Documentation
¶
Overview ¶
Package source fetches, unpacks and detects install media referenced by a local path or an http(s) URL, presenting each as a read-only io/fs.FS.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SafeURL ¶
SafeURL returns rawURL with any userinfo (username and/or password) and any query or fragment stripped, safe to fold into an error message, a log line, or a recorded manifest. Basic auth is normally attached out-of-band via creds.apply, never embedded in the URL itself, but this is defense in depth against a caller (or a redirect) that does embed one; the query is stripped too since a bearer token or signed-URL secret travels there just as often as in userinfo. If rawURL fails to parse, the raw string is not echoed back either — it could itself carry credentials — so a fixed placeholder is returned instead.
Types ¶
type Credential ¶
type Credential struct {
Host, Username, Password string
}
Credential is HTTP Basic auth for one host, scoped to https requests only.
type Credentials ¶
type Credentials []Credential
Credentials is a set of host-matched credentials, tried in order.
type Options ¶
type Options struct {
CacheDir string
Credentials Credentials
Client *http.Client
}
Options configures a Resolver: where fetched archives are cached, the credentials offered to https hosts, and the HTTP client to fetch with (http.DefaultClient when nil).
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver turns a source reference - a local path or an http(s) URL - into a vfs.Resolved: the read-only filesystem it serves, whether that is an EFS image or an extracted directory, and the closer that frees it. It satisfies vfs.Resolver.
func New ¶
New returns a Resolver configured by opts. A nil opts.Client defaults to http.DefaultClient.
Both the range reader and grab share one derived *http.Client. It is built fresh rather than mutating opts.Client (often the shared http.DefaultClient), keeping the caller's transport and cookie jar but adding two safeguards: a CheckRedirect that never forwards credentials across a host boundary, and, when the caller supplied no transport, a response-header timeout so a hung server fails fast instead of blocking Resolve forever.
func (*Resolver) Resolve ¶
Resolve turns ref into a read-only filesystem. sha256hex, when non-empty, is the layer's expected digest. Verifying it requires reading the whole object, so an archive or a raw image with a digest is fetched whole and hashed before use. It is ignored for a local source; a raw image with no digest is read lazily by byte-range, where a partial read cannot be hashed.
Source Files