image

type AdditionalMetadata func(*Image) error

type ErrPlatformMismatch struct {
	ExpectedPlatform string
	Err              error
}

type FileCatalog struct {
	*sync.RWMutex
	filetree.Index
	// contains filtered or unexported fields
}

type FileCatalogReader interface {
	Layer(file.Reference) *Layer
	Open(file.Reference) (io.ReadCloser, error)
	filetree.IndexReader
}

type Image struct {

	// Metadata contains select image attributes
	Metadata Metadata
	// Layers contains the rich layer objects in build order
	Layers []*Layer
	// FileCatalog contains all file metadata for all files in all layers
	FileCatalog FileCatalogReader

	SquashedSearchContext filetree.Searcher
	// contains filtered or unexported fields
}

type Layer struct {

	// Metadata contains select layer attributes
	Metadata LayerMetadata
	// Tree is a filetree that represents the structure of the layer tar contents ("diff tree"). It keeps this
	// layer's whiteout entries, since a merge reads them off the upper tree to know what to remove.
	Tree filetree.Reader
	// SquashedTree is a filetree that represents the combination of this layers diff tree and all diff trees
	// in lower layers relative to this one. It never contains whiteout entries: those are changeset metadata
	// and do not materialize as files in an applied rootfs. It is set for every layer once the image is read.
	// Below the top layer of an image read with WithLazyLayerSquashes it is built on first use, so it is
	// not a *filetree.FileTree and its first call can take a while (see WithLazyLayerSquashes).
	SquashedTree filetree.Reader

	// SquashedSearchContext searches SquashedTree. Over a lazy SquashedTree it is lazy too: neither the tree
	// nor the search context's link index is built until the first search.
	SquashedSearchContext filetree.Searcher
	SearchContext         filetree.Searcher
	// contains filtered or unexported fields
}

type LayerMetadata struct {
	Index uint
	// Digest is the layer's diff ID: the sha256 of the uncompressed layer contents. Taken from the
	// image config's rootfs.diff_ids when it lists exactly one per layer (as ggcr itself does for
	// registry and docker images), otherwise computed from the layer. It is what the image claims
	// about its contents, not a verification of them.
	Digest    string
	MediaType v1Types.MediaType
	// Size in bytes of the layer content size
	Size int64
}

type Metadata struct {
	// ID is the sha256 of this image config json (not manifest)
	ID string
	// Size in bytes of all the image layer content sizes (does not include config / manifest / index metadata sizes)
	Size      int64
	Config    v1.ConfigFile
	MediaType v1Types.MediaType
	// --- below fields are optional metadata
	Tags           []name.Tag
	RawManifest    []byte
	ManifestDigest string
	RawConfig      []byte
	RepoDigests    []string
	Architecture   string
	Variant        string
	OS             string
}

type Platform struct {
	// Architecture field specifies the CPU architecture, for example
	// `amd64` or `ppc64`.
	Architecture string `json:"architecture"`

	// OS specifies the operating system, for example `linux` or `windows`.
	OS string `json:"os"`

	// Variant is an optional field specifying a variant of the CPU, for
	// example `v7` to specify ARMv7 when architecture is `arm`.
	Variant string `json:"variant,omitempty"`
}

type Provider interface {
	Name() string
	Provide(context.Context) (*Image, error)
}

type RegistryCredentials struct {
	Authority string
	Username  string
	Password  string
	Token     string

	// Explicitly pass in the Authenticator, allowing for things like
	// k8schain to be passed through explicitly.
	Authenticator authn.Authenticator

	// MTLS configuration
	ClientCert string
	ClientKey  string
}

type RegistryOptions struct {
	InsecureSkipTLSVerify bool
	InsecureUseHTTP       bool
	Credentials           []RegistryCredentials
	Keychain              authn.Keychain
	CAFileOrDir           string

	// DisableBlobResume turns off resuming a registry blob download from where it stopped when the
	// connection drops partway through, so the layer fails outright instead. Resuming is on by
	// default, and applies to the OCI registry provider only. It also turns off what comes with it:
	// a read that receives nothing for two minutes is treated as a drop, and the first resume of a
	// pull pings and authenticates against the registry again.
	//
	// The idle clock is the part worth knowing, since it is the one piece that changes a pull which
	// previously only ran slowly: a registry that pauses longer than that mid-blob is reopened rather
	// than waited on. One that then ignores the range costs a re-download of what had already
	// arrived, and one that refuses it outright (a 416, say) fails the layer where waiting would have
	// finished it. Two minutes is picked to sit well above a pull-through cache filling from upstream.
	//
	// Note that this is a Go API only: syft, grype and anchorectl would each need to plumb a config
	// key through before an operator meeting such a registry could reach it.
	DisableBlobResume bool
}

type Source = string