-
Notifications
You must be signed in to change notification settings - Fork 26
[sha512] common: enable sha512 support #376
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
lsm5
wants to merge
2
commits into
containers:main
Choose a base branch
from
lsm5:common-agile-digest
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,134 @@ | ||
| //go:build !remote | ||
|
|
||
| package digestutils | ||
|
|
||
| import ( | ||
| "strings" | ||
|
|
||
| "github.com/opencontainers/go-digest" | ||
| ) | ||
|
|
||
| // IsDigestReference determines if the given name is a digest-based reference. | ||
| // This function properly detects digests using the go-digest library instead of | ||
| // hardcoded string prefixes, avoiding conflicts with repository names like "sha256" or "sha512". | ||
| // | ||
| // The function supports: | ||
| // - Standard digest formats (algorithm:hash) like "sha256:abc123..." or "sha512:def456..." | ||
| // - Legacy 64-character hex format (SHA256 without algorithm prefix) for backward compatibility | ||
| // | ||
| // Examples: | ||
| // - "sha256:916f0027a575074ce72a331777c3478d6513f786a591bd892da1a577bf2335f9" → true | ||
| // - "sha512:0e1e21ecf105ec853d24d728867ad70613c21663a4693074b2a3619c1bd39d66b588c33723bb466c72424e80e3ca63c249078ab347bab9428500e7ee43059d0d" → true | ||
| // - "abcd1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab" → true (legacy) | ||
| // - "sha256" → false (repository name) | ||
| // - "sha512:latest" → false (repository with tag) | ||
| // - "docker.io/sha256:latest" → false (repository with domain) | ||
| func IsDigestReference(name string) bool { | ||
| // First check if it's a valid digest format (algorithm:hash) | ||
| if _, err := digest.Parse(name); err == nil { | ||
| return true | ||
| } | ||
|
|
||
| // Also check for the legacy 64-character hex format (SHA256 without algorithm prefix) | ||
| // This maintains backward compatibility for existing deployments | ||
| if len(name) == 64 && !strings.ContainsAny(name, "/.:@") { | ||
| // Verify it's actually hex | ||
| for _, c := range name { | ||
| if (c < '0' || c > '9') && (c < 'a' || c > 'f') && (c < 'A' || c > 'F') { | ||
| return false | ||
| } | ||
| } | ||
| return true | ||
| } | ||
|
|
||
| return false | ||
| } | ||
|
|
||
| // ExtractAlgorithmFromDigest extracts the algorithm and hash from a digest string. | ||
| // It expects input like "@sha256:abc123" or "@sha512:def456". | ||
| // Returns (algorithm, hash) if successful, or ("", "") if parsing fails. | ||
| // | ||
| // This function validates that the extracted algorithm and hash form a valid digest. | ||
| // It is useful for preserving the algorithm that was determined by functions like getImageID, | ||
| // rather than overriding it with a globally configured algorithm. | ||
| // | ||
| // Examples: | ||
| // - "@sha256:abc123" → ("sha256", "abc123") (if valid) | ||
| // - "@sha512:def456" → ("sha512", "def456") (if valid) | ||
| // - "sha256:abc123" → ("", "") (missing @ prefix) | ||
| // - "@invalid" → ("", "") (missing colon) | ||
| // - "@sha256:invalid" → ("", "") (invalid hash format) | ||
| func ExtractAlgorithmFromDigest(digestStr string) (string, string) { | ||
| if !strings.HasPrefix(digestStr, "@") { | ||
| return "", "" | ||
| } | ||
|
|
||
| // Remove the "@" prefix | ||
| digestStr = digestStr[1:] | ||
|
|
||
| // Split on the first ":" to get algorithm:hash | ||
| parts := strings.SplitN(digestStr, ":", 2) | ||
| if len(parts) != 2 { | ||
| return "", "" | ||
| } | ||
|
|
||
| algorithm, hash := parts[0], parts[1] | ||
|
|
||
| // Validate that the algorithm and hash form a valid digest | ||
| // This ensures we only return valid digest components | ||
| if _, err := digest.Parse(algorithm + ":" + hash); err != nil { | ||
| return "", "" | ||
| } | ||
|
|
||
| return algorithm, hash | ||
| } | ||
|
|
||
| // HasDigestPrefix checks if a string starts with any supported digest algorithm prefix. | ||
| // This is more scalable than hardcoding multiple HasPrefix checks for individual algorithms. | ||
| // | ||
| // Examples: | ||
| // - "sha256:abc123" → true | ||
| // - "sha512:def456" → true | ||
| // - "image:latest" → false | ||
| // - "registry.io/repo" → false | ||
| func HasDigestPrefix(s string) bool { | ||
| // Check if the string starts with any supported digest algorithm | ||
| // This is more efficient than checking each algorithm individually | ||
| for _, prefix := range []string{"sha256:", "sha512:"} { | ||
| if strings.HasPrefix(s, prefix) { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| // GetDigestPrefix returns the digest algorithm prefix if the string starts with one. | ||
| // Returns the prefix (including colon) if found, empty string otherwise. | ||
| // | ||
| // Examples: | ||
| // - "sha256:abc123" → "sha256:" | ||
| // - "sha512:def456" → "sha512:" | ||
| // - "image:latest" → "" | ||
| func GetDigestPrefix(s string) string { | ||
| prefixes := []string{"sha256:", "sha512:"} | ||
| for _, prefix := range prefixes { | ||
| if strings.HasPrefix(s, prefix) { | ||
| return prefix | ||
| } | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| // TrimDigestPrefix removes the digest algorithm prefix from a string if present. | ||
| // Returns the string without the prefix and a boolean indicating if a prefix was found. | ||
| // | ||
| // Examples: | ||
| // - "sha256:abc123" → ("abc123", true) | ||
| // - "sha512:def456" → ("def456", true) | ||
| // - "image:latest" → ("image:latest", false) | ||
| func TrimDigestPrefix(s string) (string, bool) { | ||
| if prefix := GetDigestPrefix(s); prefix != "" { | ||
| return strings.TrimPrefix(s, prefix), true | ||
| } | ||
| return s, false | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
getImageIDknows which algorithm was used, and it’s not necessarily this one. Applies in several other places.