dZddlmZddlmZddlmZddlZddlZddlZddlZddl m Z Gdde Z d Z d Zd Zd Zd ZdZdZy)zEThis package holds a handful of utilities for manipulating manifests.)absolute_import)division)print_functionN) docker_nameceZdZdZy)BadManifestExceptionz?Exception type raised when a malformed manifest is encountered.N)__name__ __module__ __qualname____doc__4lib/third_party/containerregistry/client/v2/util_.pyrrsGrrc|jd}t|}|dzdk(rn'|dzdk(r|dz }n|dzdk(r|dz }n tdtj|j dS) aPerform a JOSE-style base64 decoding of the supplied message. This is based on the docker/libtrust version of the similarly named function found here: https://github.com/docker/libtrust/blob/master/util.go Args: message: a JOSE-style base64 url-encoded message. Raises: BadManifestException: a malformed message was supplied. Returns: The decoded message. utf8rs===zMalformed JOSE Base64 encoding.)encodelenrbase64urlsafe_b64decodedecode)message bytes_msgls r_JoseBase64UrlDecoder s{nnV$) )n!UaZ1uz I1uz I @ AA  ! !) , 3 3F ;;rcXtjt|d}|d|dfS)zDExtract the length and encoded suffix denoting the protected region. protected formatLength formatTail)jsonloadsr) signaturer s r_ExtractProtectedRegionr&<s0jj-i .DEF) N #Y|%< ==rcht|d}|ddD]}|t|k7std|S)zHVerify that the signatures agree on the protected region and return one.rNz'Signatures disagree on protected region)r&r) signaturespsigs r_ExtractCommonProtectedRegionr,BsCjm,! ^c #C (( !J KK (rctj|}|d}t|dkr td|D]}d|vstdt |\}}t |}|d||z}||fS)aBDetach the signatures from the signed manifest and return the two halves. Args: manifest: a signed JSON manifest. Raises: BadManifestException: the provided manifest was improperly signed. Returns: a pair consisting of the manifest with the signature removed and a list of the removed signatures. r)r(zExpected a signed manifest.r z$Signature is missing "protected" keyr)r#r$rrr,r)manifest json_manifestr)r+ format_length format_tailsuffixunsigned_manifests rDetachSignaturesr4Ls**X&-\** _q < == c# !G HH "?z!J=+  ,&q/&8 Z ((rc|S)Nr )r3s rSignr6ls rct|\}}|d|}t|}dj|tj|d|S)z>Attach the provided signatures to the provided naked manifest.rz*{prefix},"signatures":{signatures}{suffix}T) sort_keys)prefixr)r2)r,rformatr#dumps)r.r)r0r1r9r2s r_AttachSignaturesr<ssU"?z!J=+ Am $&  ,& 5 < < J$7  = rct|\}}tj|}|j|d<|j|d<tj |dd}t |S)z@Rename this signed manifest to the provided name, and resign it.nametagTr)r8indent)r4r#r$ repositoryr?r;r6)r.r>r3unused_signaturesr/updated_unsigned_manifests rRenamerDsd)9()C&&**./-//--#jjtA/ ' ((r)r __future__rrrrr#os subprocesscontainerregistry.clientr Exceptionrrr&r,r4r6r<rDr rrrJsUL&% 0H9H<8>  )@ )r