Documentation
¶
Overview ¶
Package registryfixture owns the bounded Linux registry/proxy and helper fixtures used by native provider-consumer tests.
Index ¶
- Constants
- func CredentialHelperMain(args []string, stdin io.Reader, stdout, stderr io.Writer) int
- func DispatchCredentialHelper() (handled bool, exitCode int)
- func IsCredentialHelperInvocation(argv0 string) bool
- type Config
- type CredentialConfig
- type CredentialObservation
- type ProcessIdentity
- type Request
- type Server
- type Snapshot
Constants ¶
const ( // #nosec G101 -- This is an environment variable name, not a credential value. CredentialConfigEnv = "CASE_A_CREDENTIAL_CONFIG" // #nosec G101 -- This is an environment variable name, not a credential value. CredentialLogEnv = "CASE_A_CREDENTIAL_OBSERVATIONS" // #nosec G101 -- This is an environment variable name, not a credential value. CredentialRootEnv = "CASE_A_CREDENTIAL_ROOT" CredentialOperationEnv = "CASE_A_OPERATION_ID" HelperBinaryName = "docker-credential-fixture" )
const RegistryHost = "registry.invalid"
Variables ¶
This section is empty.
Functions ¶
func CredentialHelperMain ¶
CredentialHelperMain implements Docker's credential-helper `get` wire protocol. The input is recorded only as an owned server key and parent PID; the secret is read from a private fixture file and never logged.
func DispatchCredentialHelper ¶
DispatchCredentialHelper runs the helper only for the fixed private-root path when it resolves to the current executable. handled is false for the normal test-binary invocation.
func IsCredentialHelperInvocation ¶
IsCredentialHelperInvocation recognizes only the fixed helper path under the configured private root, when it resolves to this running test binary.
Types ¶
type CredentialConfig ¶
type CredentialConfig struct {
OperationID string `json:"operation_id"`
ServerKey string `json:"server_key"`
Username string `json:"username,omitempty"`
Secret string `json:"secret,omitempty"`
CredentialsAvailable bool `json:"credentials_available"`
ExpectedProviderSHA256 string `json:"expected_provider_sha256"`
}
CredentialConfig fields are stored only in the private fixture root.
func ReadCredentialConfig ¶
func ReadCredentialConfig(root, path string) (CredentialConfig, error)
ReadCredentialConfig reads a validated private fixture config. The path must be a direct child of a canonical, current-user-owned mode-0700 root.
type CredentialObservation ¶
type CredentialObservation struct {
OperationID string `json:"operation_id"`
ServerKey string `json:"server_key"`
Action string `json:"action"`
Parent ProcessIdentity `json:"parent"`
Outcome string `json:"outcome"`
}
CredentialObservation contains secret-free helper invocation evidence.
type ProcessIdentity ¶
type ProcessIdentity struct {
PID int `json:"pid"`
StartTimeTicks uint64 `json:"start_time_ticks"`
Executable string `json:"executable"`
SHA256 string `json:"sha256"`
}
ProcessIdentity records a live process identity without cmdline or env.
type Request ¶
type Request struct {
Method string `json:"method"`
Path string `json:"path"` // normalized route class, never the raw URL
Status int `json:"status"`
Authenticated bool `json:"authenticated"`
Bytes int64 `json:"bytes"`
BodyDigest string `json:"body_digest,omitempty"`
Digest string `json:"docker_content_digest,omitempty"`
}
type Server ¶
type Server struct {
Authority string
ProxyURL string
CAPEM []byte
Username string
Password string
// contains filtered or unexported fields
}
Server owns one TLS registry listener and one CONNECT listener. The proxy accepts only the exact registry authority and dials the owned listener IP; it never resolves or forwards caller-selected destinations.
type Snapshot ¶
type Snapshot struct {
ConnectAllowed int `json:"connect_allowed"`
ConnectDenied int `json:"connect_denied"`
Authenticated int `json:"authenticated_requests"`
AuthRejected int `json:"auth_rejected_requests"`
Completed int `json:"completed_responses"`
ManifestGets int `json:"manifest_gets"`
BlobGets int `json:"blob_gets"`
ResponseBytes int64 `json:"response_bytes"`
Requests []Request `json:"requests"`
}
Source Files