oci

func AppendGitMetadata ¶

func AppendGitMetadata(parent context.Context, repoPath string, annotations map[string]string)

AppendGitMetadata fills missing creation, source, and revision annotations. Creation uses SOURCE_DATE_EPOCH before Git commit time; Git failures and cancellations are ignored.

func BuildArtifact ¶

func BuildArtifact(dstFile, contentPath string, ignorePaths []string) error

BuildArtifact creates the destination file and packages the given content (excluding symlinks) using tar+gzip compression.

func ListArtifactTags ¶

func ListArtifactTags(ociURL string, withDigest bool, opts []crane.Option) ([]apiv1.ArtifactReference, error)

ListArtifactTags performs the following operations: - fetches the digest of the latest tag (if it exists) - lists all the tags from the artifact repository - fetches the digest of each tag (if configured to do so) - returns an array of ArtifactReference objects

func ListModuleVersions ¶

func ListModuleVersions(ociURL string, withDigest bool, opts []crane.Option) ([]apiv1.ModuleReference, error)

ListModuleVersions performs the following operations: - lists all the tags from to this module repository - filters and orders the tags based on semver - fetches the digest of the latest version - fetches the digest of each version (if configured to do so) - returns an array of ModuleReference objects

func Options ¶

func Options(ctx context.Context, credentials string, insecure bool) []crane.Option

Options returns the crane options for the given context.

func ParseAnnotations ¶

func ParseAnnotations(args []string) (map[string]string, error)

ParseAnnotations parses key=value pairs and preserves additional equals signs in values.

func ParseArtifactURL ¶

func ParseArtifactURL(ociURL string) (string, error)

ParseArtifactURL validates the OpenContainers URL and returns the address of the artifact.

func ParseDigest ¶

func ParseDigest(ociURL string) (name.Digest, error)

ParseDigest extracts the digest from the OpenContainers URL.

func ParseRepositoryURL ¶

func ParseRepositoryURL(ociURL string) (string, error)

ParseRepositoryURL validates the OpenContainers URL and returns the address of the artifact repository.

func PullArtifact ¶

func PullArtifact(ociURL, dstPath, contentType string, opts []crane.Option) error

PullArtifact performs the following operations: - fetches the manifest of the remote artifact - verifies that artifact config matches Timoni's media type - download all the compressed layer matching Timoni's media type - extracts the layers contents to the destination directory

func PullModule ¶

func PullModule(ociURL, dstPath, cacheDir string, opts []crane.Option) (*apiv1.ModuleReference, error)

PullModule performs the following operations: - fetches the manifest of the remote artifact - computes the artifact digest from the fetched manifest - verifies that artifact config matches Timoni's media type - downloads all compressed layers matching Timoni's media type (if not cached) - atomically stores the compressed layers in the local cache (if caching is enabled) - extracts the module contents to the destination directory

func PushArtifact ¶

func PushArtifact(ociURL, contentPath string, ignorePaths []string, contentType string, annotations map[string]string, opts []crane.Option) (result string, err error)

PushArtifact builds and pushes a single-layer OCI artifact, then returns its digest URL.

func PushModule ¶

func PushModule(ociURL, contentPath string, ignorePaths []string, annotations map[string]string, opts []crane.Option) (result string, err error)

PushModule builds and pushes ordered vendor and module layers, then returns the module's digest URL.

func ResolveDigestURL ¶ added in v0.30.0

func ResolveDigestURL(ociURL string, opts []crane.Option) (string, error)

ResolveDigestURL resolves an OpenContainers URL to its immutable digest form. A URL that already refers to a digest is returned unchanged.

Callers that both verify and fetch an artifact resolve the reference once with this function and use the result for every operation, so that a tag pointing somewhere else on a later request cannot substitute the artifact between the verification and the fetch.

func SignArtifact ¶

func SignArtifact(ctx context.Context, log logr.Logger, provider string, ociURL string, keyRef string, insecure bool, credentials string) error

SignArtifact validates the provider and signs an OpenContainers artifact with the requested registry credentials and transport.

func SignCosign ¶

func SignCosign(ctx context.Context, log logr.Logger, imageRef string, keyRef string, insecure bool, credentials string) (retErr error)

SignCosign signs an image with the requested registry credentials and transport.

func TagArtifact ¶

func TagArtifact(ociURL, tag string, opts []crane.Option) error

TagArtifact validates and adds the tag to the remote OpenContainers artifact.

func ValidateSigningProvider ¶ added in v0.28.0

func ValidateSigningProvider(provider string) error

ValidateSigningProvider reports whether the signing provider is supported and available.

func ValidateTag ¶ added in v0.28.0

func ValidateTag(tag string) error

ValidateTag reports whether tag follows the OCI Distribution tag grammar.

func ValidateVerificationProvider ¶ added in v0.29.0

func ValidateVerificationProvider(provider string) error

ValidateVerificationProvider reports whether the verification provider is supported and available.

func VerifyArtifact ¶

func VerifyArtifact(ctx context.Context, log logr.Logger, provider string, ociURL string, keyRef string, certIdentity string, certIdentityRegexp string, certOidcIssuer string, certOidcIssuerRegexp string, insecure bool, credentials string) error

VerifyArtifact validates the provider and verifies an OpenContainers artifact with the requested registry credentials and transport.

func VerifyCosign ¶

func VerifyCosign(ctx context.Context, log logr.Logger, imageRef string, keyRef string,
	certIdentity string, certIdentityRegexp string, certOidcIssuer string, certOidcIssuerRegexp string,
	insecure bool, credentials string) (retErr error)

VerifyCosign verifies an image and optionally permits insecure registry transport. Keyless flows require an identity and an OIDC issuer or their regular-expression alternatives.

func WriteImage ¶ added in v0.28.0

func WriteImage(image gcrv1.Image, destination string, format LocalFormat, references []string) error

WriteImage validates and writes an image to a new OCI layout or archive. References become OCI layout descriptor names and must use Timoni's local syntax.