Running phase: unpackPhase unpacking source archive /nix/store/94b2i5k17351kyhbcw1l636hbsrm66wy-source source root is source Running phase: patchPhase Running phase: updateAutotoolsGnuConfigScriptsPhase Running phase: configurePhase Running phase: buildPhase diff --git a/image/transports/alltransports/alltransports.go b/image/transports/alltransports/alltransports.go --- a/image/transports/alltransports/alltransports.go +++ b/image/transports/alltransports/alltransports.go @@ -18,6 +18,7 @@ _ "go.podman.io/image/v5/openshift" _ "go.podman.io/image/v5/sif" _ "go.podman.io/image/v5/tarball" + _ "go.podman.io/image/v5/nix" // The docker-daemon transport is registeredy by docker_daemon*.go // The storage transport is registered by storage*.go ) --- /dev/null +++ b/image/nix/transport.go @@ -0,0 +1,206 @@ +package nix + +import ( + "context" + "encoding/json" + "fmt" + "go.podman.io/image/v5/docker/reference" + "go.podman.io/image/v5/image" + "go.podman.io/image/v5/manifest" + "go.podman.io/image/v5/transports" + "go.podman.io/image/v5/types" + "github.com/nlewo/nix2container/nix" + nixtypes "github.com/nlewo/nix2container/types" + digest "github.com/opencontainers/go-digest" + imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1" + "github.com/pkg/errors" + "io" +) + +func init() { + transports.Register(Transport) +} + +// Transport is an ImageTransport for nix2container JSON image specification. +var Transport = nixTransport{} + +type nixTransport struct{} + +func (t nixTransport) Name() string { + return "nix" +} + +type nixReference struct { + path string + nixImage nixtypes.Image +} + +// ParseReference converts a string, which should not start with the ImageTransport.Name prefix, into an ImageReference. +func (t nixTransport) ParseReference(reference string) (types.ImageReference, error) { + nixImage, err := nix.NewImageFromFile(reference) + if err != nil { + return nil, err + } + imageReference := nixReference{ + path: reference, + nixImage: nixImage, + } + return imageReference, nil +} + +// ValidatePolicyConfigurationScope checks that scope is a valid name for a signature.PolicyTransportScopes keys +// (i.e. a valid PolicyConfigurationIdentity() or PolicyConfigurationNamespaces() return value). +// It is acceptable to allow an invalid value which will never be matched, it can "only" cause user confusion. +// scope passed to this function will not be "", that value is always allowed. +func (t nixTransport) ValidatePolicyConfigurationScope(scope string) error { + // See the explanation in archiveReference.PolicyConfigurationIdentity. + return errors.New(`nix: does not support any scopes except the default "" one`) +} + +// StringWithinTransport returns a string representation of the reference, which MUST be such that +// reference.Transport().ParseReference(reference.StringWithinTransport()) returns an equivalent reference. +func (ref nixReference) StringWithinTransport() string { + return fmt.Sprintf("%s", ref.path) +} + +func (ref nixReference) Transport() types.ImageTransport { + return Transport +} + +// DeleteImage deletes the named image from the registry, if supported. +func (ref nixReference) DeleteImage(ctx context.Context, sys *types.SystemContext) error { + return errors.New("Deleting images not implemented for nix: images") +} + +// DockerReference returns a Docker reference associated with this reference +// (fully explicit, i.e. !reference.IsNameOnly, but reflecting user intent, +// not e.g. after redirect or alias processing), or nil if unknown/not applicable. +func (ref nixReference) DockerReference() reference.Named { + return nil +} + +// NewImage returns a types.ImageCloser for this reference, possibly specialized for this ImageTransport. +// The caller must call .Close() on the returned ImageCloser. +// NOTE: If any kind of signature verification should happen, build an UnparsedImage from the value returned by NewImageSource, +// verify that UnparsedImage, and convert it into a real Image via image.FromUnparsedImage. +// WARNING: This may not do the right thing for a manifest list, see image.FromSource for details. +func (ref nixReference) NewImage(ctx context.Context, sys *types.SystemContext) (types.ImageCloser, error) { + src, err := newImageSource(ctx, sys, ref) + if err != nil { + return nil, err + } + return image.FromSource(ctx, sys, src) +} + +// NewImageSource returns a types.ImageSource for this reference. +// The caller must call .Close() on the returned ImageSource. +func (ref nixReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) { + return newImageSource(ctx, sys, ref) +} + +// PolicyConfigurationIdentity returns a string representation of the reference, suitable for policy lookup. +func (ref nixReference) PolicyConfigurationIdentity() string { + return "" +} + +// PolicyConfigurationNamespaces returns a list of other policy configuration namespaces to search +// for if explicit configuration for PolicyConfigurationIdentity() is not set +func (ref nixReference) PolicyConfigurationNamespaces() []string { + return []string{} +} + +// NewImageDestination returns a types.ImageDestination for this reference. +// The caller must call .Close() on the returned ImageDestination. +func (ref nixReference) NewImageDestination(ctx context.Context, sys *types.SystemContext) (types.ImageDestination, error) { + return nil, errors.New("It is not possible to copy to nix: images") +} + +// newImageSource returns an ImageSource for reading from an existing directory. +// newImageSource untars the file and saves it in a temp directory +func newImageSource(ctx context.Context, sys *types.SystemContext, ref nixReference) (types.ImageSource, error) { + return &nixImageSource{ + ref: ref, + }, nil +} + +type nixImageSource struct { + ref nixReference +} + +// Close removes resources associated with an initialized ImageSource, if any. +// Close deletes the temporary directory at dst +func (s *nixImageSource) Close() error { + return nil +} + +func (s *nixImageSource) GetBlob(ctx context.Context, info types.BlobInfo, cache types.BlobInfoCache) (io.ReadCloser, int64, error) { + // TODO: returning the blob size here leads to the following error on image copy: + // FATA[0000] writing blob: archive/tar: write too long + rc, _, err := nix.GetBlob(s.ref.nixImage, info.Digest) + return rc, -1, err +} + +// GetManifest returns the image's manifest along with its MIME type (which may be empty when it can't be determined but the manifest is available). +// It may use a remote (= slow) service. +// If instanceDigest is not nil, it contains a digest of the specific manifest instance to retrieve (when the primary manifest is a manifest list); +// this never happens if the primary manifest is not a manifest list (e.g. if the source never returns manifest lists). +func (s *nixImageSource) GetManifest(ctx context.Context, instanceDigest *digest.Digest) ([]byte, string, error) { + configDigest, size, err := nix.GetConfigDigest(s.ref.nixImage) + if err != nil { + return nil, "", err + } + config := imgspecv1.Descriptor{ + MediaType: imgspecv1.MediaTypeImageConfig, + Size: size, + Digest: configDigest, + } + + var layers []imgspecv1.Descriptor + for _, layer := range s.ref.nixImage.Layers { + digest, err := digest.Parse(layer.Digest) + if err != nil { + return nil, "", err + } + layers = append(layers, imgspecv1.Descriptor{ + MediaType: layer.MediaType, + Size: layer.Size, + Digest: digest, + }) + } + + m := manifest.OCI1FromComponents( + config, + layers, + ) + manifestBytes, err := json.Marshal(&m) + if err != nil { + return nil, "", err + } + return manifestBytes, imgspecv1.MediaTypeImageManifest, nil +} + +func (s *nixImageSource) GetSignatures(ctx context.Context, instanceDigest *digest.Digest) ([][]byte, error) { + return [][]byte{}, nil +} + +// HasThreadSafeGetBlob indicates whether GetBlob can be executed concurrently. +func (s *nixImageSource) HasThreadSafeGetBlob() bool { + return true +} + +// LayerInfosForCopy returns either nil (meaning the values in the manifest are fine), or updated values for the layer +// blobsums that are listed in the image's manifest. If values are returned, they should be used when using GetBlob() +// to read the image's layers. +// If instanceDigest is not nil, it contains a digest of the specific manifest instance to retrieve BlobInfos for +// (when the primary manifest is a manifest list); this never happens if the primary manifest is not a manifest list +// (e.g. if the source never returns manifest lists). +// The Digest field is guaranteed to be provided; Size may be -1. +// WARNING: The list may contain duplicates, and they are semantically relevant. +func (s *nixImageSource) LayerInfosForCopy(ctx context.Context, instanceDigest *digest.Digest) ([]types.BlobInfo, error) { + return nil, nil +} + +// Reference returns the reference used to set up this source. +func (s *nixImageSource) Reference() types.ImageReference { + return s.ref +} patching file transports/alltransports/alltransports.go patching file nix/transport.go /build/source patching script interpreter paths in . ./contrib/cirrus/runner.sh: interpreter directive changed from "#!/bin/bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./contrib/cirrus/mac_cleanup.sh: interpreter directive changed from "#!/bin/bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./systemtest/run-tests: interpreter directive changed from "#!/bin/bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./systemtest/make-noarch-manifest: interpreter directive changed from "#!/bin/sh" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/sh" ./hack/tree_status.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/man-page-checker: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/warn-destructive-tests.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/sqlite_tag.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/btrfs_installed_tag.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/validate-git-marks.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/test-system.sh: interpreter directive changed from "#!/bin/bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/validate-vet.sh: interpreter directive changed from "#!/bin/bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" ./hack/libsubid_tag.sh: interpreter directive changed from "#!/usr/bin/env bash" to "/nix/store/nnm9gdr70ihc6zc9298mzz8jpcgaciql-bash-5.3p20/bin/bash" go build "-buildmode=pie" -ldflags '-X go.podman.io/image/v5/signature/internal/sequoia.sequoiaLibraryDir= ' -gcflags "" -tags " " -o bin/skopeo ./cmd/skopeo sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-copy.1.md | go-md2man -in /dev/stdin -out docs/skopeo-copy.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-delete.1.md | go-md2man -in /dev/stdin -out docs/skopeo-delete.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-generate-sigstore-key.1.md | go-md2man -in /dev/stdin -out docs/skopeo-generate-sigstore-key.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-inspect.1.md | go-md2man -in /dev/stdin -out docs/skopeo-inspect.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-list-tags.1.md | go-md2man -in /dev/stdin -out docs/skopeo-list-tags.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-login.1.md | go-md2man -in /dev/stdin -out docs/skopeo-login.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-logout.1.md | go-md2man -in /dev/stdin -out docs/skopeo-logout.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-manifest-digest.1.md | go-md2man -in /dev/stdin -out docs/skopeo-manifest-digest.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-standalone-sign.1.md | go-md2man -in /dev/stdin -out docs/skopeo-standalone-sign.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-standalone-verify.1.md | go-md2man -in /dev/stdin -out docs/skopeo-standalone-verify.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo-sync.1.md | go-md2man -in /dev/stdin -out docs/skopeo-sync.1 sed -e 's/\((skopeo.*\.md)\)//' -e 's/\[\(skopeo.*\)\]/\1/' docs/skopeo.1.md | go-md2man -in /dev/stdin -out docs/skopeo.1 go build "-buildmode=pie" -ldflags '-X go.podman.io/image/v5/signature/internal/sequoia.sequoiaLibraryDir= ' -gcflags "" -tags " " -o bin/skopeo ./cmd/skopeo install -d -m 755 completions/bash completions/zsh completions/fish completions/powershell ./bin/skopeo completion bash >| completions/bash/skopeo ./bin/skopeo completion zsh >| completions/zsh/_skopeo ./bin/skopeo completion fish >| completions/fish/skopeo.fish ./bin/skopeo completion powershell >| completions/powershell/skopeo.ps1 buildPhase completed in 3 minutes 4 seconds Running phase: glibPreInstallPhase Running phase: installPhase go build "-buildmode=pie" -ldflags '-X go.podman.io/image/v5/signature/internal/sequoia.sequoiaLibraryDir= ' -gcflags "" -tags " " -o bin/skopeo ./cmd/skopeo install -d -m 755 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/bin install -m 755 bin/skopeo /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/bin/skopeo install -d -m 755 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/man/man1 install -m 644 docs/*.1 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/man/man1 go build "-buildmode=pie" -ldflags '-X go.podman.io/image/v5/signature/internal/sequoia.sequoiaLibraryDir= ' -gcflags "" -tags " " -o bin/skopeo ./cmd/skopeo install -d -m 755 completions/bash completions/zsh completions/fish completions/powershell ./bin/skopeo completion bash >| completions/bash/skopeo ./bin/skopeo completion zsh >| completions/zsh/_skopeo ./bin/skopeo completion fish >| completions/fish/skopeo.fish ./bin/skopeo completion powershell >| completions/powershell/skopeo.ps1 install -d -m 755 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/bash-completion/completions install -m 644 completions/bash/skopeo /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/bash-completion/completions install -d -m 755 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/zsh/site-functions install -m 644 completions/zsh/_skopeo /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/zsh/site-functions install -d -m 755 /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/fish/vendor_completions.d install -m 644 completions/fish/skopeo.fish /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/fish/vendor_completions.d # There is no common location for powershell files so do not install them. Users have to source the file from their powershell profile. Running phase: fixupPhase Moving /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/share/man to /nix/store/lbpjwwvi815g344w53ccx31a0p2bh6zc-skopeo-1.24.1-man/share/man shrinking RPATHs of ELF executables and libraries in /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1 shrinking /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/bin/.skopeo-wrapped checking for references to /build/ in /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1... patching script interpreter paths in /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1 stripping (with command strip and flags -S -p) in /nix/store/g6aa427516zqih45xylxrmigrcfh0jzq-skopeo-1.24.1/bin shrinking RPATHs of ELF executables and libraries in /nix/store/lbpjwwvi815g344w53ccx31a0p2bh6zc-skopeo-1.24.1-man checking for references to /build/ in /nix/store/lbpjwwvi815g344w53ccx31a0p2bh6zc-skopeo-1.24.1-man... gzipping man pages under /nix/store/lbpjwwvi815g344w53ccx31a0p2bh6zc-skopeo-1.24.1-man/share/man/ patching script interpreter paths in /nix/store/lbpjwwvi815g344w53ccx31a0p2bh6zc-skopeo-1.24.1-man