vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add flag to enable trust per repo (#2541)

Browse source 
* Add flag to enable trust per repo

* Add api for enabling/disabling trust

* Add new LogEntryKind for changing repo trust settings
Also add tests for repo trust api

* Add `set_trust` method to repository

* Expose new logkind to UI

* Fix registry tests

* Rebase migrations and regen test.db

* Raise downstreamissue if trust metadata can't be removed

* Refactor change_repo_trust

* Add show_if to change_repo_trust endpoint
This commit is contained in:
Evan Cordell 2017-04-15 08:26:33 -04:00 • committed by GitHub
parent aa1c8d47dd
commit 2661db7485
13 changed files with 176 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
endpoints/v2/v2auth.py
View file

@ -4,6 +4,7 @@ import re
from cachetools import lru_cache
from flask import request, jsonify, abort
import features
from app import app, userevents, instance_keys
from auth.auth_context import get_authenticated_user, get_validated_token, get_validated_oauth_token
from auth.decorators import process_basic_auth
@ -15,7 +16,8 @@ from endpoints.v2.errors import InvalidLogin, NameInvalid, InvalidRequest, Unsup
from data.interfaces.v2 import pre_oci_model as model
from util.cache import no_cache
from util.names import parse_namespace_repository, REPOSITORY_NAME_REGEX
from util.security.registry_jwt import generate_bearer_token, build_context_and_subject, QUAY_TUF_ROOT, SIGNER_TUF_ROOT
from util.security.registry_jwt import (generate_bearer_token, build_context_and_subject, QUAY_TUF_ROOT,
SIGNER_TUF_ROOT, DISABLED_TUF_ROOT)
logger = logging.getLogger(__name__)
@ -64,7 +66,7 @@ def generate_registry_jwt(auth_result):
user_event_data = {
'action': 'login',
}
tuf_root = QUAY_TUF_ROOT
tuf_root = DISABLED_TUF_ROOT
if len(scope_param) > 0:
match = get_scope_regex().match(scope_param)
@ -164,8 +166,7 @@ def generate_registry_jwt(auth_result):
'repository': reponame,
'namespace': namespace,
}
tuf_root = get_tuf_root(namespace, reponame)
tuf_root = get_tuf_root(repo, namespace, reponame)
elif user is None and token is None:
# In this case, we are doing an auth flow, and it's not an anonymous pull
@ -184,7 +185,10 @@ def generate_registry_jwt(auth_result):
return jsonify({'token': token})
def get_tuf_root(namespace, reponame):
def get_tuf_root(repo, namespace, reponame):
if not features.SIGNING or repo is None or not repo.trust_enabled:
return DISABLED_TUF_ROOT
# Users with write access to a repo will see signer-rooted TUF metadata
if ModifyRepositoryPermission(namespace, reponame).can():
return SIGNER_TUF_ROOT