Commits on Jan 22, 2017

1. schema: Use Validators map and prepare to extend beyond JSON Schema …

   With image-tools split off into its own repository, the plan seems to
   be to keep all intra-blob JSON validation in this repository and to
   move all other validation (e.g. for layers or for walking Merkle
   trees) in image-tools [1].  All the non-validation logic currently in
   image/ is moving into image-tools as well [2].
   
   Some requirements (e.g. multi-parameter checks like allowed OS/arch
   pairs [3]) are difficult to handle in JSON Schema but easy to handle
   in Go.  And callers won't care if we're using JSON Schema or not; they
   just want to know if their blob is valid.
   
   This commit restructures intra-blob validation to ease the path going
   forward (although it doesn't actually change the current validation
   significantly).  The old method:
   
     func (v Validator) Validate(src io.Reader) error
   
   is now a new Validator type:
   
     type Validator(blob io.Reader, descriptor *v1.Descriptor, strict bool) (err error)
   
   and instead of instantiating an old Validator instance:
   
     schema.MediaTypeImageConfig.Validate(reader)
   
   there's a Validators registry mapping from the media type strings to
   the appropriate Validator instance (which may or may not use JSON
   Schema under the hood).  And there's a Validate function (with the
   same Validator interface) that looks up the appropriate entry in
   Validators for you so you have:
   
     schema.Validate(reader, descriptor, true)
   
   By using a Validators map, we make it easy for library consumers to
   register (or override) intra-blob validators for a particular type.
   Locations that call Validate(...) will automatically pick up the new
   validators without needing local changes.
   
   All of the old validation was based on JSON Schema, so currently all
   Validators values are ValidateJSONSchema.  As the schema package grows
   non-JSON-Schema validation, entries will start to look like:
   
     var Validators = map[string]Validator{
       v1.MediaTypeImageConfig: ValidateConfig,
       ...
     }
   
   although ValidateConfig will probably use ValidateJSONSchema
   internally.
   
   By passing through a descriptor, we get a chance to validate the
   digest and size (which we were not doing before).  Digest and size
   validation for a byte array are also exposed directly (as
   ValidateByteDigest and ValidateByteSize) for use in validators that
   are not based on ValidateJSONSchema.  Access to the digest also gives
   us a way to print specific error messages on failures.
   
   There is also a new 'strict' parameter to distinguish between
   compliant images (which should always pass when strict is false) and
   images that only use features which the spec requires implementations
   to support (which should only pass if strict is true).  The current
   JSON Schemas are not strict, but the config/layer media type checks in
   ValidateManifest exercise this distinction.
   
   Also use go-digest for local hashing now that we're vendoring it.
   
   [1]: http://ircbot.wl.linuxfoundation.org/meetings/opencontainers/2016/opencontainers.2016-10-12-21.01.log.html#l-71
   [2]: opencontainers#337
   [3]: https://tools.ietf.org/html/draft-fge-json-schema-validation-00#section-5.5.5
   [4]: opencontainers#341
   
   Signed-off-by: W. Trevor King <wking@tremily.us>

   

   wking committed Jan 22, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for f2b9500
   • Browse repository at this point

   Copy the full SHA

   f2b9500 View commit details

   Browse the repository at this point in the history