manifest blob and its digest cannot be verified.
func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) { |
f9a3558a |
testRequires(c, DaemonIsLinux) |
de52a3bc |
manifestDigest, err := setupImage(c)
if err != nil {
c.Fatalf("error setting up image: %v", err)
}
// Load the target manifest blob.
manifestBlob := s.reg.readBlobContents(c, manifestDigest)
var imgManifest manifest.Manifest
if err := json.Unmarshal(manifestBlob, &imgManifest); err != nil {
c.Fatalf("unable to decode image manifest from blob: %s", err)
}
// Add a malicious layer digest to the list of layers in the manifest.
imgManifest.FSLayers = append(imgManifest.FSLayers, manifest.FSLayer{
BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
})
// Move the existing data file aside, so that we can replace it with a
// malicious blob of data. NOTE: we defer the returned undo func.
undo := s.reg.tempMoveBlobData(c, manifestDigest)
defer undo()
alteredManifestBlob, err := json.Marshal(imgManifest)
if err != nil {
c.Fatalf("unable to encode altered image manifest to JSON: %s", err)
}
s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob)
// Now try pulling that image by digest. We should get an error about
// digest verification for the manifest digest.
// Pull from the registry using the <name>@<digest> reference.
imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
if exitStatus == 0 { |
d80c4244 |
c.Fatalf("expected a non-zero exit status but got %d: %s", exitStatus, out) |
de52a3bc |
}
expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest)
if !strings.Contains(out, expectedErrorMsg) {
c.Fatalf("expected error message %q in output: %s", expectedErrorMsg, out)
}
}
// TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
// we have modified a layer blob and its digest cannot be verified.
func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) { |
f9a3558a |
testRequires(c, DaemonIsLinux) |
de52a3bc |
manifestDigest, err := setupImage(c)
if err != nil {
c.Fatalf("error setting up image: %v", err)
}
// Load the target manifest blob.
manifestBlob := s.reg.readBlobContents(c, manifestDigest)
var imgManifest manifest.Manifest
if err := json.Unmarshal(manifestBlob, &imgManifest); err != nil {
c.Fatalf("unable to decode image manifest from blob: %s", err)
}
// Next, get the digest of one of the layers from the manifest.
targetLayerDigest := imgManifest.FSLayers[0].BlobSum
// Move the existing data file aside, so that we can replace it with a
// malicious blob of data. NOTE: we defer the returned undo func.
undo := s.reg.tempMoveBlobData(c, targetLayerDigest)
defer undo()
// Now make a fake data blob in this directory.
s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
// Now try pulling that image by digest. We should get an error about
// digest verification for the target layer digest.
// Pull from the registry using the <name>@<digest> reference.
imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
if exitStatus == 0 {
c.Fatalf("expected a zero exit status but got: %d", exitStatus)
}
expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
if !strings.Contains(out, expectedErrorMsg) {
c.Fatalf("expected error message %q in output: %s", expectedErrorMsg, out)
}
} |