docker-remote 0.4.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6cfe49856e12add82e0b4fa76a42381640b46ab0810a08db03cbd4e6619fa8d5
-  data.tar.gz: d5d7ab9eb55c7d2189ab5127e5b9c03a5e3c2c53a16241e540907cce3158fc72
+  metadata.gz: 7aafe47e42bed5d3cd16a135a0a3a6f771aaceb9c35b796bf0706ec09137814d
+  data.tar.gz: 1c5aa9f0e89a229cbe203f5d535154fcb85fe270df340862200f3a14df5e0789
 SHA512:
-  metadata.gz: 046f4aa7357778f0ded105562fd8ec55e25dc4d012e1c9fcfd01ee4bda47670b26cb83a9fc1bb5f3b4ed625a248af8ea541effceb93e284984c1219baabe634e
-  data.tar.gz: 38cd75b59a2a12e2339fff98a492f97851d28068184dc7b354ef080f70a7e65baf09a5ffe6fc0495d64158e74d58e4826ceec90da75a2ca28535cbbb6d2a8ffd
+  metadata.gz: d2a2c898b5150f0a69e6c42a8c097f5956044201749167a3648a89725f0ae62e2e5e03e9432133f68637325406842c3d529fa3aaed76ac07e19c51d67b569920
+  data.tar.gz: 1306ccd01efe9184963586f0b34bbe0d9b10ea262b9570538b8d234d4024c0e862dfc001cffa1c144b67699e9a231155940ea18fc36ebccf59ae444ad8777ab1

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.7.0
+* Support Azure Container Registry (ACR)
+  - ACR does two things differently than other registries like DockerHub, GitHub, etc:
+    1. OAuth tokens are returned under the `access_token` key instead of `token`.
+    1. The repo:<name>:pull scope is not enough to read metadata like the list of tags. You need the repo:<name>:metadata_read scope instead. Fortunately the www-authenticate header contains the scope you need to perform the operation.
+
+## 0.6.0
+* Raise `UnknownRepoError` if the registry returns the `NAME_UNKNOWN` error code, which indicates the repo has never been pushed to before.
+
+## 0.5.1
+* Just use given port if present, i.e. without checking it for connectivity.
+
+## 0.5.0
+* Figure out registry port more accurately.
+
 ## 0.4.0
 * Support redirection when making HTTP requests.
 

data/lib/docker/remote/auth_info.rb

@@ -0,0 +1,40 @@
+module Docker
+  module Remote
+    class AuthInfo
+      class << self
+        def from_header(header, creds)
+          idx = header.index(' ')
+          auth_type = header[0..idx].strip.downcase
+
+          params = header[idx..-1].split(',').each_with_object({}) do |param, ret|
+            key, value = param.split('=')
+            ret[key.strip] = value.strip[1..-2]  # remove quotes
+          end
+
+          new(auth_type, params, creds)
+        end
+      end
+
+
+      attr_reader :auth_type, :params, :creds
+
+      def initialize(auth_type, params, creds)
+        @auth_type = auth_type
+        @params = params
+        @creds = creds
+      end
+
+      def strategy
+        @strategy ||= case auth_type
+          when 'bearer'
+            BearerAuth.new(self, creds)
+          when 'basic'
+            BasicAuth.new(creds)
+          else
+            raise UnsupportedAuthTypeError,
+              "unsupported Docker auth type '#{auth_type}'"
+        end
+      end
+    end
+  end
+end

data/lib/docker/remote/basic_auth.rb

@@ -3,16 +3,15 @@ require 'net/http'
 module Docker
   module Remote
     class BasicAuth
-      attr_reader :username, :password
+      attr_reader :creds
 
-      def initialize(username, password)
-        @username = username
-        @password = password
+      def initialize(creds)
+        @creds = creds
       end
 
       def make_get(path)
         Net::HTTP::Get.new(path).tap do |request|
-          request.basic_auth(username, password)
+          request.basic_auth(creds.username, creds.password)
         end
       end
     end

data/lib/docker/remote/bearer_auth.rb

@@ -7,13 +7,11 @@ module Docker
     class BearerAuth
       include Utils
 
-      attr_reader :params, :repo, :username, :password
+      attr_reader :auth_info, :creds
 
-      def initialize(params, repo, username, password)
-        @params = params
-        @repo = repo
-        @username = username
-        @password = password
+      def initialize(auth_info, creds)
+        @auth_info = auth_info
+        @creds = creds
       end
 
       def make_get(path)
@@ -25,11 +23,11 @@ module Docker
       private
 
       def realm
-        @realm ||= URI.parse(params['realm'])
+        @realm ||= URI.parse(auth_info.params['realm'])
       end
 
       def service
-        @serivce ||= params['service']
+        @serivce ||= auth_info.params['service']
       end
 
       def token
@@ -37,17 +35,24 @@ module Docker
           http = Net::HTTP.new(realm.host, realm.port)
           http.use_ssl = true if realm.scheme == 'https'
 
+          url_params = { service: service }
+
+          if scope = auth_info.params['scope']
+            url_params[:scope] = scope
+          end
+
           request = Net::HTTP::Get.new(
-            "#{realm.request_uri}?service=#{service}&scope=repository:#{repo}:pull"
+            "#{realm.request_uri}?#{URI.encode_www_form(url_params)}"
           )
 
-          if username && password
-            request.basic_auth(username, password)
+          if creds.username && creds.password
+            request.basic_auth(creds.username, creds.password)
           end
 
           response = http.request(request)
           potentially_raise_error!(response)
-          JSON.parse(response.body)['token']
+          body_json = JSON.parse(response.body)
+          body_json['token'] || body_json['access_token']
         end
       end
     end

data/lib/docker/remote/client.rb

@@ -1,5 +1,6 @@
 require 'json'
 require 'net/http'
+require 'socket'
 require 'uri'
 
 module Docker
@@ -11,13 +12,16 @@ module Docker
     class Client
       include Utils
 
-      attr_reader :registry_url, :repo, :username, :password
+      attr_reader :registry_url, :repo, :creds
+
+      PORTMAP = { 'ghcr.io' => 443 }.freeze
+      DEFAULT_PORT = 443
+      STANDARD_PORTS = [DEFAULT_PORT, 80].freeze
 
       def initialize(registry_url, repo, username = nil, password = nil)
         @registry_url = registry_url
         @repo = repo
-        @username = username
-        @password = password
+        @creds = Credentials.new(username, password)
       end
 
       def tags
@@ -42,14 +46,14 @@ module Docker
 
       def auth
         @auth ||= begin
-          response = get('/v2/', use_auth: nil)
+          response = get('/v2/', use_auth: NoAuth.instance)
 
-          case response.code
-            when '200'
+          case response
+            when Net::HTTPSuccess
               NoAuth.instance
-            when '401'
-              www_auth(response)
-            when '404'
+            when Net::HTTPUnauthorized
+              www_auth(response).strategy
+            when Net::HTTPNotFound
               raise UnsupportedVersionError,
                 "the registry at #{registry_url} doesn't support v2 "\
                   'of the Docker registry API'
@@ -62,25 +66,7 @@ module Docker
       end
 
       def www_auth(response)
-        auth = response['www-authenticate']
-
-        idx = auth.index(' ')
-        auth_type = auth[0..idx].strip
-
-        params = auth[idx..-1].split(',').each_with_object({}) do |param, ret|
-          key, value = param.split('=')
-          ret[key.strip] = value.strip[1..-2]  # remove quotes
-        end
-
-        case auth_type.downcase
-          when 'bearer'
-            BearerAuth.new(params, repo, username, password)
-          when 'basic'
-            BasicAuth.new(username, password)
-          else
-            raise UnsupportedAuthTypeError,
-              "unsupported Docker auth type '#{auth_type}'"
-        end
+        AuthInfo.from_header(response['www-authenticate'], creds)
       end
 
       def get(path, http: registry_http, use_auth: auth, limit: 5)
@@ -88,24 +74,31 @@ module Docker
           raise DockerRemoteError, 'too many redirects'
         end
 
-        request = if use_auth
-          use_auth.make_get(path)
-        else
-          Net::HTTP::Get.new(path)
-        end
-
+        request = use_auth.make_get(path)
         response = http.request(request)
 
         case response
+          when Net::HTTPUnauthorized
+            auth_info = www_auth(response)
+
+            if auth_info.params['error'] == 'insufficient_scope'
+              if auth_info.params.include?('scope')
+                return get(
+                  path,
+                  http: http,
+                  use_auth: auth_info.strategy,
+                  limit: limit - 1
+                )
+              end
+            end
           when Net::HTTPRedirection
             redirect_uri = URI.parse(response['location'])
             redirect_http = make_http(redirect_uri)
             return get(
-              redirect_uri.path, {
-                http: redirect_http,
-                use_auth: use_auth,
-                limit: limit - 1
-              }
+              redirect_uri.path,
+              http: redirect_http,
+              use_auth: use_auth,
+              limit: limit - 1
             )
         end
 
@@ -113,7 +106,28 @@ module Docker
       end
 
       def registry_uri
-        @registry_uri ||= URI.parse(registry_url)
+        @registry_uri ||= begin
+          host_port, *rest = registry_url.split('/')
+          host, orig_port = host_port.split(':')
+
+          port = if orig_port
+            orig_port.to_i
+          elsif prt = PORTMAP[host]
+            prt
+          else
+            STANDARD_PORTS.find do |prt|
+              can_connect?(host, prt)
+            end
+          end
+
+          unless port
+            raise DockerRemoteError,
+              "couldn't determine what port to connect to for '#{registry_url}'"
+          end
+
+          scheme = port == DEFAULT_PORT ? 'https' : 'http'
+          URI.parse("#{scheme}://#{host}:#{port}/#{rest.join('/')}")
+        end
       end
 
       def make_http(uri)
@@ -125,6 +139,49 @@ module Docker
       def registry_http
         @registry_http ||= make_http(registry_uri)
       end
+
+      # Adapted from: https://spin.atomicobject.com/2013/09/30/socket-connection-timeout-ruby/
+      def can_connect?(host, port)
+        # Convert the passed host into structures the non-blocking calls
+        # can deal with
+        addr = Socket.getaddrinfo(host, nil)
+        sockaddr = Socket.pack_sockaddr_in(port, addr[0][3])
+        timeout = 3
+
+        Socket.new(Socket.const_get(addr[0][0]), Socket::SOCK_STREAM, 0).tap do |socket|
+          socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
+
+          begin
+            # Initiate the socket connection in the background. If it doesn't fail
+            # immediately it will raise an IO::WaitWritable (Errno::EINPROGRESS)
+            # indicating the connection is in progress.
+            socket.connect_nonblock(sockaddr)
+
+          rescue IO::WaitWritable
+            # IO.select will block until the socket is writable or the timeout
+            # is exceeded - whichever comes first.
+            if IO.select(nil, [socket], nil, timeout)
+              begin
+                # Verify there is now a good connection
+                socket.connect_nonblock(sockaddr)
+              rescue Errno::EISCONN
+                # Good news everybody, the socket is connected!
+                socket.close
+                return true
+              rescue
+                # An unexpected exception was raised - the connection is no good.
+                socket.close
+              end
+            else
+              # IO.select returns nil when the socket is not ready before timeout
+              # seconds have elapsed
+              socket.close
+            end
+          end
+        end
+
+        false
+      end
     end
   end
 end

data/lib/docker/remote/credentials.rb

@@ -0,0 +1,12 @@
+module Docker
+  module Remote
+    class Credentials
+      attr_reader :username, :password
+
+      def initialize(username, password)
+        @username = username
+        @password = password
+      end
+    end
+  end
+end

data/lib/docker/remote/utils.rb

@@ -1,3 +1,5 @@
+require 'json'
+
 module Docker
   module Remote
     module Utils
@@ -6,6 +8,13 @@ module Docker
           when 401
             raise UnauthorizedError, "401 Unauthorized: #{response.message}"
           when 404
+            json = JSON.parse(response.body) rescue {}
+            error = (json['errors'] || []).first || {}
+
+            if error['code'] == 'NAME_UNKNOWN'
+              raise UnknownRepoError, error['message']
+            end
+
             raise NotFoundError, "404 Not Found: #{response.message}"
         end
 

data/lib/docker/remote/version.rb

@@ -1,5 +1,5 @@
 module Docker
   module Remote
-    VERSION = '0.4.0'
+    VERSION = '0.7.0'
   end
 end

data/lib/docker/remote.rb

@@ -4,13 +4,16 @@ module Docker
     class ServerError < StandardError; end
     class UnauthorizedError < ClientError; end
     class NotFoundError < ClientError; end
+    class UnknownRepoError < ClientError; end
 
     class UnsupportedAuthTypeError < StandardError; end
 
-    autoload :BasicAuth,  'docker/remote/basic_auth'
-    autoload :BearerAuth, 'docker/remote/bearer_auth'
-    autoload :Client,     'docker/remote/client'
-    autoload :NoAuth,     'docker/remote/no_auth'
-    autoload :Utils,      'docker/remote/utils'
+    autoload :AuthInfo,    'docker/remote/auth_info'
+    autoload :BasicAuth,   'docker/remote/basic_auth'
+    autoload :BearerAuth,  'docker/remote/bearer_auth'
+    autoload :Client,      'docker/remote/client'
+    autoload :Credentials, 'docker/remote/credentials'
+    autoload :NoAuth,      'docker/remote/no_auth'
+    autoload :Utils,       'docker/remote/utils'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: docker-remote
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Cameron Dutro
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-11-02 00:00:00.000000000 Z
+date: 2022-02-11 00:00:00.000000000 Z
 dependencies: []
 description: A Ruby client for communicating with the Docker registry API v2.
 email:
@@ -23,9 +23,11 @@ files:
 - Rakefile
 - docker-remote.gemspec
 - lib/docker/remote.rb
+- lib/docker/remote/auth_info.rb
 - lib/docker/remote/basic_auth.rb
 - lib/docker/remote/bearer_auth.rb
 - lib/docker/remote/client.rb
+- lib/docker/remote/credentials.rb
 - lib/docker/remote/no_auth.rb
 - lib/docker/remote/utils.rb
 - lib/docker/remote/version.rb
@@ -47,7 +49,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.22
 signing_key:
 specification_version: 4
 summary: A Ruby client for communicating with the Docker registry API v2.