(ctx context.Context, dockerCLI command.Cli, options signOptions)
| 43 | } |
| 44 | |
| 45 | func runSignImage(ctx context.Context, dockerCLI command.Cli, options signOptions) error { |
| 46 | imageName := options.imageName |
| 47 | imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, authResolver(dockerCLI), imageName) |
| 48 | if err != nil { |
| 49 | return err |
| 50 | } |
| 51 | if err := validateTag(imgRefAndAuth); err != nil { |
| 52 | return err |
| 53 | } |
| 54 | |
| 55 | notaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull) |
| 56 | if err != nil { |
| 57 | return trust.NotaryError(imgRefAndAuth.Reference().Name(), err) |
| 58 | } |
| 59 | if err = clearChangeList(notaryRepo); err != nil { |
| 60 | return err |
| 61 | } |
| 62 | defer clearChangeList(notaryRepo) |
| 63 | |
| 64 | // get the latest repository metadata so we can figure out which roles to sign |
| 65 | if _, err = notaryRepo.ListTargets(); err != nil { |
| 66 | switch err.(type) { |
| 67 | case notaryclient.ErrRepoNotInitialized, notaryclient.ErrRepositoryNotExist: |
| 68 | // before initializing a new repo, check that the image exists locally: |
| 69 | if err := checkLocalImageExistence(ctx, dockerCLI.Client(), imageName); err != nil { |
| 70 | return err |
| 71 | } |
| 72 | |
| 73 | userRole := data.RoleName(path.Join(data.CanonicalTargetsRole.String(), imgRefAndAuth.AuthConfig().Username)) |
| 74 | if err := initNotaryRepoWithSigners(notaryRepo, userRole); err != nil { |
| 75 | return trust.NotaryError(imgRefAndAuth.Reference().Name(), err) |
| 76 | } |
| 77 | |
| 78 | _, _ = fmt.Fprintln(dockerCLI.Out(), "Created signer:", imgRefAndAuth.AuthConfig().Username) |
| 79 | _, _ = fmt.Fprintln(dockerCLI.Out(), "Finished initializing signed repository for", imageName) |
| 80 | default: |
| 81 | return trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), err) |
| 82 | } |
| 83 | } |
| 84 | target, err := createTarget(notaryRepo, imgRefAndAuth.Tag()) |
| 85 | if err != nil || options.local { |
| 86 | switch err := err.(type) { |
| 87 | // If the error is nil then the local flag is set |
| 88 | case notaryclient.ErrNoSuchTarget, notaryclient.ErrRepositoryNotExist, nil: |
| 89 | // Fail fast if the image doesn't exist locally |
| 90 | if err := checkLocalImageExistence(ctx, dockerCLI.Client(), imageName); err != nil { |
| 91 | return err |
| 92 | } |
| 93 | _, _ = fmt.Fprintf(dockerCLI.Err(), "Signing and pushing trust data for local image %s, may overwrite remote trust data\n", imageName) |
| 94 | |
| 95 | authConfig := resolveAuthConfig(dockerCLI.ConfigFile(), imgRefAndAuth.RepoInfo().Index) |
| 96 | encodedAuth, err := authconfig.Encode(authConfig) |
| 97 | if err != nil { |
| 98 | return err |
| 99 | } |
| 100 | responseBody, err := dockerCLI.Client().ImagePush(ctx, reference.FamiliarString(imgRefAndAuth.Reference()), client.ImagePushOptions{ |
| 101 | RegistryAuth: encodedAuth, |
| 102 | PrivilegeFunc: nil, |
no test coverage detected
searching dependent graphs…