From 46e0317bc166b04070366b1012b6cd87f905d0fa Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 3 Dec 2022 18:08:29 +0100 Subject: [PATCH 1/5] [23.0] remove libtrust tests This is a subset of 1981706196164984ea6b75f0c8b7318c7fd6ca5a on master, preserving the tests for migrating the key to engine-id. Signed-off-by: Sebastiaan van Stijn --- integration-cli/docker_cli_daemon_test.go | 73 ----------------------- integration/daemon/daemon_test.go | 19 ------ 2 files changed, 92 deletions(-) diff --git a/integration-cli/docker_cli_daemon_test.go b/integration-cli/docker_cli_daemon_test.go index 804e77a37d..f3f8030dee 100644 --- a/integration-cli/docker_cli_daemon_test.go +++ b/integration-cli/docker_cli_daemon_test.go @@ -35,7 +35,6 @@ import ( "github.com/docker/docker/opts" testdaemon "github.com/docker/docker/testutil/daemon" units "github.com/docker/go-units" - "github.com/docker/libtrust" "github.com/moby/sys/mount" "golang.org/x/sys/unix" "gotest.tools/v3/assert" @@ -556,24 +555,6 @@ func (s *DockerDaemonSuite) TestDaemonAllocatesListeningPort(c *testing.T) { } } -func (s *DockerDaemonSuite) TestDaemonKeyGeneration(c *testing.T) { - // TODO: skip or update for Windows daemon - os.Remove("/etc/docker/key.json") - c.Setenv("DOCKER_ALLOW_SCHEMA1_PUSH_DONOTUSE", "1") - s.d.Start(c) - s.d.Stop(c) - - k, err := libtrust.LoadKeyFile("/etc/docker/key.json") - if err != nil { - c.Fatalf("Error opening key file") - } - kid := k.KeyID() - // Test Key ID is a valid fingerprint (e.g. QQXN:JY5W:TBXI:MK3X:GX6P:PD5D:F56N:NHCS:LVRZ:JA46:R24J:XEFF) - if len(kid) != 59 { - c.Fatalf("Bad key ID: %s", kid) - } -} - // GH#11320 - verify that the daemon exits on failure properly // Note that this explicitly tests the conflict of {-b,--bridge} and {--bip} options as the means // to get a daemon init failure; no other tests for -b/--bip conflict are therefore required @@ -1201,60 +1182,6 @@ func (s *DockerDaemonSuite) TestDaemonUnixSockCleanedUp(c *testing.T) { } } -func (s *DockerDaemonSuite) TestDaemonWithWrongkey(c *testing.T) { - type Config struct { - Crv string `json:"crv"` - D string `json:"d"` - Kid string `json:"kid"` - Kty string `json:"kty"` - X string `json:"x"` - Y string `json:"y"` - } - - os.Remove("/etc/docker/key.json") - c.Setenv("DOCKER_ALLOW_SCHEMA1_PUSH_DONOTUSE", "1") - s.d.Start(c) - s.d.Stop(c) - - config := &Config{} - bytes, err := os.ReadFile("/etc/docker/key.json") - if err != nil { - c.Fatalf("Error reading key.json file: %s", err) - } - - // byte[] to Data-Struct - if err := json.Unmarshal(bytes, &config); err != nil { - c.Fatalf("Error Unmarshal: %s", err) - } - - // replace config.Kid with the fake value - config.Kid = "VSAJ:FUYR:X3H2:B2VZ:KZ6U:CJD5:K7BX:ZXHY:UZXT:P4FT:MJWG:HRJ4" - - // NEW Data-Struct to byte[] - newBytes, err := json.Marshal(&config) - if err != nil { - c.Fatalf("Error Marshal: %s", err) - } - - // write back - if err := os.WriteFile("/etc/docker/key.json", newBytes, 0400); err != nil { - c.Fatalf("Error os.WriteFile: %s", err) - } - - defer os.Remove("/etc/docker/key.json") - - if err := s.d.StartWithError(); err == nil { - c.Fatalf("It should not be successful to start daemon with wrong key: %v", err) - } - - content, err := s.d.ReadLogFile() - assert.Assert(c, err == nil) - - if !strings.Contains(string(content), "Public Key ID does not match") { - c.Fatalf("Missing KeyID message from daemon logs: %s", string(content)) - } -} - func (s *DockerDaemonSuite) TestDaemonRestartKillWait(c *testing.T) { s.d.StartWithBusybox(c) diff --git a/integration/daemon/daemon_test.go b/integration/daemon/daemon_test.go index 42e4155269..344a592c26 100644 --- a/integration/daemon/daemon_test.go +++ b/integration/daemon/daemon_test.go @@ -29,25 +29,6 @@ const ( libtrustKeyID = "WTJ3:YSIP:CE2E:G6KJ:PSBD:YX2Y:WEYD:M64G:NU2V:XPZV:H2CR:VLUB" ) -func TestConfigDaemonLibtrustID(t *testing.T) { - skip.If(t, runtime.GOOS == "windows") - - d := daemon.New(t) - defer d.Stop(t) - - trustKey := filepath.Join(d.RootDir(), "key.json") - err := os.WriteFile(trustKey, []byte(libtrustKey), 0644) - assert.NilError(t, err) - - cfg := filepath.Join(d.RootDir(), "daemon.json") - err = os.WriteFile(cfg, []byte(`{"deprecated-key-path": "`+trustKey+`"}`), 0644) - assert.NilError(t, err) - - d.Start(t, "--config-file", cfg) - info := d.Info(t) - assert.Equal(t, info.ID, libtrustKeyID) -} - func TestConfigDaemonID(t *testing.T) { skip.If(t, runtime.GOOS == "windows") From 139080d093a3b38d8be79eed123d68dbc905f8e2 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 19 Oct 2022 15:29:16 +0200 Subject: [PATCH 2/5] daemon/config: remove and local trustkey utilities Turned out that the loadOrCreateTrustKey() utility was doing exactly the same as libtrust.LoadOrCreateTrustKey(), so making it a thin wrapped. I kept the tests to verify the behavior, but we could remove them as we only need this for our integration tests. The storage location for the generated key was changed (again as we only need this for some integration tests), so we can remove the TrustKeyPath from the config. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 5cdd6ab7cd4af97da2150cd649acfdb19ea8d700) Signed-off-by: Sebastiaan van Stijn --- cmd/dockerd/daemon_windows.go | 2 +- cmd/dockerd/docker_windows.go | 2 +- daemon/trustkey.go | 54 ++--------------------------------- daemon/trustkey_test.go | 22 ++++---------- 4 files changed, 10 insertions(+), 70 deletions(-) diff --git a/cmd/dockerd/daemon_windows.go b/cmd/dockerd/daemon_windows.go index 08a77b7cb8..c592e286e3 100644 --- a/cmd/dockerd/daemon_windows.go +++ b/cmd/dockerd/daemon_windows.go @@ -24,7 +24,7 @@ func setDefaultUmask() error { } func getDaemonConfDir(root string) (string, error) { - return filepath.Join(root, `\config`), nil + return filepath.Join(root, "config"), nil } // preNotifyReady sends a message to the host when the API is active, but before the daemon is diff --git a/cmd/dockerd/docker_windows.go b/cmd/dockerd/docker_windows.go index 9295741217..f0c225a64b 100644 --- a/cmd/dockerd/docker_windows.go +++ b/cmd/dockerd/docker_windows.go @@ -24,7 +24,7 @@ func runDaemon(opts *daemonOptions) error { // Windows specific settings as these are not defaulted. if opts.configFile == "" { - opts.configFile = filepath.Join(opts.daemonConfig.Root, `config\daemon.json`) + opts.configFile = filepath.Join(opts.daemonConfig.Root, "config", "daemon.json") } if runAsService { // If Windows SCM manages the service - no need for PID files diff --git a/daemon/trustkey.go b/daemon/trustkey.go index a6b662d7c9..8d1da5aaa7 100644 --- a/daemon/trustkey.go +++ b/daemon/trustkey.go @@ -1,57 +1,9 @@ package daemon // import "github.com/docker/docker/daemon" -import ( - "encoding/json" - "encoding/pem" - "fmt" - "os" - "path/filepath" - - "github.com/docker/docker/pkg/ioutils" - "github.com/docker/docker/pkg/system" - "github.com/docker/libtrust" -) +import "github.com/docker/libtrust" // LoadOrCreateTrustKey attempts to load the libtrust key at the given path, -// otherwise generates a new one -// TODO: this should use more of libtrust.LoadOrCreateTrustKey which may need -// a refactor or this function to be moved into libtrust +// otherwise generates a new one. func loadOrCreateTrustKey(trustKeyPath string) (libtrust.PrivateKey, error) { - err := system.MkdirAll(filepath.Dir(trustKeyPath), 0755) - if err != nil { - return nil, err - } - trustKey, err := libtrust.LoadKeyFile(trustKeyPath) - if err == libtrust.ErrKeyFileDoesNotExist { - trustKey, err = libtrust.GenerateECP256PrivateKey() - if err != nil { - return nil, fmt.Errorf("Error generating key: %s", err) - } - encodedKey, err := serializePrivateKey(trustKey, filepath.Ext(trustKeyPath)) - if err != nil { - return nil, fmt.Errorf("Error serializing key: %s", err) - } - if err := ioutils.AtomicWriteFile(trustKeyPath, encodedKey, os.FileMode(0600)); err != nil { - return nil, fmt.Errorf("Error saving key file: %s", err) - } - } else if err != nil { - return nil, fmt.Errorf("Error loading key file %s: %s", trustKeyPath, err) - } - return trustKey, nil -} - -func serializePrivateKey(key libtrust.PrivateKey, ext string) (encoded []byte, err error) { - if ext == ".json" || ext == ".jwk" { - encoded, err = json.Marshal(key) - if err != nil { - return nil, fmt.Errorf("unable to encode private key JWK: %s", err) - } - } else { - pemBlock, err := key.PEMBlock() - if err != nil { - return nil, fmt.Errorf("unable to encode private key PEM: %s", err) - } - encoded = pem.EncodeToMemory(pemBlock) - } - return + return libtrust.LoadOrCreateTrustKey(trustKeyPath) } diff --git a/daemon/trustkey_test.go b/daemon/trustkey_test.go index fcc57b12bf..1ea66b65b3 100644 --- a/daemon/trustkey_test.go +++ b/daemon/trustkey_test.go @@ -7,29 +7,20 @@ import ( "gotest.tools/v3/assert" is "gotest.tools/v3/assert/cmp" - "gotest.tools/v3/fs" ) // LoadOrCreateTrustKey func TestLoadOrCreateTrustKeyInvalidKeyFile(t *testing.T) { - tmpKeyFolderPath, err := os.MkdirTemp("", "api-trustkey-test") + tmpKeyFile, err := os.CreateTemp(t.TempDir(), "keyfile") assert.NilError(t, err) - defer os.RemoveAll(tmpKeyFolderPath) - - tmpKeyFile, err := os.CreateTemp(tmpKeyFolderPath, "keyfile") - assert.NilError(t, err) - defer tmpKeyFile.Close() + _ = tmpKeyFile.Close() _, err = loadOrCreateTrustKey(tmpKeyFile.Name()) - assert.Check(t, is.ErrorContains(err, "Error loading key file")) + assert.Check(t, is.ErrorContains(err, "error loading key file")) } func TestLoadOrCreateTrustKeyCreateKeyWhenFileDoesNotExist(t *testing.T) { - tmpKeyFolderPath := fs.NewDir(t, "api-trustkey-test") - defer tmpKeyFolderPath.Remove() - - // Without the need to create the folder hierarchy - tmpKeyFile := tmpKeyFolderPath.Join("keyfile") + tmpKeyFile := filepath.Join(t.TempDir(), "keyfile") key, err := loadOrCreateTrustKey(tmpKeyFile) assert.NilError(t, err) @@ -40,10 +31,7 @@ func TestLoadOrCreateTrustKeyCreateKeyWhenFileDoesNotExist(t *testing.T) { } func TestLoadOrCreateTrustKeyCreateKeyWhenDirectoryDoesNotExist(t *testing.T) { - tmpKeyFolderPath := fs.NewDir(t, "api-trustkey-test") - defer tmpKeyFolderPath.Remove() - tmpKeyFile := tmpKeyFolderPath.Join("folder/hierarchy/keyfile") - + tmpKeyFile := filepath.Join(t.TempDir(), "folder/hierarchy/keyfile") key, err := loadOrCreateTrustKey(tmpKeyFile) assert.NilError(t, err) assert.Check(t, key != nil) From f2463e1e86d50f81af615a23101c385d09ea366d Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sun, 27 Nov 2022 15:16:16 +0100 Subject: [PATCH 3/5] distribution: use ad-hoc trustkey for tests Signed-off-by: Sebastiaan van Stijn (cherry picked from commit e854b2a4592e07486be9111ca7715c546091522e) Signed-off-by: Sebastiaan van Stijn --- distribution/push_v2.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/distribution/push_v2.go b/distribution/push_v2.go index 910123250c..5c540c0c5b 100644 --- a/distribution/push_v2.go +++ b/distribution/push_v2.go @@ -24,6 +24,7 @@ import ( "github.com/docker/docker/pkg/progress" "github.com/docker/docker/pkg/stringid" "github.com/docker/docker/registry" + "github.com/docker/libtrust" "github.com/opencontainers/go-digest" "github.com/pkg/errors" "github.com/sirupsen/logrus" @@ -187,7 +188,7 @@ func (p *pusher) pushTag(ctx context.Context, ref reference.NamedTagged, id dige putOptions := []distribution.ManifestServiceOption{distribution.WithTag(ref.Tag())} if _, err = manSvc.Put(ctx, manifest, putOptions...); err != nil { - if runtime.GOOS == "windows" || p.config.TrustKey == nil || p.config.RequireSchema2 { + if runtime.GOOS == "windows" || p.config.RequireSchema2 { logrus.Warnf("failed to upload schema2 manifest: %v", err) return err } @@ -211,7 +212,11 @@ func (p *pusher) pushTag(ctx context.Context, ref reference.NamedTagged, id dige if err != nil { return err } - builder = schema1.NewConfigManifestBuilder(p.repo.Blobs(ctx), p.config.TrustKey, manifestRef, imgConfig) + pk, err := libtrust.GenerateECP256PrivateKey() + if err != nil { + return errors.Wrap(err, "unexpected error generating private key") + } + builder = schema1.NewConfigManifestBuilder(p.repo.Blobs(ctx), pk, manifestRef, imgConfig) manifest, err = manifestFromBuilder(ctx, builder, descriptors) if err != nil { return err From e7b26fa1b1ce17421228b507009d6fd88ad1ed6e Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sun, 27 Nov 2022 15:25:00 +0100 Subject: [PATCH 4/5] use ad-hoc libtrust key This is only used for tests, and the key is not verified anymore, so instead of creating a key and storing it, we can just use an ad-hoc one. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 8feeaecb84cabb415a0d68db01f2bb425527f67c) Signed-off-by: Sebastiaan van Stijn --- cmd/dockerd/options.go | 2 -- daemon/daemon.go | 13 -------- daemon/images/image_push.go | 1 - daemon/images/service.go | 4 --- daemon/trustkey.go | 9 ------ daemon/trustkey_test.go | 59 ------------------------------------- distribution/config.go | 4 --- 7 files changed, 92 deletions(-) delete mode 100644 daemon/trustkey.go delete mode 100644 daemon/trustkey_test.go diff --git a/cmd/dockerd/options.go b/cmd/dockerd/options.go index c4649ded51..a9c336c357 100644 --- a/cmd/dockerd/options.go +++ b/cmd/dockerd/options.go @@ -65,8 +65,6 @@ func (o *daemonOptions) installFlags(flags *pflag.FlagSet) { flags.BoolVar(&o.TLS, FlagTLS, DefaultTLSValue, "Use TLS; implied by --tlsverify") flags.BoolVar(&o.TLSVerify, FlagTLSVerify, dockerTLSVerify || DefaultTLSValue, "Use TLS and verify the remote") - // TODO use flag flags.String("identity"}, "i", "", "Path to libtrust key file") - o.TLSOptions = &tlsconfig.Options{} tlsOptions := o.TLSOptions flags.StringVar(&tlsOptions.CAFile, "tlscacert", filepath.Join(dockerCertPath, DefaultCaFile), "Trust certs signed only by this CA") diff --git a/daemon/daemon.go b/daemon/daemon.go index 3cf256a751..935a7b44ee 100644 --- a/daemon/daemon.go +++ b/daemon/daemon.go @@ -1053,19 +1053,6 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S ContentNamespace: config.ContainerdNamespace, } - // This is a temporary environment variables used in CI to allow pushing - // manifest v2 schema 1 images to test-registries used for testing *pulling* - // these images. - if os.Getenv("DOCKER_ALLOW_SCHEMA1_PUSH_DONOTUSE") != "" { - imgSvcConfig.TrustKey, err = loadOrCreateTrustKey(config.TrustKeyPath) - if err != nil { - return nil, err - } - if err = system.MkdirAll(filepath.Join(config.Root, "trust"), 0700); err != nil { - return nil, err - } - } - // containerd is not currently supported with Windows. // So sometimes d.containerdCli will be nil // In that case we'll create a local content store... but otherwise we'll use containerd diff --git a/daemon/images/image_push.go b/daemon/images/image_push.go index 302ffd8eec..ece46d27ae 100644 --- a/daemon/images/image_push.go +++ b/daemon/images/image_push.go @@ -54,7 +54,6 @@ func (i *ImageService) PushImage(ctx context.Context, image, tag string, metaHea }, ConfigMediaType: schema2.MediaTypeImageConfig, LayerStores: distribution.NewLayerProvidersFromStore(i.layerStore), - TrustKey: i.trustKey, UploadManager: i.uploadManager, } diff --git a/daemon/images/service.go b/daemon/images/service.go index b1fdcc11ba..2b6532170c 100644 --- a/daemon/images/service.go +++ b/daemon/images/service.go @@ -17,7 +17,6 @@ import ( "github.com/docker/docker/layer" dockerreference "github.com/docker/docker/reference" "github.com/docker/docker/registry" - "github.com/docker/libtrust" "github.com/opencontainers/go-digest" "github.com/pkg/errors" "golang.org/x/sync/singleflight" @@ -44,7 +43,6 @@ type ImageServiceConfig struct { MaxDownloadAttempts int ReferenceStore dockerreference.Store RegistryService registry.Service - TrustKey libtrust.PrivateKey ContentStore content.Store Leases leases.Manager ContentNamespace string @@ -61,7 +59,6 @@ func NewImageService(config ImageServiceConfig) *ImageService { layerStore: config.LayerStore, referenceStore: config.ReferenceStore, registryService: config.RegistryService, - trustKey: config.TrustKey, uploadManager: xfer.NewLayerUploadManager(config.MaxConcurrentUploads), leases: config.Leases, content: config.ContentStore, @@ -80,7 +77,6 @@ type ImageService struct { pruneRunning int32 referenceStore dockerreference.Store registryService registry.Service - trustKey libtrust.PrivateKey uploadManager *xfer.LayerUploadManager leases leases.Manager content content.Store diff --git a/daemon/trustkey.go b/daemon/trustkey.go deleted file mode 100644 index 8d1da5aaa7..0000000000 --- a/daemon/trustkey.go +++ /dev/null @@ -1,9 +0,0 @@ -package daemon // import "github.com/docker/docker/daemon" - -import "github.com/docker/libtrust" - -// LoadOrCreateTrustKey attempts to load the libtrust key at the given path, -// otherwise generates a new one. -func loadOrCreateTrustKey(trustKeyPath string) (libtrust.PrivateKey, error) { - return libtrust.LoadOrCreateTrustKey(trustKeyPath) -} diff --git a/daemon/trustkey_test.go b/daemon/trustkey_test.go deleted file mode 100644 index 1ea66b65b3..0000000000 --- a/daemon/trustkey_test.go +++ /dev/null @@ -1,59 +0,0 @@ -package daemon // import "github.com/docker/docker/daemon" - -import ( - "os" - "path/filepath" - "testing" - - "gotest.tools/v3/assert" - is "gotest.tools/v3/assert/cmp" -) - -// LoadOrCreateTrustKey -func TestLoadOrCreateTrustKeyInvalidKeyFile(t *testing.T) { - tmpKeyFile, err := os.CreateTemp(t.TempDir(), "keyfile") - assert.NilError(t, err) - _ = tmpKeyFile.Close() - - _, err = loadOrCreateTrustKey(tmpKeyFile.Name()) - assert.Check(t, is.ErrorContains(err, "error loading key file")) -} - -func TestLoadOrCreateTrustKeyCreateKeyWhenFileDoesNotExist(t *testing.T) { - tmpKeyFile := filepath.Join(t.TempDir(), "keyfile") - - key, err := loadOrCreateTrustKey(tmpKeyFile) - assert.NilError(t, err) - assert.Check(t, key != nil) - - _, err = os.Stat(tmpKeyFile) - assert.NilError(t, err, "key file doesn't exist") -} - -func TestLoadOrCreateTrustKeyCreateKeyWhenDirectoryDoesNotExist(t *testing.T) { - tmpKeyFile := filepath.Join(t.TempDir(), "folder/hierarchy/keyfile") - key, err := loadOrCreateTrustKey(tmpKeyFile) - assert.NilError(t, err) - assert.Check(t, key != nil) - - _, err = os.Stat(tmpKeyFile) - assert.NilError(t, err, "key file doesn't exist") -} - -func TestLoadOrCreateTrustKeyCreateKeyNoPath(t *testing.T) { - defer os.Remove("keyfile") - key, err := loadOrCreateTrustKey("keyfile") - assert.NilError(t, err) - assert.Check(t, key != nil) - - _, err = os.Stat("keyfile") - assert.NilError(t, err, "key file doesn't exist") -} - -func TestLoadOrCreateTrustKeyLoadValidKey(t *testing.T) { - tmpKeyFile := filepath.Join("testdata", "keyfile") - key, err := loadOrCreateTrustKey(tmpKeyFile) - assert.NilError(t, err) - expected := "AWX2:I27X:WQFX:IOMK:CNAK:O7PW:VYNB:ZLKC:CVAE:YJP2:SI4A:XXAY" - assert.Check(t, is.Contains(key.String(), expected)) -} diff --git a/distribution/config.go b/distribution/config.go index fa06e3c9c0..afeb669060 100644 --- a/distribution/config.go +++ b/distribution/config.go @@ -17,7 +17,6 @@ import ( "github.com/docker/docker/pkg/system" refstore "github.com/docker/docker/reference" "github.com/docker/docker/registry" - "github.com/docker/libtrust" "github.com/opencontainers/go-digest" specs "github.com/opencontainers/image-spec/specs-go/v1" "github.com/pkg/errors" @@ -74,9 +73,6 @@ type ImagePushConfig struct { ConfigMediaType string // LayerStores manages layers. LayerStores PushLayerProvider - // TrustKey is the private key for legacy signatures. This is typically - // an ephemeral key, since these signatures are no longer verified. - TrustKey libtrust.PrivateKey // UploadManager dispatches uploads. UploadManager *xfer.LayerUploadManager } From 4952dc28444bee7f5cd827fb2bb92bf07a7fd361 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sun, 27 Nov 2022 15:32:02 +0100 Subject: [PATCH 5/5] distribution: remove unused RequireSchema2 It's never set, so we can remove it. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 85fddc0081339ea12e6c7bd71f702aa737f589b2) Signed-off-by: Sebastiaan van Stijn --- distribution/config.go | 2 -- distribution/pull_v2.go | 4 ---- distribution/push_v2.go | 2 +- 3 files changed, 1 insertion(+), 7 deletions(-) diff --git a/distribution/config.go b/distribution/config.go index afeb669060..3ac89ea306 100644 --- a/distribution/config.go +++ b/distribution/config.go @@ -46,8 +46,6 @@ type Config struct { // ReferenceStore manages tags. This value is optional, when excluded // content will not be tagged. ReferenceStore refstore.Store - // RequireSchema2 ensures that only schema2 manifests are used. - RequireSchema2 bool } // ImagePullConfig stores pull configuration. diff --git a/distribution/pull_v2.go b/distribution/pull_v2.go index 51ec5c311b..07adb7bf05 100644 --- a/distribution/pull_v2.go +++ b/distribution/pull_v2.go @@ -438,10 +438,6 @@ func (p *puller) pullTag(ctx context.Context, ref reference.Named, platform *spe switch v := manifest.(type) { case *schema1.SignedManifest: - if p.config.RequireSchema2 { - return false, fmt.Errorf("invalid manifest: not schema2") - } - // give registries time to upgrade to schema2 and only warn if we know a registry has been upgraded long time ago // TODO: condition to be removed if reference.Domain(ref) == "docker.io" { diff --git a/distribution/push_v2.go b/distribution/push_v2.go index 5c540c0c5b..4332c44480 100644 --- a/distribution/push_v2.go +++ b/distribution/push_v2.go @@ -188,7 +188,7 @@ func (p *pusher) pushTag(ctx context.Context, ref reference.NamedTagged, id dige putOptions := []distribution.ManifestServiceOption{distribution.WithTag(ref.Tag())} if _, err = manSvc.Put(ctx, manifest, putOptions...); err != nil { - if runtime.GOOS == "windows" || p.config.RequireSchema2 { + if runtime.GOOS == "windows" { logrus.Warnf("failed to upload schema2 manifest: %v", err) return err }