mirror of
https://github.com/containers/podman.git
synced 2026-02-05 15:45:08 +01:00
d163c38a26
This also then bumps github.com/opencontainers/runtime-spec to v1.3.0 which contains breaking changes of the pid type as such we had to update all the podman callers. And tags.cncf.io/container-device-interface also used some changed types from it and they have been updated in main so bump to the latest commit there as well in order to get podman to compile properly. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
38 lines
1.4 KiB
Go
38 lines
1.4 KiB
Go
// Policy evaluation for the various simple PolicyRequirement types.
|
|
|
|
package signature
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"go.podman.io/image/v5/internal/private"
|
|
"go.podman.io/image/v5/transports"
|
|
)
|
|
|
|
func (pr *prInsecureAcceptAnything) isSignatureAuthorAccepted(ctx context.Context, image private.UnparsedImage, sig []byte) (signatureAcceptanceResult, *Signature, error) {
|
|
// prInsecureAcceptAnything semantics: Every image is allowed to run,
|
|
// but this does not consider the signature as verified.
|
|
return sarUnknown, nil, nil
|
|
}
|
|
|
|
func (pr *prInsecureAcceptAnything) isRunningImageAllowed(ctx context.Context, image private.UnparsedImage) (bool, error) {
|
|
return true, nil
|
|
}
|
|
|
|
func (pr *prInsecureAcceptAnything) verifiesSignatures() bool {
|
|
return false
|
|
}
|
|
|
|
func (pr *prReject) isSignatureAuthorAccepted(ctx context.Context, image private.UnparsedImage, sig []byte) (signatureAcceptanceResult, *Signature, error) {
|
|
return sarRejected, nil, PolicyRequirementError(fmt.Sprintf("Any signatures for image %s are rejected by policy.", transports.ImageName(image.Reference())))
|
|
}
|
|
|
|
func (pr *prReject) isRunningImageAllowed(ctx context.Context, image private.UnparsedImage) (bool, error) {
|
|
return false, PolicyRequirementError(fmt.Sprintf("Running image %s is rejected by policy.", transports.ImageName(image.Reference())))
|
|
}
|
|
|
|
func (pr *prReject) verifiesSignatures() bool {
|
|
return false
|
|
}
|