spiegel_podman/cmd/podman
Miloslav Trmač 5c95c0920f Add support for creating sigstore signatures, and providing passphrases
- Allow creating sigstore signatures via --sign-by-sigstore-private-key .
  Like existing --sign-by, it does not work remote (in this case
  because we would have to copy the private key to the server).
- Allow passing a passphrase (which is mandatory for sigstore private keys)
  via --sign-passphrase-file; if it is not provided, prompt interactively.
- Also, use that passphrase for --sign-by as well, allowing non-interactive
  GPG use. (But --sign-passphrase-file can only be used with _one of_
  --sign-by and --sign-by-sigstore-private-key.)

Note that unlike the existing code, (podman build) does not yet
implement sigstore (I'm not sure why it needs to, it seems not to
push images?) because Buildah does not expose the feature yet.

Also, (podman image sign) was not extended to support sigstore.

The test for this follows existing (podman image sign) tests
and doesn't work rootless; that could be improved by exposing
a registries.d override option.

The test for push is getting large; I didn't want to
start yet another registry container, but that would be an
alternative.  In the future, Ginkgo's Ordered/BeforeAll
would allow starting a registry once and using it for two
tests.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
2022-08-02 16:52:56 +02:00
..
common Add support for creating sigstore signatures, and providing passphrases 2022-08-02 16:52:56 +02:00
completion enable gocritic linter 2022-04-26 18:12:22 +02:00
containers Remove return error from "containers.pause" 2022-07-26 13:38:10 -04:00
diff cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
generate cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
healthcheck bump go module to version 4 2022-01-18 12:47:07 +01:00
images Add support for creating sigstore signatures, and providing passphrases 2022-08-02 16:52:56 +02:00
inspect Merge pull request #14449 from cdoern/podVolumes 2022-07-01 08:46:11 +00:00
machine pkg/machine/e2e: do not import from cmd/podman 2022-07-26 14:24:43 -04:00
manifest Add support for creating sigstore signatures, and providing passphrases 2022-08-02 16:52:56 +02:00
networks docs: remove CNI word where it is not applicable 2022-07-26 14:42:32 -04:00
parse cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
play cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
pods pod create --share none should not create infra 2022-07-26 14:46:12 -04:00
registry Add --host and -H as equivalent options to --url 2022-07-26 13:34:12 -04:00
secrets cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
system Add podman events -f to be alias for --filter 2022-07-26 13:15:45 -04:00
utils Refactored networkPrune function 2022-07-08 08:33:20 +09:00
validate Podman stop --filter flag 2022-07-26 13:25:36 -04:00
volumes cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
auto-update.go cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
diff.go Remove unused archive flag from diff commands 2022-05-25 08:50:12 -07:00
early_init_linux.go cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
early_init_unsupported.go go fmt: use go 1.18 conditional-build syntax 2022-03-18 09:11:53 +01:00
inspect.go bump go module to version 4 2022-01-18 12:47:07 +01:00
login.go bump go module to version 4 2022-01-18 12:47:07 +01:00
logout.go bump go module to version 4 2022-01-18 12:47:07 +01:00
main.go bump github.com/spf13/cobra from 1.4.0 to 1.5.0 2022-06-21 17:17:06 +02:00
README.md [Techinal Debt] Cleanup ABI vs. Tunnel CLI commands 2021-05-27 11:40:43 -07:00
root.go Add --host and -H as equivalent options to --url 2022-07-26 13:34:12 -04:00
root_test.go cmd/podman: switch to golang native error wrapping 2022-06-30 12:58:57 +02:00
shell_completion_test.go bump go module to version 4 2022-01-18 12:47:07 +01:00
syslog_linux.go Fix build on OS X 2020-05-20 18:24:56 -04:00
syslog_unsupported.go go fmt: use go 1.18 conditional-build syntax 2022-03-18 09:11:53 +01:00

Podman CLI

The following is an example of how to add a new primary command (manifest) and a sub-command (inspect) to the Podman CLI. This is example code, the production code has additional error checking and the business logic provided.

See items below for details on building, installing, contributing to Podman:

Adding a new command podman manifest

$ mkdir -p $GOPATH/src/github.com/containers/podman/cmd/podmanV2/manifests

Create the file $GOPATH/src/github.com/containers/podman/cmd/podmanV2/manifests/manifest.go

package manifests

import (
    "github.com/containers/podman/cmd/podman/registry"
    "github.com/containers/podman/cmd/podman/validate"
    "github.com/containers/podman/pkg/domain/entities"
    "github.com/spf13/cobra"
)

var (
    // podman _manifests_
    manifestCmd = &cobra.Command{
        Use:               "manifest",
        Short:             "Manage manifests",
        Args:              cobra.ExactArgs(1),
        Long:              "Manage manifests",
        Example:           "podman manifest IMAGE",
        TraverseChildren:  true,
        RunE:              validate.SubCommandExists, // Report error if there is no sub command given
    }
)
func init() {
    // Subscribe command to podman
    registry.Commands = append(registry.Commands, registry.CliCommand{
        Command: manifestCmd,
    })
}

To "wire" in the manifest command, edit the file $GOPATH/src/github.com/containers/podman/cmd/podmanV2/main.go to add:

package main

import	_ "github.com/containers/podman/cmd/podman/manifests"

Adding a new sub command podman manifests list

Create the file $GOPATH/src/github.com/containers/podman/cmd/podmanV2/manifests/inspect.go

package manifests

import (
    "github.com/containers/podman/cmd/podman/registry"
    "github.com/containers/podman/pkg/domain/entities"
    "github.com/spf13/cobra"
)

var (
    // podman manifests _inspect_
    inspectCmd = &cobra.Command{
        Use:     "inspect IMAGE",
        Short:   "Display manifest from image",
        Long:    "Displays the low-level information on a manifest identified by image name or ID",
        RunE:    inspect,
        Annotations: map[string]string{
            // Add this annotation if this command cannot be run rootless
            // registry.ParentNSRequired: "",
        },
        Example: "podman manifest inspect DEADBEEF",
    }
)

func init() {
    // Subscribe inspect sub command to manifest command
    registry.Commands = append(registry.Commands, registry.CliCommand{
        Command: inspectCmd,
        // The parent command to proceed this command on the CLI
        Parent:  manifestCmd,
    })

    // This is where you would configure the cobra flags using inspectCmd.Flags()
}

// Business logic: cmd is inspectCmd, args is the positional arguments from os.Args
func inspect(cmd *cobra.Command, args []string) error {
    // Business logic using registry.ImageEngine()
    // Do not pull from libpod directly use the domain objects and types
    return nil
}

Helper functions

The complete set can be found in the validate package, here are some examples:

  • cobra.Command{ Args: validate.NoArgs } used when the command does not accept errors
  • cobra.Command{ Args: validate.IdOrLatestArgs } used to ensure either a list of ids given or the --latest flag
  • cobra.Command{ RunE: validate.SubCommandExists } used to validate a subcommand given to a command
  • validate.ChoiceValue used to create a pflag.Value that validate user input against a provided slice of values. For example:
    flags := cobraCommand.Flags()
    created := validate.ChoiceValue(&opts.Sort, "command", "created", "id", "image", "names", "runningfor", "size", "status")
    flags.Var(created, "sort", "Sort output by: "+created.Choices())