fix: Embed default policy in binary (#8)

mesosphere · Dec 15, 2021 · 4f10858 · 4f10858
1 parent e07999f
commit 4f10858
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 2 deletions.
diff --git a/skopeo/default-policy.json b/skopeo/default-policy.json
@@ -0,0 +1,14 @@
+{
+  "default": [
+      {
+          "type": "insecureAcceptAnything"
+      }
+  ],
+  "transports":
+      {
+          "docker-daemon":
+              {
+                  "": [{"type":"insecureAcceptAnything"}]
+              }
+      }
+}
diff --git a/skopeo/skopeo.go b/skopeo/skopeo.go
@@ -17,6 +17,7 @@ package skopeo
 import (
 	"bytes"
 	"context"
+	_ "embed"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -31,6 +32,9 @@ import (
 	"k8s.io/klog/v2"
 )
 
+//go:embed default-policy.json
+var defaultSkopeoPolicy []byte
+
 type SkopeoOption func() string
 
 func DisableSrcTLSVerify() SkopeoOption {
@@ -94,8 +98,9 @@ func DestCredentials(username, password string) SkopeoOption {
 }
 
 type Runner struct {
-	unpacked           sync.Once
-	unpackedSkopeoPath string
+	unpacked                 sync.Once
+	unpackedSkopeoPath       string
+	unpackedSkopeoPolicyPath string
 }
 
 type CleanupFunc func() error
@@ -117,11 +122,16 @@ func (r *Runner) mustUnpack() {
 	if err = os.WriteFile(r.unpackedSkopeoPath, skopeoBinary, 0700); err != nil {
 		panic(err)
 	}
+	r.unpackedSkopeoPolicyPath = filepath.Join(tempDir, "policy.json")
+	if err = os.WriteFile(r.unpackedSkopeoPolicyPath, defaultSkopeoPolicy, 0400); err != nil {
+		panic(err)
+	}
 }
 
 func (r *Runner) Copy(ctx context.Context, src, dest string, opts ...SkopeoOption) ([]byte, error) {
 	copyArgs := []string{
 		"copy",
+		"--policy", r.unpackedSkopeoPolicyPath,
 		"--preserve-digests",
 		src,
 		dest,