Signed-off-by: Diogo Monica <diogo@docker.com>
| ... | ... |
@@ -142,6 +142,40 @@ func (s *DockerTrustSuite) TestTrustedPush(c *check.C) {
|
| 142 | 142 |
} |
| 143 | 143 |
} |
| 144 | 144 |
|
| 145 |
+func (s *DockerTrustSuite) TestTrustedPushWithEnvPasswords(c *check.C) {
|
|
| 146 |
+ repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)
|
|
| 147 |
+ // tag the image and upload it to the private registry |
|
| 148 |
+ dockerCmd(c, "tag", "busybox", repoName) |
|
| 149 |
+ |
|
| 150 |
+ pushCmd := exec.Command(dockerBinary, "push", repoName) |
|
| 151 |
+ s.trustedCmdWithPassphrases(pushCmd, "12345678", "12345678") |
|
| 152 |
+ out, _, err := runCommandWithOutput(pushCmd) |
|
| 153 |
+ if err != nil {
|
|
| 154 |
+ c.Fatalf("Error running trusted push: %s\n%s", err, out)
|
|
| 155 |
+ } |
|
| 156 |
+ if !strings.Contains(string(out), "Signing and pushing trust metadata") {
|
|
| 157 |
+ c.Fatalf("Missing expected output on trusted push:\n%s", out)
|
|
| 158 |
+ } |
|
| 159 |
+} |
|
| 160 |
+ |
|
| 161 |
+// This test ensures backwards compatibility with old ENV variables. Should be |
|
| 162 |
+// deprecated by 1.10 |
|
| 163 |
+func (s *DockerTrustSuite) TestTrustedPushWithDeprecatedEnvPasswords(c *check.C) {
|
|
| 164 |
+ repoName := fmt.Sprintf("%v/dockercli/trusteddeprecated:latest", privateRegistryURL)
|
|
| 165 |
+ // tag the image and upload it to the private registry |
|
| 166 |
+ dockerCmd(c, "tag", "busybox", repoName) |
|
| 167 |
+ |
|
| 168 |
+ pushCmd := exec.Command(dockerBinary, "push", repoName) |
|
| 169 |
+ s.trustedCmdWithDeprecatedEnvPassphrases(pushCmd, "12345678", "12345678") |
|
| 170 |
+ out, _, err := runCommandWithOutput(pushCmd) |
|
| 171 |
+ if err != nil {
|
|
| 172 |
+ c.Fatalf("Error running trusted push: %s\n%s", err, out)
|
|
| 173 |
+ } |
|
| 174 |
+ if !strings.Contains(string(out), "Signing and pushing trust metadata") {
|
|
| 175 |
+ c.Fatalf("Missing expected output on trusted push:\n%s", out)
|
|
| 176 |
+ } |
|
| 177 |
+} |
|
| 178 |
+ |
|
| 145 | 179 |
func (s *DockerTrustSuite) TestTrustedPushWithFaillingServer(c *check.C) {
|
| 146 | 180 |
repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)
|
| 147 | 181 |
// tag the image and upload it to the private registry |
| ... | ... |
@@ -268,6 +302,38 @@ func (s *DockerTrustSuite) TestTrustedPushWithIncorrectPassphraseForNonRoot(c *c |
| 268 | 268 |
} |
| 269 | 269 |
} |
| 270 | 270 |
|
| 271 |
+// This test ensures backwards compatibility with old ENV variables. Should be |
|
| 272 |
+// deprecated by 1.10 |
|
| 273 |
+func (s *DockerTrustSuite) TestTrustedPushWithIncorrectDeprecatedPassphraseForNonRoot(c *check.C) {
|
|
| 274 |
+ repoName := fmt.Sprintf("%v/dockercliincorretdeprecatedpwd/trusted:latest", privateRegistryURL)
|
|
| 275 |
+ // tag the image and upload it to the private registry |
|
| 276 |
+ dockerCmd(c, "tag", "busybox", repoName) |
|
| 277 |
+ |
|
| 278 |
+ // Push with default passphrases |
|
| 279 |
+ pushCmd := exec.Command(dockerBinary, "push", repoName) |
|
| 280 |
+ s.trustedCmd(pushCmd) |
|
| 281 |
+ out, _, err := runCommandWithOutput(pushCmd) |
|
| 282 |
+ if err != nil {
|
|
| 283 |
+ c.Fatalf("trusted push failed: %s\n%s", err, out)
|
|
| 284 |
+ } |
|
| 285 |
+ |
|
| 286 |
+ if !strings.Contains(string(out), "Signing and pushing trust metadata") {
|
|
| 287 |
+ c.Fatalf("Missing expected output on trusted push:\n%s", out)
|
|
| 288 |
+ } |
|
| 289 |
+ |
|
| 290 |
+ // Push with wrong passphrases |
|
| 291 |
+ pushCmd = exec.Command(dockerBinary, "push", repoName) |
|
| 292 |
+ s.trustedCmdWithDeprecatedEnvPassphrases(pushCmd, "12345678", "87654321") |
|
| 293 |
+ out, _, err = runCommandWithOutput(pushCmd) |
|
| 294 |
+ if err == nil {
|
|
| 295 |
+ c.Fatalf("Error missing from trusted push with short targets passphrase: \n%s", out)
|
|
| 296 |
+ } |
|
| 297 |
+ |
|
| 298 |
+ if !strings.Contains(string(out), "password invalid, operation has failed") {
|
|
| 299 |
+ c.Fatalf("Missing expected output on trusted push with short targets/snapsnot passphrase:\n%s", out)
|
|
| 300 |
+ } |
|
| 301 |
+} |
|
| 302 |
+ |
|
| 271 | 303 |
func (s *DockerTrustSuite) TestTrustedPushWithExpiredSnapshot(c *check.C) {
|
| 272 | 304 |
c.Skip("Currently changes system time, causing instability")
|
| 273 | 305 |
repoName := fmt.Sprintf("%v/dockercliexpiredsnapshot/trusted:latest", privateRegistryURL)
|
| ... | ... |
@@ -124,11 +124,27 @@ func (s *DockerTrustSuite) trustedCmdWithServer(cmd *exec.Cmd, server string) {
|
| 124 | 124 |
trustCmdEnv(cmd, server, pwd, pwd) |
| 125 | 125 |
} |
| 126 | 126 |
|
| 127 |
-func (s *DockerTrustSuite) trustedCmdWithPassphrases(cmd *exec.Cmd, offlinePwd, taggingPwd string) {
|
|
| 128 |
- trustCmdEnv(cmd, notaryURL, offlinePwd, taggingPwd) |
|
| 127 |
+func (s *DockerTrustSuite) trustedCmdWithPassphrases(cmd *exec.Cmd, rootPwd, repositoryPwd string) {
|
|
| 128 |
+ trustCmdEnv(cmd, s.not.address(), rootPwd, repositoryPwd) |
|
| 129 | 129 |
} |
| 130 | 130 |
|
| 131 |
-func trustCmdEnv(cmd *exec.Cmd, server, offlinePwd, taggingPwd string) {
|
|
| 131 |
+func (s *DockerTrustSuite) trustedCmdWithDeprecatedEnvPassphrases(cmd *exec.Cmd, offlinePwd, taggingPwd string) {
|
|
| 132 |
+ trustCmdDeprecatedEnv(cmd, s.not.address(), offlinePwd, taggingPwd) |
|
| 133 |
+} |
|
| 134 |
+ |
|
| 135 |
+func trustCmdEnv(cmd *exec.Cmd, server, rootPwd, repositoryPwd string) {
|
|
| 136 |
+ env := []string{
|
|
| 137 |
+ "DOCKER_CONTENT_TRUST=1", |
|
| 138 |
+ fmt.Sprintf("DOCKER_CONTENT_TRUST_SERVER=%s", server),
|
|
| 139 |
+ fmt.Sprintf("DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE=%s", rootPwd),
|
|
| 140 |
+ fmt.Sprintf("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=%s", repositoryPwd),
|
|
| 141 |
+ } |
|
| 142 |
+ cmd.Env = append(os.Environ(), env...) |
|
| 143 |
+} |
|
| 144 |
+ |
|
| 145 |
+// Helper method to test the old env variables OFFLINE and TAGGING that will |
|
| 146 |
+// be deprecated by 1.10 |
|
| 147 |
+func trustCmdDeprecatedEnv(cmd *exec.Cmd, server, offlinePwd, taggingPwd string) {
|
|
| 132 | 148 |
env := []string{
|
| 133 | 149 |
"DOCKER_CONTENT_TRUST=1", |
| 134 | 150 |
fmt.Sprintf("DOCKER_CONTENT_TRUST_SERVER=%s", server),
|