vbatts/registry
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Avoid manifest verification errors by using Raw

Browse source 
Because json.Marshal does compaction on returned results, applications must
directly use SignedManifest.Raw when the marshaled value is required.
Otherwise, the returned manifest will fail signature checks.
This commit is contained in:
Stephen J Day 2014-12-01 17:10:33 -08:00
parent 8c7bec72b1
commit e6e0219065
2 changed files with 16 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
api_test.go
View file

@ -277,7 +277,7 @@ func TestManifestAPI(t *testing.T) {
resp = putManifest(t, "putting signed manifest", manifestURL, signedManifest)
checkResponse(t, "putting manifest", resp, http.StatusOK)
checkResponse(t, "putting signed manifest", resp, http.StatusOK)
resp, err = http.Get(manifestURL)
if err != nil {
@ -299,9 +299,15 @@ func TestManifestAPI(t *testing.T) {
}
func putManifest(t *testing.T, msg, url string, v interface{}) *http.Response {
body, err := json.Marshal(v)
if err != nil {
t.Fatalf("unexpected error marshaling %v: %v", v, err)
var body []byte
if sm, ok := v.(*storage.SignedManifest); ok {
body = sm.Raw
} else {
var err error
body, err = json.MarshalIndent(v, "", " ")
if err != nil {
t.Fatalf("unexpected error marshaling %v: %v", v, err)
}
}
req, err := http.NewRequest("PUT", url, bytes.NewReader(body))

9
storage/manifest.go
View file

@ -140,8 +140,9 @@ type SignedManifest struct {
Manifest
// Raw is the byte representation of the ImageManifest, used for signature
// verification. The manifest byte representation cannot change or it will
// have to be re-signed.
// verification. The value of Raw must be used directly during
// serialization, or the signature check will fail. The manifest byte
// representation cannot change or it will have to be re-signed.
Raw []byte `json:"-"`
}
@ -184,7 +185,9 @@ func (sm *SignedManifest) UnmarshalJSON(b []byte) error {
}
// MarshalJSON returns the contents of raw. If Raw is nil, marshals the inner
// contents.
// contents. Applications requiring a marshaled signed manifest should simply
// use Raw directly, since the the content produced by json.Marshal will
// compacted and will fail signature checks.
func (sm *SignedManifest) MarshalJSON() ([]byte, error) {
if len(sm.Raw) > 0 {
return sm.Raw, nil