diff --git a/data/registry_model/datatypes.py b/data/registry_model/datatypes.py
index 224beae26..4ec21d68e 100644
--- a/data/registry_model/datatypes.py
+++ b/data/registry_model/datatypes.py
@@ -7,8 +7,10 @@ from cachetools import lru_cache
from data import model
from data.registry_model.datatype import datatype, requiresinput, optionalinput
+from image.docker import ManifestException
from image.docker.schemas import parse_manifest_from_bytes
from image.docker.schema1 import DOCKER_SCHEMA1_SIGNED_MANIFEST_CONTENT_TYPE
+from image.docker.schema2 import DOCKER_SCHEMA2_MANIFESTLIST_CONTENT_TYPE
class RepositoryReference(datatype('Repository', [])):
@@ -138,6 +140,13 @@ class Tag(datatype('Tag', ['name', 'reversion', 'manifest_digest', 'lifetime_sta
""" Returns the manifest for this tag. Will only apply to new-style OCI tags. """
return manifest
+ @property
+ @optionalinput('manifest')
+ def manifest(self, manifest):
+ """ Returns the manifest for this tag or None if none. Will only apply to new-style OCI tags.
+ """
+ return Manifest.for_manifest(manifest, self.legacy_image_if_present)
+
@property
@requiresinput('repository')
def repository(self, repository):
@@ -202,6 +211,21 @@ class Manifest(datatype('Manifest', ['digest', 'media_type', 'manifest_bytes']))
""" Returns the parsed manifest for this manifest. """
return parse_manifest_from_bytes(self.manifest_bytes, self.media_type, validate=validate)
+ @property
+ def layers_compressed_size(self):
+ """ Returns the total compressed size of the layers in the manifest or None if this could not
+ be computed.
+ """
+ try:
+ return self.get_parsed_manifest().layers_compressed_size
+ except ManifestException:
+ return None
+
+ @property
+ def is_manifest_list(self):
+ """ Returns True if this manifest points to a list (instead of an image). """
+ return self.media_type == DOCKER_SCHEMA2_MANIFESTLIST_CONTENT_TYPE
+
class LegacyImage(datatype('LegacyImage', ['docker_image_id', 'created', 'comment', 'command',
'image_size', 'aggregate_size', 'uploading',
diff --git a/endpoints/api/tag.py b/endpoints/api/tag.py
index 413491093..3b0cf646c 100644
--- a/endpoints/api/tag.py
+++ b/endpoints/api/tag.py
@@ -1,4 +1,5 @@
""" Manage the tags of a repository. """
+import json
from datetime import datetime
from flask import request, abort
@@ -27,14 +28,26 @@ def _tag_dict(tag):
if tag.lifetime_end_ts > 0:
tag_info['end_ts'] = tag.lifetime_end_ts
- if tag.manifest_digest:
- tag_info['manifest_digest'] = tag.manifest_digest
-
- if tag.legacy_image:
+ # TODO(jschorr): Remove this once fully on OCI data model.
+ if tag.legacy_image_if_present:
tag_info['docker_image_id'] = tag.legacy_image.docker_image_id
tag_info['image_id'] = tag.legacy_image.docker_image_id
tag_info['size'] = tag.legacy_image.aggregate_size
+ # TODO(jschorr): Remove this check once fully on OCI data model.
+ if tag.manifest_digest:
+ tag_info['manifest_digest'] = tag.manifest_digest
+ if tag.manifest:
+ try:
+ tag_info['manifest'] = json.loads(tag.manifest.manifest_bytes)
+ except (TypeError, ValueError):
+ pass
+
+ tag_info['is_manifest_list'] = tag.manifest.is_manifest_list
+
+ if 'size' not in tag_info:
+ tag_info['size'] = tag.manifest.layers_compressed_size
+
if tag.lifetime_start_ts > 0:
last_modified = format_date(datetime.utcfromtimestamp(tag.lifetime_start_ts))
tag_info['last_modified'] = last_modified
diff --git a/image/docker/interfaces.py b/image/docker/interfaces.py
index a275caba7..2af17f1d4 100644
--- a/image/docker/interfaces.py
+++ b/image/docker/interfaces.py
@@ -46,6 +46,12 @@ class ManifestInterface(object):
"""
pass
+ @abstractproperty
+ def layers_compressed_size(self):
+ """ Returns the total compressed size of all the layers in this manifest. Returns None if this
+ cannot be computed locally.
+ """
+
@abstractproperty
def blob_digests(self):
""" Returns an iterator over all the blob digests referenced by this manifest,
diff --git a/image/docker/schema1.py b/image/docker/schema1.py
index 02f557fdd..2a5d26e25 100644
--- a/image/docker/schema1.py
+++ b/image/docker/schema1.py
@@ -251,6 +251,10 @@ class DockerSchema1Manifest(ManifestInterface):
def manifest_dict(self):
return self._parsed
+ @property
+ def layers_compressed_size(self):
+ return None
+
@property
def digest(self):
return digest_tools.sha256_digest(self._payload)
diff --git a/image/docker/schema2/list.py b/image/docker/schema2/list.py
index a7f383d7b..27939523d 100644
--- a/image/docker/schema2/list.py
+++ b/image/docker/schema2/list.py
@@ -228,6 +228,10 @@ class DockerSchema2ManifestList(ManifestInterface):
def local_blob_digests(self):
return self.blob_digests
+ @property
+ def layers_compressed_size(self):
+ return None
+
@lru_cache(maxsize=1)
def manifests(self, lookup_manifest_fn):
""" Returns the manifests in the list. The `lookup_manifest_fn` is a function
diff --git a/image/docker/schema2/manifest.py b/image/docker/schema2/manifest.py
index 8f48e0f9d..13fe52626 100644
--- a/image/docker/schema2/manifest.py
+++ b/image/docker/schema2/manifest.py
@@ -169,6 +169,10 @@ class DockerSchema2Manifest(ManifestInterface):
self._layers = list(self._generate_layers())
return self._layers
+ @property
+ def layers_compressed_size(self):
+ return sum(layer.compressed_size for layer in self.layers)
+
@property
def leaf_layer(self):
return self.layers[-1]
diff --git a/static/css/directives/repo-view/repo-panel-tags.css b/static/css/directives/repo-view/repo-panel-tags.css
index 8dea9ae7e..258c866b7 100644
--- a/static/css/directives/repo-view/repo-panel-tags.css
+++ b/static/css/directives/repo-view/repo-panel-tags.css
@@ -176,6 +176,10 @@
padding-top: 0px;
}
+.repo-panel-tags-element .manifest-list .labels-col {
+ padding-top: 10px;
+}
+
.repo-panel-tags-element .signing-delegations-list {
margin-top: 8px;
}
@@ -258,4 +262,35 @@
margin-bottom: 4px;
text-align: center;
padding: 4px;
+}
+
+.repo-panel-tags-element .manifest-list-icons {
+ display: inline-block;
+ float: right;
+}
+
+.repo-panel-tags-element .manifest-list-manifest-icon {
+ display: inline-block;
+ margin-right: 4px;
+ background-color: #e8f1f6;
+ padding: 6px;
+ border-radius: 4px;
+ font-size: 14px;
+ padding-top: 4px;
+ padding-bottom: 4px;
+ vertical-align: middle;
+}
+
+.repo-panel-tags-element .secscan-manifestlist {
+ color: #aaa;
+ font-size: 12px;
+}
+
+.repo-panel-tags-element .manifest-list-view td {
+ border-bottom: 0px;
+ border-top: 1px dotted #eee;
+}
+
+.repo-panel-tags-element .expanded-view.manifest-list {
+ border-top: 1px solid #eee;
}
\ No newline at end of file
diff --git a/static/directives/repo-view/repo-panel-tags.html b/static/directives/repo-view/repo-panel-tags.html
index 665762e0a..c54be60f9 100644
--- a/static/directives/repo-view/repo-panel-tags.html
+++ b/static/directives/repo-view/repo-panel-tags.html
@@ -122,7 +122,7 @@
|
- Image
+ Manifest
|
|
@@ -137,7 +137,15 @@
bindonce>
|
- |
+
+
+
+
+
+ |
@@ -151,89 +159,33 @@
|
-
-
+
-
- Could not load security information
+ See Child Manifests
-
-
-
-
- Unsupported
-
-
-
-
-
- Queued
-
-
-
-
-
- Unable to scan
-
-
-
-
-
- Unsupported
-
-
-
-
-
-
- Passed
-
-
-
-
-
-
-
-
-
-
-
-
-
- {{ getTagVulnerabilities(tag).highestVulnerability.Count }}
-
-
-
- ·
-
- {{ getTagVulnerabilities(tag).vulnerabilitiesInfo.fixable.length }} fixable
-
-
+
+
+
+ Unsupported
+
+
+
+
|
- |
+
+
+ N/A
+ |
@@ -307,7 +259,40 @@
|
|
-
+
+
+
+ |
+
+
+ {{ manifest.description }}
+ |
+
+
+
+
+
+ |
+
+
+
+ |
+
+
+
+ |
+
+ |
+
+
+
+
|
@@ -331,7 +316,7 @@
ng-class="::trackLineExpandedClass(it, $parent.$parent.$parent.$index)"
ng-style="::{'borderColor': getTrackEntryForIndex(it, $parent.$parent.$parent.$index).color}">
|
- |
+ |
diff --git a/static/js/directives/repo-view/repo-panel-tags.js b/static/js/directives/repo-view/repo-panel-tags.js
index 2fe30f82e..bada3dc2e 100644
--- a/static/js/directives/repo-view/repo-panel-tags.js
+++ b/static/js/directives/repo-view/repo-panel-tags.js
@@ -39,7 +39,7 @@ angular.module('quay').directive('repoPanelTags', function () {
$scope.expandedView = false;
$scope.labelCache = {};
- $scope.imageVulnerabilities = {};
+ $scope.manifestVulnerabilities = {};
$scope.repoDelegationsInfo = null;
$scope.defcon1 = {};
@@ -251,76 +251,6 @@ angular.module('quay').directive('repoPanelTags', function () {
loadRepoSignatures();
}, true);
- $scope.loadImageVulnerabilities = function(image_id, imageData) {
- VulnerabilityService.loadImageVulnerabilities($scope.repository, image_id, function(resp) {
- imageData.loading = false;
- imageData.status = resp['status'];
-
- if (imageData.status == 'scanned') {
- var vulnerabilities = [];
- var highest = {
- 'Severity': 'Unknown',
- 'Count': 0,
- 'index': 100000
- };
-
- VulnerabilityService.forEachVulnerability(resp, function(vuln) {
- if (VulnerabilityService.LEVELS[vuln.Severity].index == 0) {
- $scope.defcon1[vuln.Name] = vuln;
- $scope.hasDefcon1 = true;
- }
-
- if (VulnerabilityService.LEVELS[vuln.Severity].index < highest.index) {
- highest = {
- 'Priority': vuln.Severity,
- 'Count': 1,
- 'index': VulnerabilityService.LEVELS[vuln.Severity].index,
- 'Color': VulnerabilityService.LEVELS[vuln.Severity].color
- }
- } else if (VulnerabilityService.LEVELS[vuln.Severity].index == highest.index) {
- highest['Count']++;
- }
-
- vulnerabilities.push(vuln);
- });
-
- imageData.hasFeatures = VulnerabilityService.hasFeatures(resp);
- imageData.hasVulnerabilities = !!vulnerabilities.length;
- imageData.vulnerabilities = vulnerabilities;
- imageData.highestVulnerability = highest;
- imageData.featuresInfo = VulnerabilityService.buildFeaturesInfo(null, resp);
- imageData.vulnerabilitiesInfo = VulnerabilityService.buildVulnerabilitiesInfo(null, resp);
- }
- }, function() {
- imageData.loading = false;
- imageData.hasError = true;
- });
- };
-
- $scope.getTagVulnerabilities = function(tag) {
- if (!tag.manifest_digest) {
- return 'nodigest';
- }
-
- return $scope.getImageVulnerabilities(tag.image_id);
- };
-
- $scope.getImageVulnerabilities = function(image_id) {
- if (!$scope.repository) {
- return;
- }
-
- if (!$scope.imageVulnerabilities[image_id]) {
- $scope.imageVulnerabilities[image_id] = {
- 'loading': true
- };
-
- $scope.loadImageVulnerabilities(image_id, $scope.imageVulnerabilities[image_id]);
- }
-
- return $scope.imageVulnerabilities[image_id];
- };
-
$scope.clearSelectedTags = function() {
$scope.checkedTags.setChecked([]);
};
@@ -499,6 +429,27 @@ angular.module('quay').directive('repoPanelTags', function () {
$scope.handleLabelsChanged = function(manifest_digest) {
delete $scope.labelCache[manifest_digest];
};
+
+ $scope.manifestsOf = function(tag) {
+ if (!tag.is_manifest_list || !tag.manifest) {
+ return [];
+ }
+
+ if (!tag._mapped_manifests) {
+ // Calculate once and cache to avoid angular digest cycles.
+ tag._mapped_manifests = tag.manifest.manifests.map(function(manifest) {
+ return {
+ 'raw': manifest,
+ 'os': manifest.platform.os,
+ 'size': manifest.size,
+ 'digest': manifest.digest,
+ 'description': `${manifest.platform.os} on ${manifest.platform.architecture}`,
+ };
+ });
+ }
+
+ return tag._mapped_manifests;
+ };
}
};
return directiveDefinitionObject;
diff --git a/static/js/directives/ui/fetch-tag-dialog.js b/static/js/directives/ui/fetch-tag-dialog.js
index 51d75abea..046cdbf0f 100644
--- a/static/js/directives/ui/fetch-tag-dialog.js
+++ b/static/js/directives/ui/fetch-tag-dialog.js
@@ -39,7 +39,7 @@ angular.module('quay').directive('fetchTagDialog', function () {
});
}
- if ($scope.repository) {
+ if ($scope.repository && $scope.currentTag && !$scope.currentTag.is_manifest_list) {
$scope.formats.push({
'title': 'Squashed Docker Image',
'icon': 'ci-squashed',
@@ -49,7 +49,7 @@ angular.module('quay').directive('fetchTagDialog', function () {
});
}
- if (Features.ACI_CONVERSION) {
+ if (Features.ACI_CONVERSION && $scope.currentTag && !$scope.currentTag.is_manifest_list) {
$scope.formats.push({
'title': 'rkt Fetch',
'icon': 'rocket-icon',
diff --git a/static/js/directives/ui/manifest-security-view/manifest-security-view.component.html b/static/js/directives/ui/manifest-security-view/manifest-security-view.component.html
new file mode 100644
index 000000000..66a06327f
--- /dev/null
+++ b/static/js/directives/ui/manifest-security-view/manifest-security-view.component.html
@@ -0,0 +1,73 @@
+
\ No newline at end of file
diff --git a/static/js/directives/ui/manifest-security-view/manifest-security-view.component.ts b/static/js/directives/ui/manifest-security-view/manifest-security-view.component.ts
new file mode 100644
index 000000000..be0ec9c15
--- /dev/null
+++ b/static/js/directives/ui/manifest-security-view/manifest-security-view.component.ts
@@ -0,0 +1,76 @@
+import { Input, Component, Inject } from 'ng-metadata/core';
+import { Repository } from '../../../types/common.types';
+
+
+/**
+ * A component that displays the security status of a manifest.
+ */
+@Component({
+ selector: 'manifest-security-view',
+ templateUrl: '/static/js/directives/ui/manifest-security-view/manifest-security-view.component.html',
+})
+export class ManifestSecurityView {
+ @Input('<') public repository: Repository;
+ @Input('<') public manifestDigest: string;
+
+ private cachedSecurityStatus: Object = null;
+
+ constructor(@Inject('VulnerabilityService') private VulnerabilityService: any) {
+ }
+
+ private getSecurityStatus(repository: Repository, manifestDigest: string): Object {
+ if (repository == null || !manifestDigest) {
+ return {'status': 'loading'};
+ }
+
+ if (this.cachedSecurityStatus) {
+ return this.cachedSecurityStatus;
+ }
+
+ this.cachedSecurityStatus = {'status': 'loading'};
+ this.loadManifestVulnerabilities(this.cachedSecurityStatus);
+ return this.cachedSecurityStatus;
+ }
+
+ private loadManifestVulnerabilities(securityStatus) {
+ this.VulnerabilityService.loadManifestVulnerabilities(this.repository, this.manifestDigest, (resp) => {
+ securityStatus.loading = false;
+ securityStatus.status = resp['status'];
+
+ if (securityStatus.status == 'scanned') {
+ var vulnerabilities = [];
+ var highest = {
+ 'Priority': 'Unknown',
+ 'Count': 0,
+ 'index': 100000,
+ 'Color': 'gray',
+ };
+
+ this.VulnerabilityService.forEachVulnerability(resp, function(vuln) {
+ if (this.VulnerabilityService.LEVELS[vuln.Severity].index < highest.index) {
+ highest = {
+ 'Priority': vuln.Severity,
+ 'Count': 1,
+ 'index': this.VulnerabilityService.LEVELS[vuln.Severity].index,
+ 'Color': this.VulnerabilityService.LEVELS[vuln.Severity].color
+ }
+ } else if (this.VulnerabilityService.LEVELS[vuln.Severity].index == highest.index) {
+ highest['Count']++;
+ }
+
+ vulnerabilities.push(vuln);
+ });
+
+ securityStatus.hasFeatures = this.VulnerabilityService.hasFeatures(resp);
+ securityStatus.hasVulnerabilities = !!vulnerabilities.length;
+ securityStatus.vulnerabilities = vulnerabilities;
+ securityStatus.highestVulnerability = highest;
+ securityStatus.featuresInfo = this.VulnerabilityService.buildFeaturesInfo(null, resp);
+ securityStatus.vulnerabilitiesInfo = this.VulnerabilityService.buildVulnerabilitiesInfo(null, resp);
+ }
+ }, function() {
+ securityStatus.loading = false;
+ securityStatus.hasError = true;
+ });
+ };
+}
diff --git a/static/js/quay.module.ts b/static/js/quay.module.ts
index d17c399bc..eb80a488d 100644
--- a/static/js/quay.module.ts
+++ b/static/js/quay.module.ts
@@ -41,6 +41,7 @@ import { TimeAgoComponent } from './directives/ui/time-ago/time-ago.component';
import { TimeDisplayComponent } from './directives/ui/time-display/time-display.component';
import { AppSpecificTokenManagerComponent } from './directives/ui/app-specific-token-manager/app-specific-token-manager.component';
import { ManifestLinkComponent } from './directives/ui/manifest-link/manifest-link.component';
+import { ManifestSecurityView } from './directives/ui/manifest-security-view/manifest-security-view.component';
import { MarkdownModule } from './directives/ui/markdown/markdown.module';
import * as Clipboard from 'clipboard';
@@ -87,6 +88,7 @@ import * as Clipboard from 'clipboard';
TimeDisplayComponent,
AppSpecificTokenManagerComponent,
ManifestLinkComponent,
+ ManifestSecurityView,
],
providers: [
ViewArrayImpl,
diff --git a/workers/manifestbackfillworker.py b/workers/manifestbackfillworker.py
index c5e5fe613..4c5c35995 100644
--- a/workers/manifestbackfillworker.py
+++ b/workers/manifestbackfillworker.py
@@ -86,6 +86,10 @@ class BrokenManifest(ManifestInterface):
def schema_version():
return 1
+ @property
+ def layers_compressed_size():
+ return None
+
class ManifestBackfillWorker(Worker):
def __init__(self):