Documentation
¶
Overview ¶
Package reg implements puboci.StateReader, puboci.ContentPusher, and puboci.TagCommitter with oras-go.
New builds a registry client for tag reads, digest-addressed writes, and serial tag commits. Token text is applied only when building a per-request authenticated transport and is never stored in a formattable field or included in returned errors. Resolve, Version, PushBlob, PushManifest, Verify, and Commit classify registry failures as absent, auth, retryable, or corrupt. An already-present blob or manifest is success. Client.Commit applies tags one at a time and verifies each write before the next starts.
Index ¶
- type Client
- func (c *Client) Commit(ctx context.Context, image puboci.Image, digest rel.Digest, tags []rel.Tag) error
- func (c *Client) PushBlob(ctx context.Context, image puboci.Image, descriptor puboci.Descriptor, ...) error
- func (c *Client) PushManifest(ctx context.Context, image puboci.Image, descriptor puboci.Descriptor, ...) error
- func (c *Client) Resolve(ctx context.Context, ref puboci.Reference) (rel.Digest, error)
- func (c *Client) Verify(ctx context.Context, ref puboci.DigestRef) error
- func (c *Client) Version(ctx context.Context, ref puboci.Reference) (rel.Version, error)
- type Credentials
- type Options
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client reads tag state, pushes digest-addressed content, and commits tags.
It implements puboci.StateReader, puboci.ContentPusher, and puboci.TagCommitter. Credential material is captured inside the auth client's closure and is not stored on this value.
func New ¶
New constructs a Client from options.
A nil HTTPClient selects retry.DefaultClient. When credentials are present, rel.Secret.Reveal is called once and the token is captured only inside the auth credential closure.
func (*Client) Commit ¶
func (c *Client) Commit( ctx context.Context, image puboci.Image, digest rel.Digest, tags []rel.Tag, ) error
Commit applies tags to digest serially, verifying each one.
Commit implements puboci.TagCommitter. image@digest is resolved once. Each tag is then written with oras and checked to resolve back to digest before the next write starts. An empty tags slice is success and performs no registry calls after input checks. The first failure stops the sequence and reports the failing tag and how many tags were already applied. Absent content wraps puboci.ErrTagAbsent. Transient registry failures wrap puboci.ErrRetryable.
func (*Client) PushBlob ¶
func (c *Client) PushBlob( ctx context.Context, image puboci.Image, descriptor puboci.Descriptor, content io.Reader, ) error
PushBlob implements puboci.ContentPusher.
Content is streamed to the registry and is never buffered. An already-present blob is success so a retry of a partial publication can converge.
func (*Client) PushManifest ¶
func (c *Client) PushManifest( ctx context.Context, image puboci.Image, descriptor puboci.Descriptor, content io.Reader, ) error
PushManifest implements puboci.ContentPusher.
The registry stores content under descriptor.MediaType. An already-present manifest is success. Unlike Client.PushBlob, the authenticated oras manifest path may buffer the document in memory before the request.
func (*Client) Resolve ¶
Resolve implements puboci.StateReader.
func (*Client) Verify ¶
Verify implements puboci.ContentPusher.
Missing content wraps puboci.ErrTagAbsent. A different resolved digest is a verification failure and is not classified as absent.
type Credentials ¶
type Credentials struct {
// Username is the registry user. An empty username with a password is
// valid for token auth.
Username string
// Password is the registry password or token. Reveal it only when
// composing the oras credential.
Password rel.Secret
}
Credentials is a registry username and password.
A zero value is anonymous. Password is a rel.Secret so token text is not printed, logged, or encoded.
type Options ¶
type Options struct {
// Credentials authenticates registry requests. The zero value is anonymous.
Credentials Credentials
// PlainHTTP forces HTTP instead of HTTPS. Tests use this against a
// local registry.
PlainHTTP bool
// HTTPClient is the optional transport. Nil selects
// [retry.DefaultClient]. An injected client is used as-is so tests stay
// deterministic.
HTTPClient *http.Client
}
Options configures a registry Client.
Source Files
Directories