ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Confine image preparation beneath retained storage authority

Browse source
This commit is contained in:
ms2k 2026-07-16 20:41:26 +09:00
commit c0b139256e
3 changed files with 694 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

76
crates/lazaret-prepared-lower/src/layer.rs
View file

@ -100,6 +100,26 @@ pub(crate) struct VerifiedLayout {
diff_ids: Vec<String>,
}
pub(crate) enum LayoutSource<'a> {
Ambient(&'a Path),
Retained(&'a File),
}
impl LayoutSource<'_> {
fn open(&self, relative: &Path) -> Result<File> {
match self {
Self::Ambient(root) => Ok(File::open(root.join(relative))?),
Self::Retained(root) => Ok(File::from(openat2(
root,
relative,
OFlags::RDONLY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
Mode::empty(),
secure_resolve(),
)?)),
}
}
}
#[derive(Default)]
struct Usage {
entries: u64,
@ -107,8 +127,11 @@ struct Usage {
total_bytes: u64,
}
pub(crate) fn verify_layout(layout: &Path, limits: PreparationLimits) -> Result<VerifiedLayout> {
let index: LayoutIndex = read_json(&layout.join("index.json"), limits.max_json_bytes)?;
pub(crate) fn verify_layout(
layout: &LayoutSource<'_>,
limits: PreparationLimits,
) -> Result<VerifiedLayout> {
let index: LayoutIndex = read_json(layout, Path::new("index.json"), limits.max_json_bytes)?;
if index.manifests.len() != 1 {
bail!("selected OCI layout must contain exactly one manifest");
}
@ -138,7 +161,7 @@ pub(crate) fn verify_layout(layout: &Path, limits: PreparationLimits) -> Result<
}
pub(crate) fn apply_layout(
layout: &Path,
layout: &LayoutSource<'_>,
rootfs: &File,
verified: &VerifiedLayout,
id_map: &IdMap,
@ -157,7 +180,7 @@ pub(crate) fn apply_layout(
secure_resolve(),
)?);
let observed = decompress_layer(
&blob_path(layout, &descriptor.digest)?,
layout.open(&blob_path(&descriptor.digest)?)?,
&descriptor.media_type,
spool.try_clone()?,
limits.max_uncompressed_layer_bytes,
@ -171,48 +194,64 @@ pub(crate) fn apply_layout(
state.finish(rootfs)
}
fn read_json<T: serde::de::DeserializeOwned>(path: &Path, limit: u64) -> Result<T> {
let metadata = std::fs::metadata(path)?;
fn read_json<T: serde::de::DeserializeOwned>(
layout: &LayoutSource<'_>,
path: &Path,
limit: u64,
) -> Result<T> {
let mut file = layout.open(path)?;
let metadata = file.metadata()?;
if metadata.len() > limit {
bail!("OCI JSON exceeds {limit} bytes");
}
Ok(serde_json::from_slice(&std::fs::read(path)?)?)
let mut bytes = Vec::new();
file.read_to_end(&mut bytes)?;
Ok(serde_json::from_slice(&bytes)?)
}
fn verified_blob(layout: &Path, descriptor: &Descriptor, limit: u64) -> Result<Vec<u8>> {
let path = blob_path(layout, &descriptor.digest)?;
let metadata = std::fs::metadata(&path)?;
fn verified_blob(
layout: &LayoutSource<'_>,
descriptor: &Descriptor,
limit: u64,
) -> Result<Vec<u8>> {
let mut file = layout.open(&blob_path(&descriptor.digest)?)?;
let metadata = file.metadata()?;
if metadata.len() != descriptor.size || metadata.len() > limit {
bail!("OCI descriptor size or resource limit mismatch");
}
let bytes = std::fs::read(path)?;
let mut bytes = Vec::new();
file.read_to_end(&mut bytes)?;
if Sha256::digest(&bytes).as_slice() != parse_sha256(&descriptor.digest)? {
bail!("OCI descriptor digest mismatch");
}
Ok(bytes)
}
fn verify_blob_digest(layout: &Path, descriptor: &Descriptor, limit: u64) -> Result<()> {
let path = blob_path(layout, &descriptor.digest)?;
let metadata = std::fs::metadata(&path)?;
fn verify_blob_digest(
layout: &LayoutSource<'_>,
descriptor: &Descriptor,
limit: u64,
) -> Result<()> {
let file = layout.open(&blob_path(&descriptor.digest)?)?;
let metadata = file.metadata()?;
if metadata.len() != descriptor.size || metadata.len() > limit {
bail!("OCI layer size or resource limit mismatch");
}
let observed = digest_reader(File::open(path)?, limit, None)?;
let observed = digest_reader(file, limit, None)?;
if observed != descriptor.digest {
bail!("OCI layer digest mismatch");
}
Ok(())
}
fn blob_path(layout: &Path, digest: &str) -> Result<PathBuf> {
fn blob_path(digest: &str) -> Result<PathBuf> {
let component = digest
.strip_prefix("sha256:")
.context("only sha256 OCI descriptors are supported")?;
if component.len() != 64 || !component.bytes().all(|byte| byte.is_ascii_hexdigit()) {
bail!("invalid sha256 OCI descriptor");
}
Ok(layout.join("blobs/sha256").join(component))
Ok(Path::new("blobs/sha256").join(component))
}
fn parse_sha256(digest: &str) -> Result<[u8; 32]> {
@ -229,8 +268,7 @@ fn parse_sha256(digest: &str) -> Result<[u8; 32]> {
Ok(bytes)
}
fn decompress_layer(source: &Path, media_type: &str, output: File, limit: u64) -> Result<String> {
let input = File::open(source)?;
fn decompress_layer(input: File, media_type: &str, output: File, limit: u64) -> Result<String> {
let reader: Box<dyn Read> = match media_type {
"application/vnd.oci.image.layer.v1.tar" => Box::new(input),
"application/vnd.oci.image.layer.v1.tar+gzip" => {

104
crates/lazaret-prepared-lower/src/store.rs
View file

@ -3,10 +3,12 @@ use std::io;
use std::os::fd::AsFd;
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::path::{Path, PathBuf};
use std::sync::Arc;
use std::thread;
use std::time::{Duration, Instant};
use anyhow::{Context, Result, bail};
use lazaret_core::configuration::ConfinedPathPlan;
use lazaret_core::identity::{
DeviceId, HostPath, IdMapDigest, InodeId, PolicyId, PrepareOperationId, PreparedArtifactId,
SelectedManifestDigest, SourceIdentity,
@ -21,8 +23,10 @@ use rustix::fs::{
use sha2::{Digest, Sha256};
use crate::layer::{
IdMap, POLICY_NAME, PreparationLimits, apply_layout, remove_children, verify_layout,
IdMap, LayoutSource, POLICY_NAME, PreparationLimits, apply_layout, remove_children,
verify_layout,
};
use crate::transport::TransportedImage;
const PHYSICAL_LOCK_WAIT: Duration = Duration::from_secs(5);
const LOCK_RETRY: Duration = Duration::from_millis(2);
@ -51,7 +55,7 @@ pub enum ReclaimOutcome {
#[derive(Clone, Debug)]
pub struct PreparedLowerStore {
root: PathBuf,
root: Arc<File>,
catalog: Catalog,
limits: PreparationLimits,
}
@ -63,20 +67,43 @@ impl PreparedLowerStore {
///
/// Returns an error if the root cannot be opened or any fixed path is not a real directory.
pub fn initialize(root: impl Into<PathBuf>, catalog: Catalog) -> Result<Self> {
let root = root.into();
let root = File::open(&root).context("opening Storage Root")?;
Self::initialize_retained(root, catalog)
}
/// Retains the exact validated Storage Root and creates only fixed children beneath it.
///
/// # Errors
/// Returns an error if Storage Root authority drifts or a fixed child is not a real directory.
pub fn under_storage_root(storage_root: &ConfinedPathPlan, catalog: Catalog) -> Result<Self> {
let storage_root = File::from(
storage_root
.open_authority()
.context("opening validated Storage Root")?,
);
match mkdirat(&storage_root, "prepared-lower", Mode::from_raw_mode(0o700)) {
Ok(()) | Err(rustix::io::Errno::EXIST) => {}
Err(error) => return Err(error.into()),
}
let root = open_directory_at(&storage_root, Path::new("prepared-lower"))?;
Self::initialize_retained(root, catalog)
}
fn initialize_retained(root: File, catalog: Catalog) -> Result<Self> {
let store = Self {
root: root.into(),
root: Arc::new(root),
catalog,
limits: PreparationLimits::default(),
};
let root = File::open(&store.root).context("opening Storage Root")?;
for name in ["artifacts", "stages", "quarantine"] {
match mkdirat(&root, name, Mode::from_raw_mode(0o700)) {
match mkdirat(&store.root, name, Mode::from_raw_mode(0o700)) {
Ok(()) | Err(rustix::io::Errno::EXIST) => {}
Err(error) => return Err(error.into()),
}
open_directory_at(&root, Path::new(name))?;
open_directory_at(&store.root, Path::new(name))?;
}
open_lock_at(&root)?;
open_lock_at(&store.root)?;
Ok(store)
}
@ -93,10 +120,41 @@ impl PreparedLowerStore {
/// Refuses corrupt or unsupported OCI input, forged physical ownership, catalog conflicts,
/// resource limits, and publication failures.
pub fn prepare(&self, request: &PrepareRequest) -> Result<PreparedArtifact> {
self.prepare_from_source(request, &LayoutSource::Ambient(&request.layout_path))
}
/// Verifies and prepares an image through its retained transport-layout authority.
///
/// # Errors
/// Refuses ambient-only transported images and all normal preparation validation failures.
pub fn prepare_transported(
&self,
operation_id: PrepareOperationId,
image: &TransportedImage,
id_map: IdMap,
) -> Result<PreparedArtifact> {
let layout = image
.retained_layout()
.context("transported image has no retained layout authority")?;
let request = PrepareRequest {
operation_id,
layout_path: image.layout_path.clone(),
source_identity: image.source_identity.clone(),
selected_manifest_digest: image.selected_manifest_digest,
id_map,
};
self.prepare_from_source(&request, &LayoutSource::Retained(layout.root()))
}
fn prepare_from_source(
&self,
request: &PrepareRequest,
layout: &LayoutSource<'_>,
) -> Result<PreparedArtifact> {
if request.source_identity.is_empty() || request.source_identity.len() > 4096 {
bail!("source identity is empty or exceeds 4096 bytes");
}
let verified = verify_layout(&request.layout_path, self.limits)?;
let verified = verify_layout(layout, self.limits)?;
if request.selected_manifest_digest != verified.manifest_digest {
bail!("selected manifest identity does not match verified OCI layout");
}
@ -133,14 +191,8 @@ impl PreparedLowerStore {
}
return Err(error.into());
}
if let Err(error) = apply_layout(
&request.layout_path,
&stage,
&verified,
&request.id_map,
self.limits,
)
.and_then(|()| sync_tree(&stage))
if let Err(error) = apply_layout(layout, &stage, &verified, &request.id_map, self.limits)
.and_then(|()| sync_tree(&stage))
{
if self
.remove_exact_path(&stage_relative, device, inode)
@ -358,16 +410,15 @@ impl PreparedLowerStore {
}
fn create_stage(&self, relative: &Path) -> Result<File> {
let stages = open_directory_at(&File::open(&self.root)?, Path::new("stages"))?;
let stages = open_directory_at(&self.root, Path::new("stages"))?;
let name = relative.file_name().context("stage has no name")?;
mkdirat(&stages, name, Mode::from_raw_mode(0o700))?;
open_directory_at(&stages, Path::new(name))
}
fn open_relative(&self, relative: &Path) -> Result<Option<File>> {
let root = File::open(&self.root)?;
match openat2(
&root,
&self.root,
relative,
OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC | OFlags::NOFOLLOW,
Mode::empty(),
@ -380,30 +431,27 @@ impl PreparedLowerStore {
}
fn rename_relative(&self, from: &Path, to: &Path) -> Result<()> {
let root = File::open(&self.root)?;
renameat(&root, from, &root, to)?;
renameat(&self.root, from, &self.root, to)?;
Ok(())
}
fn rename_relative_noreplace(&self, from: &Path, to: &Path) -> Result<()> {
let root = File::open(&self.root)?;
renameat_with(&root, from, &root, to, RenameFlags::NOREPLACE)?;
renameat_with(&self.root, from, &self.root, to, RenameFlags::NOREPLACE)?;
Ok(())
}
fn remove_exact_path(&self, relative: &Path, device: DeviceId, inode: InodeId) -> Result<()> {
let root = File::open(&self.root)?;
let file = open_directory_at(&root, relative)?;
let file = open_directory_at(&self.root, relative)?;
require_identity(&file, device, inode)?;
remove_children(&file)?;
unlinkat(&root, relative, AtFlags::REMOVEDIR)?;
unlinkat(&self.root, relative, AtFlags::REMOVEDIR)?;
Ok(())
}
fn physical_lock(&self) -> Result<ExclusiveFileLock> {
let deadline = Instant::now() + PHYSICAL_LOCK_WAIT;
loop {
let file = open_lock_at(&File::open(&self.root)?)?;
let file = open_lock_at(&self.root)?;
match try_exclusive_flock(file) {
Ok(lock) => return Ok(lock),
Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
@ -419,7 +467,7 @@ impl PreparedLowerStore {
}
fn sync_fixed_directory(&self, name: &str) -> Result<()> {
open_directory_at(&File::open(&self.root)?, Path::new(name))?.sync_all()?;
open_directory_at(&self.root, Path::new(name))?.sync_all()?;
Ok(())
}
}

444
crates/lazaret-prepared-lower/src/transport.rs
View file

@ -1,12 +1,21 @@
use std::fs::{File, OpenOptions};
use std::io::{Read, Write};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::os::unix::fs::PermissionsExt;
use std::path::{Path, PathBuf};
use std::str::FromStr;
use std::{fs::OpenOptions, io::Write, os::unix::fs::PermissionsExt};
use std::sync::Arc;
use anyhow::{Context, Result, bail};
use lazaret_core::configuration::ConfinedPathPlan;
use oci_client::Reference;
use oci_client::client::{Client, ClientConfig};
use oci_client::manifest::{IMAGE_LAYER_GZIP_MEDIA_TYPE, IMAGE_LAYER_MEDIA_TYPE, OciImageManifest};
use oci_client::secrets::RegistryAuth;
use rustix::fs::{
AtFlags, Mode, OFlags, RenameFlags, ResolveFlags, fstat, mkdirat, openat2, renameat_with,
unlinkat,
};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
@ -56,11 +65,50 @@ impl std::fmt::Debug for RegistryCredentials {
}
}
#[derive(Clone, Debug)]
#[derive(Debug)]
pub struct TransportedImage {
pub layout_path: PathBuf,
pub source_identity: Vec<u8>,
pub selected_manifest_digest: [u8; 32],
retained_layout: Option<RetainedLayout>,
}
#[derive(Debug)]
pub(crate) struct RetainedLayout {
root: Arc<File>,
parent: Arc<File>,
name: String,
identity: (u64, u64),
cleanup_armed: bool,
}
impl RetainedLayout {
pub(crate) fn root(&self) -> &File {
&self.root
}
}
impl TransportedImage {
pub(crate) fn retained_layout(&self) -> Option<&RetainedLayout> {
self.retained_layout.as_ref()
}
/// Deletes only the exact descriptor-retained transport staging leaf.
///
/// # Errors
/// Refuses a replacement path and reports any descriptor-relative cleanup failure.
pub fn cleanup(mut self) -> Result<()> {
if let Some(layout) = &mut self.retained_layout {
cleanup_retained_layout(layout)?;
}
Ok(())
}
}
impl Drop for RetainedLayout {
fn drop(&mut self) {
let _ = cleanup_retained_layout(self);
}
}
#[derive(Clone, Debug, Default)]
@ -90,12 +138,56 @@ impl OciRegistryTransport {
.await
}
/// Pulls an image into an exact descriptor-retained child of Storage Root.
///
/// # Errors
/// Refuses changed Storage Root authority, fixed-child symlinks, staging collisions,
/// authentication failures, corrupt content, and unsupported images.
pub async fn pull_confined(
&self,
reference: &str,
credentials: &RegistryCredentials,
platform: &Platform,
storage_root: &ConfinedPathPlan,
staging_id: [u8; 32],
) -> Result<TransportedImage> {
self.pull_to(
reference,
credentials,
platform,
LayoutDestination::Confined {
storage_root,
staging_id,
},
ClientConfig::default(),
)
.await
}
async fn pull_with_config(
&self,
reference: &str,
credentials: &RegistryCredentials,
platform: &Platform,
layout_path: &Path,
config: ClientConfig,
) -> Result<TransportedImage> {
self.pull_to(
reference,
credentials,
platform,
LayoutDestination::Ambient(layout_path),
config,
)
.await
}
async fn pull_to(
&self,
reference: &str,
credentials: &RegistryCredentials,
platform: &Platform,
destination: LayoutDestination<'_>,
mut config: ClientConfig,
) -> Result<TransportedImage> {
validate_credentials(credentials)?;
@ -131,39 +223,35 @@ impl OciRegistryTransport {
}
verify_platform(&config_json, platform)?;
validate_manifest(&manifest)?;
create_layout(layout_path)?;
let blobs = layout_path.join("blobs/sha256");
write_verified_blob(&blobs, &manifest.config.digest, config_json.as_bytes())?;
let layout = LayoutWriter::create(destination)?;
layout.write_verified_blob(&manifest.config.digest, config_json.as_bytes())?;
for descriptor in &manifest.layers {
let size = u64::try_from(descriptor.size).context("negative OCI layer size")?;
if size > MAX_LAYER_BYTES {
bail!("OCI layer exceeds {MAX_LAYER_BYTES} bytes");
}
let digest_component = digest_component(&descriptor.digest)?;
let path = blobs.join(digest_component);
if path.exists() {
require_existing_blob(&path, &descriptor.digest, size)?;
if layout.blob_exists(digest_component)? {
layout.require_existing_blob(&descriptor.digest, size)?;
continue;
}
let file = tokio::fs::OpenOptions::new()
.create_new(true)
.write(true)
.open(&path)
.await?;
let (file, temporary) = layout.create_blob(digest_component)?;
let file = tokio::fs::File::from_std(file);
if let Err(error) = client.pull_blob(&reference, descriptor, file).await {
let _ = std::fs::remove_file(&path);
layout.remove_temporary_blob(&temporary);
return Err(error)
.with_context(|| format!("pulling OCI layer {}", descriptor.digest));
}
let observed = std::fs::metadata(&path)?.len();
let observed = layout.temporary_blob_size(&temporary)?;
if observed != size {
bail!("OCI layer {} size mismatch", descriptor.digest);
}
layout.publish_blob(&temporary, digest_component)?;
}
let local_manifest = serde_json::to_vec(&manifest)?;
let local_digest = format!("sha256:{}", hex(&Sha256::digest(&local_manifest)));
write_verified_blob(&blobs, &local_digest, &local_manifest)?;
write_layout_index(layout_path, &local_digest, local_manifest.len())?;
layout.write_verified_blob(&local_digest, &local_manifest)?;
layout.write_layout_index(&local_digest, local_manifest.len())?;
let selected_manifest_digest = parse_sha256(&local_digest)?;
let source_identity = format!(
"oci-v1\0{}\0{}\0{manifest_digest}",
@ -172,9 +260,10 @@ impl OciRegistryTransport {
)
.into_bytes();
Ok(TransportedImage {
layout_path: layout_path.to_owned(),
layout_path: layout.label().to_owned(),
source_identity,
selected_manifest_digest,
retained_layout: layout.into_retained(),
})
}
}
@ -237,6 +326,297 @@ fn validate_manifest(manifest: &OciImageManifest) -> Result<()> {
Ok(())
}
#[derive(Clone, Copy)]
enum LayoutDestination<'a> {
Ambient(&'a Path),
Confined {
storage_root: &'a ConfinedPathPlan,
staging_id: [u8; 32],
},
}
enum LayoutWriter {
Ambient(PathBuf),
Confined {
layout: RetainedLayout,
label: PathBuf,
},
}
impl LayoutWriter {
fn create(destination: LayoutDestination<'_>) -> Result<Self> {
match destination {
LayoutDestination::Ambient(path) => {
create_layout(path)?;
Ok(Self::Ambient(path.to_owned()))
}
LayoutDestination::Confined {
storage_root,
staging_id,
} => {
let storage = File::from(storage_root.open_authority()?);
create_directory(&storage, "image-transports")?;
let parent = Arc::new(open_directory(&storage, Path::new("image-transports"))?);
let name = hex(&staging_id);
mkdirat(&parent, name.as_str(), Mode::from_raw_mode(0o700))?;
let root = Arc::new(open_directory(&parent, Path::new(&name))?);
let stat = fstat(&root)?;
create_directory(&root, "blobs")?;
let blobs = open_directory(&root, Path::new("blobs"))?;
create_directory(&blobs, "sha256")?;
write_relative_atomic(
&root,
Path::new("oci-layout"),
b"{\"imageLayoutVersion\":\"1.0.0\"}\n",
)?;
let label = PathBuf::from(std::ffi::OsString::from_vec(
storage_root.canonical_label().as_bytes().to_vec(),
))
.join("image-transports")
.join(&name);
Ok(Self::Confined {
layout: RetainedLayout {
root,
parent,
name,
identity: (stat.st_dev, stat.st_ino),
cleanup_armed: true,
},
label,
})
}
}
}
fn label(&self) -> &Path {
match self {
Self::Ambient(path) => path,
Self::Confined { label, .. } => label,
}
}
fn into_retained(self) -> Option<RetainedLayout> {
match self {
Self::Ambient(_) => None,
Self::Confined { layout, .. } => Some(layout),
}
}
fn write_verified_blob(&self, digest: &str, bytes: &[u8]) -> Result<()> {
if parse_sha256(digest)? != Sha256::digest(bytes).as_slice() {
bail!("OCI descriptor digest mismatch for {digest}");
}
let component = digest_component(digest)?;
if self.blob_exists(component)? {
return self.require_existing_blob(digest, bytes.len() as u64);
}
let (mut file, temporary) = self.create_blob(component)?;
file.write_all(bytes)?;
file.sync_all()?;
self.publish_blob(&temporary, component)
}
fn blob_exists(&self, component: &str) -> Result<bool> {
match self {
Self::Ambient(path) => Ok(path.join("blobs/sha256").join(component).exists()),
Self::Confined { layout, .. } => match open_relative_file(
layout.root(),
&Path::new("blobs/sha256").join(component),
OFlags::RDONLY,
) {
Ok(_) => Ok(true),
Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(false),
Err(error) => Err(error.into()),
},
}
}
fn require_existing_blob(&self, digest: &str, size: u64) -> Result<()> {
let mut file = self.open_blob(digest_component(digest)?)?;
let mut bytes = Vec::new();
file.read_to_end(&mut bytes)?;
if bytes.len() as u64 != size || parse_sha256(digest)? != Sha256::digest(&bytes).as_slice()
{
bail!("existing OCI blob does not match its descriptor");
}
Ok(())
}
fn open_blob(&self, component: &str) -> Result<File> {
match self {
Self::Ambient(path) => Ok(File::open(path.join("blobs/sha256").join(component))?),
Self::Confined { layout, .. } => Ok(open_relative_file(
layout.root(),
&Path::new("blobs/sha256").join(component),
OFlags::RDONLY,
)?),
}
}
fn create_blob(&self, component: &str) -> Result<(File, String)> {
let temporary = format!(".{component}.partial");
match self {
Self::Ambient(path) => Ok((
OpenOptions::new()
.create_new(true)
.write(true)
.open(path.join("blobs/sha256").join(&temporary))?,
temporary,
)),
Self::Confined { layout, .. } => Ok((
open_relative_file(
layout.root(),
&Path::new("blobs/sha256").join(&temporary),
OFlags::CREATE | OFlags::EXCL | OFlags::WRONLY,
)?,
temporary,
)),
}
}
fn temporary_blob_size(&self, temporary: &str) -> Result<u64> {
Ok(fstat(&self.open_blob(temporary)?)?.st_size.cast_unsigned())
}
fn publish_blob(&self, temporary: &str, component: &str) -> Result<()> {
match self {
Self::Ambient(path) => {
std::fs::rename(
path.join("blobs/sha256").join(temporary),
path.join("blobs/sha256").join(component),
)?;
}
Self::Confined { layout, .. } => {
let blobs = open_directory(layout.root(), Path::new("blobs/sha256"))?;
renameat_with(&blobs, temporary, &blobs, component, RenameFlags::NOREPLACE)?;
blobs.sync_all()?;
}
}
Ok(())
}
fn remove_temporary_blob(&self, temporary: &str) {
match self {
Self::Ambient(path) => {
let _ = std::fs::remove_file(path.join("blobs/sha256").join(temporary));
}
Self::Confined { layout, .. } => {
let _ = unlinkat(
layout.root(),
Path::new("blobs/sha256").join(temporary),
AtFlags::empty(),
);
}
}
}
fn write_layout_index(&self, digest: &str, size: usize) -> Result<()> {
let bytes = layout_index(digest, size)?;
match self {
Self::Ambient(path) => std::fs::write(path.join("index.json"), bytes)?,
Self::Confined { layout, .. } => {
write_relative_atomic(layout.root(), Path::new("index.json"), &bytes)?;
}
}
Ok(())
}
}
fn create_directory(parent: &File, path: &str) -> Result<()> {
match mkdirat(parent, path, Mode::from_raw_mode(0o700)) {
Ok(()) | Err(rustix::io::Errno::EXIST) => {}
Err(error) => return Err(error.into()),
}
drop(open_directory(parent, Path::new(path))?);
Ok(())
}
fn open_directory(parent: &File, path: &Path) -> std::io::Result<File> {
openat2(
parent,
path,
OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC,
Mode::empty(),
confined_resolve(),
)
.map(File::from)
.map_err(Into::into)
}
fn open_relative_file(parent: &File, path: &Path, flags: OFlags) -> std::io::Result<File> {
openat2(
parent,
path,
flags | OFlags::NOFOLLOW | OFlags::CLOEXEC,
Mode::from_raw_mode(0o600),
confined_resolve(),
)
.map(File::from)
.map_err(Into::into)
}
fn write_relative_atomic(root: &File, path: &Path, bytes: &[u8]) -> Result<()> {
let name = path.file_name().context("layout file has no name")?;
let parent_path = path.parent().unwrap_or(Path::new("."));
let parent = open_directory(root, parent_path)?;
let temporary = format!(".{}.partial", name.to_string_lossy());
let mut file = open_relative_file(
&parent,
Path::new(&temporary),
OFlags::CREATE | OFlags::EXCL | OFlags::WRONLY,
)?;
file.write_all(bytes)?;
file.sync_all()?;
renameat_with(&parent, temporary, &parent, name, RenameFlags::NOREPLACE)?;
parent.sync_all()?;
Ok(())
}
fn confined_resolve() -> ResolveFlags {
ResolveFlags::BENEATH
| ResolveFlags::NO_MAGICLINKS
| ResolveFlags::NO_SYMLINKS
| ResolveFlags::NO_XDEV
}
fn cleanup_retained_layout(layout: &mut RetainedLayout) -> Result<()> {
if !layout.cleanup_armed {
return Ok(());
}
let current = open_directory(&layout.parent, Path::new(&layout.name))?;
let stat = fstat(&current)?;
if (stat.st_dev, stat.st_ino) != layout.identity {
bail!("transport staging path no longer names the retained layout");
}
remove_layout_children(&layout.root)?;
unlinkat(&layout.parent, layout.name.as_str(), AtFlags::REMOVEDIR)?;
layout.cleanup_armed = false;
Ok(())
}
fn remove_layout_children(directory: &File) -> Result<()> {
let mut buffer = [std::mem::MaybeUninit::<u8>::uninit(); 4096];
let mut entries = rustix::fs::RawDir::new(rustix::io::dup(directory)?, &mut buffer);
while let Some(entry) = entries.next() {
let entry = entry?;
let name = entry.file_name();
if name.to_bytes() == b"." || name.to_bytes() == b".." {
continue;
}
if entry.file_type() == rustix::fs::FileType::Directory {
let child = open_directory(
directory,
Path::new(std::ffi::OsStr::from_bytes(name.to_bytes())),
)?;
remove_layout_children(&child)?;
unlinkat(directory, name, AtFlags::REMOVEDIR)?;
} else {
unlinkat(directory, name, AtFlags::empty())?;
}
}
Ok(())
}
fn create_layout(path: &Path) -> Result<()> {
std::fs::create_dir(path).context("creating private OCI layout")?;
std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))?;
@ -253,29 +633,6 @@ fn create_layout(path: &Path) -> Result<()> {
Ok(())
}
fn write_verified_blob(blobs: &Path, digest: &str, bytes: &[u8]) -> Result<()> {
if parse_sha256(digest)? != Sha256::digest(bytes).as_slice() {
bail!("OCI descriptor digest mismatch for {digest}");
}
let path = blobs.join(digest_component(digest)?);
match OpenOptions::new().create_new(true).write(true).open(&path) {
Ok(mut file) => file.write_all(bytes)?,
Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
require_existing_blob(&path, digest, bytes.len() as u64)?;
}
Err(error) => return Err(error.into()),
}
Ok(())
}
fn require_existing_blob(path: &Path, digest: &str, size: u64) -> Result<()> {
let bytes = std::fs::read(path)?;
if bytes.len() as u64 != size || parse_sha256(digest)? != Sha256::digest(&bytes).as_slice() {
bail!("existing OCI blob does not match its descriptor");
}
Ok(())
}
#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
struct LayoutIndex<'a> {
@ -291,7 +648,7 @@ struct LayoutDescriptor<'a> {
size: usize,
}
fn write_layout_index(path: &Path, digest: &str, size: usize) -> Result<()> {
fn layout_index(digest: &str, size: usize) -> Result<Vec<u8>> {
let index = LayoutIndex {
schema_version: 2,
manifests: [LayoutDescriptor {
@ -300,8 +657,7 @@ fn write_layout_index(path: &Path, digest: &str, size: usize) -> Result<()> {
size,
}],
};
std::fs::write(path.join("index.json"), serde_json::to_vec(&index)?)?;
Ok(())
Ok(serde_json::to_vec(&index)?)
}
fn digest_component(digest: &str) -> Result<&str> {