Skip to content

Commit

Permalink
schema/validator: Punt sha256/sha512 hex-validation to go-digest
Browse files Browse the repository at this point in the history
It's covered this since opencontainers/go-digest@4ca13015 (disallow
upper characters (/A-F/) in hex-encoded portion, 2017-05-12, #34), so
we don't need to do it locally.  Also, use a more specific check for
ignoring unrecognized algorithms, because we don't want to return nil
when go-digest notices an invalid encoding, etc.

Signed-off-by: W. Trevor King <wking@tremily.us>
  • Loading branch information
wking committed Jun 9, 2017
1 parent df6f3c5 commit c1ce45f
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 18 deletions.
1 change: 1 addition & 0 deletions schema/descriptor_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
package schema_test

import (
_ "crypto/sha256"
"strings"
"testing"

Expand Down
21 changes: 3 additions & 18 deletions schema/validator.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ import (
"fmt"
"io"
"io/ioutil"
"regexp"

digest "github.com/opencontainers/go-digest"
"github.com/opencontainers/image-spec/specs-go/v1"
Expand Down Expand Up @@ -125,11 +124,6 @@ func validateManifest(r io.Reader) error {
return nil
}

var (
sha256EncodedRegexp = regexp.MustCompile(`^[a-f0-9]{64}$`)
sha512EncodedRegexp = regexp.MustCompile(`^[a-f0-9]{128}$`)
)

func validateDescriptor(r io.Reader) error {
header := v1.Descriptor{}

Expand All @@ -143,22 +137,13 @@ func validateDescriptor(r io.Reader) error {
return errors.Wrap(err, "descriptor format mismatch")
}

if header.Digest.Validate() != nil {
err = header.Digest.Validate()
if err == digest.ErrDigestUnsupported {
// we ignore unsupported algorithms
fmt.Printf("warning: unsupported digest: %q: %v\n", header.Digest, err)
return nil
}
switch header.Digest.Algorithm() {
case digest.SHA256:
if !sha256EncodedRegexp.MatchString(header.Digest.Hex()) {
return errors.Errorf("unexpected sha256 digest: %q", header.Digest)
}
case digest.SHA512:
if !sha512EncodedRegexp.MatchString(header.Digest.Hex()) {
return errors.Errorf("unexpected sha512 digest: %q", header.Digest)
}
}
return nil
return err
}

func validateIndex(r io.Reader) error {
Expand Down

0 comments on commit c1ce45f

Please sign in to comment.