manifest

Documentation

Index

• Constants
• Variables
• func Digest(manifest []byte) (string, error)
• func GuessMIMEType(manifest []byte) string
• func MatchesDigest(manifest []byte, expectedDigest string) (bool, error)

Constants

const (
	// DockerV2Schema1MIMEType MIME type represents Docker manifest schema 1
	DockerV2Schema1MIMEType = "application/vnd.docker.distribution.manifest.v1+json"
	// DockerV2Schema1MIMEType MIME type represents Docker manifest schema 1 with a JWS signature
	DockerV2Schema1SignedMIMEType = "application/vnd.docker.distribution.manifest.v1+prettyjws"
	// DockerV2Schema2MIMEType MIME type represents Docker manifest schema 2
	DockerV2Schema2MIMEType = "application/vnd.docker.distribution.manifest.v2+json"
	// DockerV2ListMIMEType MIME type represents Docker manifest schema 2 list
	DockerV2ListMIMEType = "application/vnd.docker.distribution.manifest.list.v2+json"
)

FIXME(runcom, mitr): should we havea mediatype pkg??

Variables

var DefaultRequestedManifestMIMETypes = []string{
	imgspecv1.MediaTypeImageManifest,
	DockerV2Schema2MIMEType,
	DockerV2Schema1SignedMIMEType,
	DockerV2Schema1MIMEType,
}

DefaultRequestedManifestMIMETypes is a list of MIME types a types.ImageSource should request from the backend unless directed otherwise.

Functions

func Digest

func Digest(manifest []byte) (string, error)

Digest returns the a digest of a docker manifest, with any necessary implied transformations like stripping v1s1 signatures.

func GuessMIMEType

func GuessMIMEType(manifest []byte) string

GuessMIMEType guesses MIME type of a manifest and returns it _if it is recognized_, or "" if unknown or unrecognized. FIXME? We should, in general, prefer out-of-band MIME type instead of blindly parsing the manifest, but we may not have such metadata available (e.g. when the manifest is a local file).

func MatchesDigest

func MatchesDigest(manifest []byte, expectedDigest string) (bool, error)

MatchesDigest returns true iff the manifest matches expectedDigest. Error may be set if this returns false. Note that this is not doing ConstantTimeCompare; by the time we get here, the cryptographic signature must already have been verified, or we are not using a cryptographic channel and the attacker can modify the digest along with the manifest blob.