{"push_id":1867156280,"size":10,"distinct_size":8,"ref":"refs/heads/dockerd-verification","head":"cc7bded665351ef12bfa90cb8fa11cc8ca596e8d","before":"afda1e492768af7ca7deba19f2002f51ce370c3d","commits":[{"sha":"1e26e839ab6c05e0e7fe97d1444407bba3321746","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Log the unrecognized challenges if we don’t recognize any of them\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/image/commits/1e26e839ab6c05e0e7fe97d1444407bba3321746"},{"sha":"80d736b518dba4fe352b3d728ffd8571e01c2eb7","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Merge pull request #308 from mtrmac/unknown-challenge-schemes\n\nLog the unrecognized challenges if we don’t recognize any of them","distinct":false,"url":"https://api.github.com/repos/mtrmac/image/commits/80d736b518dba4fe352b3d728ffd8571e01c2eb7"},{"sha":"fa3de58489e32822f09729d80a864a6e6d4a5e12","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add a comment delineating ostree-specific overrides\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/fa3de58489e32822f09729d80a864a6e6d4a5e12"},{"sha":"2185c0fbaa883f51d54184f4b2610f0583deefa4","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add PolicyContext.IsImageAuthenticated\n\nThis is intended for building larger chains of trust, e.g. verifying\nlayers based on data in the manifest/config.  The policy for other\nlinks in the trust chain (e.g. what to trust about the config or how to\nverify it) is defined by this library, and needs to be handled by the\ncaller.\n\nNOTE: This is not intended as an all-purpose “trust this image” knob; in\nparticular, PolicyContext.IsRunningImageAllowed should be used for the\n“run this image” decision, and the two may return different results!\n(e.g. consider prInsecureAcceptAnything.)\n\nThe tests for the critical PolicyContext.IsImageAuthenticated and\nprSignedBy.isImageAuthenticated mostly duplicate existing\nIsRunningImageAllowed tests (but note the different\nprInsecureAnythingAllowed treatment!); a simple duplication of a\nstraightforward test seems better than either not testing one, or\nbuilding a non-trivial abstraction.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/2185c0fbaa883f51d54184f4b2610f0583deefa4"},{"sha":"755db42f54d18af0756201c894ae00a3fe5b70ed","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add Types.Image.LayerDiffIDs\n\nThis allows building tools to verify uncompressed layers, perhaps when\nthe layers are expanded on a not-quite-trusted filesystems.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/755db42f54d18af0756201c894ae00a3fe5b70ed"},{"sha":"da21a6da04f530f7f6eb44c1646244ec66b78a98","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add types.ImageSource.GetOriginalManifest\n\nThis returns the origina unmodified manifest, which can be used for\nsignature verification but not necessarily to get a workable image.\nIntended as a companion to PolicyContext.IsImageAuthenticated, with a\nbit more scaffolding which will arrive shortly.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/da21a6da04f530f7f6eb44c1646244ec66b78a98"},{"sha":"31b4b969ab96dc8496bbfdf671dfa3e6e228f67a","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add image.UnparsedOriginalFromSource\n\nThis allows using the signature verification code and image parsing on\nthe results of GetOriginalManifest, as long as the caller is fine with\nthe layer data being not available.\n\nNote that UnparsedImage.Manifest() enforces the manifest digest from the\nreference, if any, on both the original and current manifest, so if the\ntwo differ, one of the two would fail.  In practice this is not really\nan issue for us right now, because docker-daemon: is the only transport\nwhere we have a non-trivial GetOriginalManifest, and uploading to\ndocker-daemon is only possible with a name:tag, so GetOriginalManifest\ncan return something only for non-digested references.  (Digested\nreferences could be used for images downloaded via (docker pull),\nbut those wouldn’t have the original manifest avialable.)\n\nBut eventually we might need to solve this somehow.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/31b4b969ab96dc8496bbfdf671dfa3e6e228f67a"},{"sha":"f00d6dd2ce362cfee451346569a3ac45de4b03cb","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Introduce containers/image/docker/daemon/extra\n\n… which allows recording the original manifests and signatures.  Nothing\nuses it yet.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/f00d6dd2ce362cfee451346569a3ac45de4b03cb"},{"sha":"c1a4025a6f77310fb9ebe63dc43b3792d3e2233e","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Use docker/daemon/extra in docker/daemon\n\nUse it in PutSignatures/GetSignatures, and\nPutManifest/GetOriginalManifest.\n\ndocker/tarfile objects now have TarfileConfigDigest() methods to allow\nassociating the extra data without redoing the parsing in docker/daemon.\n\nFIXME: tests, at least for the \"read data\" path\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/c1a4025a6f77310fb9ebe63dc43b3792d3e2233e"},{"sha":"cc7bded665351ef12bfa90cb8fa11cc8ca596e8d","author":{"name":"Miloslav Trmač","email":"eb7b572a3180a08bfc105fe6c1f4dce37ccb851f@redhat.com"},"message":"Add docker/daemon/extra.RecordImage\n\n… usable by external implementations of image pull into the daemon.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":true,"url":"https://api.github.com/repos/mtrmac/image/commits/cc7bded665351ef12bfa90cb8fa11cc8ca596e8d"}]}
{"actor":{"display_login":"mtrmac"}}