-
Notifications
You must be signed in to change notification settings - Fork 54
Signing a bundle now imply resolving image references into immutable references #428
Signing a bundle now imply resolving image references into immutable references #428
Conversation
I am very much in favor of this. |
|
Fixed linting issues. Before merging this, I would also like to add a "--push-local-images" flag to the sign subcommand, leading to a "--push-images-and-sign" kind of flag for the build command. |
/cc @radu-matei |
cmd/duffle/default_user.go
Outdated
@@ -23,6 +24,12 @@ func defaultUserID() signature.UserID { | |||
name = account.Name | |||
username = account.Username | |||
} | |||
// on Windows, account name are prefixed with '<machinename>\' which makes the generated email invalid | |||
// and makes the key user identity parser fail | |||
if ix := strings.Index(username, "\\"); ix != -1 { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah! Glad you caught that. Thanks
PTAL @technosophos |
Rebased and splitted the change to fix user-identity resolution on Windows |
Also add an option to the sign command, to push local images to a registry Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
@simonferquel I went ahead and updated this to fix the conflicts and resolve the repo move. I also updated this todo the following: Updated In summary:
Repeating: When you do a |
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
Signed-off-by: Simon Ferquel <simon.ferquel@docker.com>
@@ -134,6 +135,19 @@ func (b *buildCmd) run() (err error) { | |||
if err := bldr.Build(ctx, app); err != nil { | |||
return err | |||
} | |||
cli := command.NewDockerCli(os.Stdin, os.Stdout, os.Stderr, false) | |||
if err := cli.Initialize(dockerflags.NewClientOptions()); err != nil { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is there a reason we aren't using b.dockerClientOptions
here?
@@ -48,13 +52,20 @@ func newBundleSignCmd(w io.Writer) *cobra.Command { | |||
if err != nil { | |||
return err | |||
} | |||
return sign.signBundle(bundle, secring) | |||
cli := command.NewDockerCli(os.Stdin, os.Stdout, os.Stderr, false) | |||
if err := cli.Initialize(flags.NewClientOptions()); err != nil { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should probably add all the docker CLI flags similar to duffle build
if we're pushing images with duffle bundle sign
.
I'm not a huge fan of the experience of having to push when building or signing bundles. It breaks the most basic first-time user story, which is pasted all across the documentation:
In my opinion this is an incredibly poor user experience and we're going to have a very hard time explaining this to first-time users. My view is that given we know there's a technical limitation with how docker's CLI requires pushing to a registry to compute a digest, we should not merge this and instead focus on replacing the docker driver with buildkit as explained in #563. I feel that users being on-boarded to the project would be more understanding about us holding out for a better solution than shoehorning something in last minute that significantly affects the first-time user experience. |
I've thought a lot about this, because from about almost every technical and usability angle it's a poor story with little defense except for "stuff is this way at the moment". I'm going to suggest that this be closed in favor of something like #563, however tempting it is to move things along. It is just not the right way to do this. I'll leave the PR open for comments for today, but absent a better argument, I'll close it tomorrow morning. (I hate closing PRs on well-submitted code. booo.) |
closing in favour of #563. |
This aims at having signed bundles truly immutable. That means that all referenced images (invocationImages or images) without a digest are modified into digested references:
Signed-off-by: Simon Ferquel simon.ferquel@docker.com