Proofing

Signed-off-by: apostasie <spam_blackhole@farcloser.world>

Author: apostasie

.github/workflows/test.yml

@@ -138,10 +138,18 @@ jobs:
           # To avoid that, we explicitly list the architectures we do want emulation for.
           docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
+      - name: "Mock services"
+        run: |
+          CLI=docker ./mod/proofing/spoof.sh server::start ./mod/proofing/.env
       - name: "Run integration tests"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
+        run: |
+          docker run -t --rm \
+            --env PROOFING_IP=$(docker inspect proofing-spoofer -f '{{ .NetworkSettings.IPAddress }}') \
+            --privileged test-integration ./hack/test-integration.sh -test.only-flaky=false
       - name: "Run integration tests (flaky)"
-        run: docker run -t --rm --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
+        run: |
+          docker run -t --rm \
+            --privileged test-integration ./hack/test-integration.sh -test.only-flaky=true
 
   test-integration-ipv6:
     needs: build-dependencies

cmd/nerdctl/builder/builder_builder_test.go

@@ -152,9 +152,9 @@ CMD ["echo", "nerdctl-builder-debug-test-string"]`, testutil.CommonImage)
 					// FIXME: this test should be rewritten to dynamically retrieve the ids, and use images
 					// available on all platforms
 					oldImage := testutil.BusyboxImage
-					oldImageSha := "7b3ccabffc97de872a30dfd234fd972a66d247c8cfc69b0550f276481852627c"
+					oldImageSha := "07b7d0e283515a078e1d5b23d41e0db4d41211878612de51c0935490c76aec1c"
 					newImage := testutil.AlpineImage
-					newImageSha := "ec14c7992a97fc11425907e908340c6c3d6ff602f5f13d899e6b7027c9b4133a"
+					newImageSha := "00b9b8f7ecae6f64741cf4f8f96abce0ac070ccac85fa7866890a0b6dcfb0aad"
 
 					helpers.Ensure("pull", "--quiet", oldImage)
 					helpers.Ensure("tag", oldImage, newImage)

cmd/nerdctl/container/container_run_mount_linux_test.go

@@ -18,6 +18,7 @@ package container
 
 import (
 	"fmt"
+	"github.com/containerd/nerdctl/mod/tigron/tig"
 	"os"
 	"path/filepath"
 	"strings"
@@ -307,7 +308,7 @@ func TestRunBindMountTmpfs(t *testing.T) {
 }
 
 func mountExistsWithOpt(mountPoint, mountOpt string) test.Comparator {
-	return func(stdout, info string, t *testing.T) {
+	return func(stdout string, t tig.T) {
 		lines := strings.Split(strings.TrimSpace(stdout), "\n")
 		mountOutput := []string{}
 		for _, line := range lines {

cmd/nerdctl/image/image_history_test.go

@@ -134,22 +134,22 @@ func TestImageHistory(t *testing.T) {
 				Expected: test.Expects(0, nil, func(stdout string, t tig.T) {
 					history, err := decode(stdout)
 					assert.NilError(t, err, "decode should not fail")
-					assert.Equal(t, history[1].Snapshot, "sha256:56bf55b8eed1f0b4794a30386e4d1d3da949c25bcb5155e898097cd75dc77c2a")
+					assert.Equal(t, history[1].Snapshot, "sha256:a16e98724c05975ee8c40d8fe389c3481373d34ab20a1cf52ea2accc43f71f4c")
 					assert.Equal(t, history[1].CreatedBy, "/bin/sh -c #(nop) ADD file:3b16ffee2b26d8af5db152fcc582aaccd9e1ec9e3343874e9969a205550fe07d in / ")
 				}),
 			},
 			{
 				Description: "Quiet has no effect with format, so, go no-json, no-trunc",
 				Command:     test.Command("image", "history", "--human=false", "--no-trunc", "--quiet", testutil.CommonImage),
 				Expected: test.Expects(0, nil, func(stdout string, t tig.T) {
-					assert.Equal(t, stdout, "<missing>\nsha256:56bf55b8eed1f0b4794a30386e4d1d3da949c25bcb5155e898097cd75dc77c2a\n")
+					assert.Equal(t, stdout, "<missing>\nsha256:a16e98724c05975ee8c40d8fe389c3481373d34ab20a1cf52ea2accc43f71f4c\n")
 				}),
 			},
 			{
 				Description: "With quiet, trunc has no effect",
 				Command:     test.Command("image", "history", "--human=false", "--no-trunc", "--quiet", testutil.CommonImage),
 				Expected: test.Expects(0, nil, func(stdout string, t tig.T) {
-					assert.Equal(t, stdout, "<missing>\nsha256:56bf55b8eed1f0b4794a30386e4d1d3da949c25bcb5155e898097cd75dc77c2a\n")
+					assert.Equal(t, stdout, "<missing>\nsha256:a16e98724c05975ee8c40d8fe389c3481373d34ab20a1cf52ea2accc43f71f4c\n")
 				}),
 			},
 		},

hack/test-integration.sh

@@ -26,6 +26,11 @@ if [[ "$(id -u)" = "0" ]]; then
   fi
 fi
 
+# If we are being asked to use the proofing system, configure it
+if [ "${PROOFING_IP:-}" != "" ]; then
+  "$root"/mod/proofing/spoof.sh guest::configure "$root"/mod/proofing/.env "$PROOFING_IP"
+fi
+
 readonly timeout="60m"
 readonly retries="2"
 readonly needsudo="${WITH_SUDO:-}"

mod/proofing/.env

@@ -0,0 +1,10 @@
+# This is the minimal env file you need to have
+# You must at least point to a usable docker registry image
+REGISTRY=registry:3.0.0@sha256:1fc7de654f2ac1247f0b67e8a459e273b0993be7d2beda1f3f56fbf1001ed3e7
+
+# You can then add below whatever image you want mocked, for any origin.
+# Short syntax is accepted (eg: `busybox`, or `library:busybox`) though you MUST provide a tag AND a digest
+
+# Examples:
+# NANOSERVER=mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:16b61ffac72961551c4b5312a7ab3da7c3dc3258510e40bee309e6e51f006ac6
+# DEBIAN=debian:bookworm-slim@sha256:b1211f6d19afd012477bd34fdcabb6b663d680e0f4b0537da6e6b0fd057a3ec3

mod/proofing/forward.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# shellcheck disable=SC2034,SC2015
+set -o errexit -o errtrace -o functrace -o nounset -o pipefail
+
+# Extract the list of domains from image names in the environment
+extract::domains(){
+  local fd="$1"
+
+  local image
+  local domain
+  local ignore
+
+  while read -r image; do
+    IFS=" " read -r domain ignore <<<"$image"
+    printf "%s\n" "$domain"
+  done < <(extract::images "$1") | sort | uniq
+}
+
+# Extract the list of images from the file.
+extract::images(){
+  local fd="$1"
+  local image
+  local ref
+  local domain
+  local owner
+  local name
+  local tag
+  local digest
+
+  while read -r image; do
+    [ "$image" != "" ] && [ "${image:0:1}" != "#" ] || continue
+    image="${image#*=}"
+    digest="${image#*@}"
+    tag="${image#*:}"
+    tag="${tag%@*}"
+    ref="${image%%:*}"
+
+    IFS=/ read -r domain owner name <<<"$ref"
+    [ "$owner" != "" ] || {
+      name="$domain"
+      owner=library
+      domain=docker.io
+    }
+    [ "$name" != "" ] || {
+      name="$owner"
+      owner="$domain"
+      domain=docker.io
+    }
+
+    printf "%s %s %s %s\n" "$domain" "$owner/$name" "$tag" "$digest"
+  done <"$fd" | sort | uniq
+}
+
+"extract::$1" "$2"