From 1b9a64e943e2233e009e01a08191b4c17580b3f6 Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Mon, 4 May 2020 13:00:35 +0200

Subject: [PATCH 1/7] oci authenticator: Accept the right docker manifest when

 authenticating

Without this I got for the fedora registry:

```

getting token for https://registry.fedoraproject.org/v2/f32/flatpak-runtime/manifests/sha256:bd83b4f6974094848efac22b933419c1dbe11b553def148a82f821faf595de8a

F: Anonymous authentication failed: Unexpected response status 404 from repo

```

(cherry picked from commit 1ee132e70e5d0cb5fa0e022c2271f76bcfd03054)

---

 common/flatpak-oci-registry.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/common/flatpak-oci-registry.c b/common/flatpak-oci-registry.c

index 2505771ee..ae363bc1a 100644

--- a/common/flatpak-oci-registry.c

+++ b/common/flatpak-oci-registry.c

@@ -1015,6 +1015,9 @@ flatpak_oci_registry_get_token (FlatpakOciRegistry *self,

   msg = soup_message_new_from_uri ("HEAD", uri);

+  soup_message_headers_replace (msg->request_headers, "Accept",

+                                FLATPAK_OCI_MEDIA_TYPE_IMAGE_MANIFEST ", " FLATPAK_DOCKER_MEDIA_TYPE_IMAGE_MANIFEST2);

+

   stream = soup_session_send (self->soup_session, msg, NULL, error);

   if (stream == NULL)

     return NULL;

From 0d4deebbd5855ceef1cdb5bac3d5c6fb630dc29e Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Mon, 4 May 2020 12:35:16 +0200

Subject: [PATCH 2/7] By default, always try to auth to OCI remotes

This makes for instance docker hub work.

(cherry picked from commit fdfcae7a91e3af207c4acec918276511f112cafe)

---

 common/flatpak-auth.c | 4 ++++

 common/flatpak-dir.c  | 5 +++++

 2 files changed, 9 insertions(+)

diff --git a/common/flatpak-auth.c b/common/flatpak-auth.c

index 9d0f689fc..9e45da41e 100644

--- a/common/flatpak-auth.c

+++ b/common/flatpak-auth.c

@@ -49,6 +49,10 @@ flatpak_auth_new_for_remote (FlatpakDir *dir,

       if (!ostree_repo_get_remote_option (repo, remote, FLATPAK_REMOTE_CONFIG_AUTHENTICATOR_NAME, NULL, &name, error))

         return NULL;

     }

+

+  if (name == NULL && flatpak_dir_get_remote_oci (dir, remote))

+    name = g_strdup ("org.flatpak.Authenticator.Oci");

+

   if (name == NULL || *name == 0 /* or if no repo */)

     {

       flatpak_fail (error, _("No authenticator configured for remote `%s`"), remote);

diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c

index 2c8e12eaf..19de4fd38 100644

--- a/common/flatpak-dir.c

+++ b/common/flatpak-dir.c

@@ -11233,6 +11233,11 @@ _flatpak_dir_get_remote_state (FlatpakDir   *self,

         }

     }

+  if (flatpak_dir_get_remote_oci (self, remote_or_uri))

+    {

+      state->default_token_type = 1;

+    }

+

   if (state->collection_id == NULL)

     {

       if (state->summary != NULL) /* In the optional case we might not have a summary */

From 77e4db40f40a92f4f7e0ddb21ae367e9a0af9cb4 Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Fri, 8 May 2020 15:09:02 +0200

Subject: [PATCH 3/7] oci: Add flatpak_oci_registry_is_local()

(cherry picked from commit d4962628aa8db6132e98660fe52aa5a9ac5d3637)

---

 common/flatpak-oci-registry-private.h | 1 +

 common/flatpak-oci-registry.c         | 6 ++++++

 2 files changed, 7 insertions(+)

diff --git a/common/flatpak-oci-registry-private.h b/common/flatpak-oci-registry-private.h

index 1804e43b6..6745c5f65 100644

--- a/common/flatpak-oci-registry-private.h

+++ b/common/flatpak-oci-registry-private.h

@@ -62,6 +62,7 @@ FlatpakOciRegistry  *  flatpak_oci_registry_new (const char           *uri,

                                                  GError              **error);

 void                   flatpak_oci_registry_set_token (FlatpakOciRegistry *self,

                                                        const char *token);

+gboolean               flatpak_oci_registry_is_local (FlatpakOciRegistry *self);

 const char          *  flatpak_oci_registry_get_uri (FlatpakOciRegistry *self);

 FlatpakOciIndex     *  flatpak_oci_registry_load_index (FlatpakOciRegistry *self,

                                                         GCancellable       *cancellable,

diff --git a/common/flatpak-oci-registry.c b/common/flatpak-oci-registry.c

index ae363bc1a..fdeee56bd 100644

--- a/common/flatpak-oci-registry.c

+++ b/common/flatpak-oci-registry.c

@@ -205,6 +205,12 @@ flatpak_oci_registry_init (FlatpakOciRegistry *self)

   self->tmp_dfd = -1;

 }

+gboolean

+flatpak_oci_registry_is_local (FlatpakOciRegistry *self)

+{

+  return self->dfd != -1;

+}

+

 const char *

 flatpak_oci_registry_get_uri (FlatpakOciRegistry *self)

 {

From 3deeea1ad50b469f7daaca7e2e0d7ba9c5efc26e Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Fri, 8 May 2020 15:10:38 +0200

Subject: [PATCH 4/7] oci: Set token on child oci registry and pass to

 system-helper

When we create a system child registry we also set the current token on

it. This is not used directly in the client, however its saved in a

file called .token and re-read in the system-helper, allowing it to

also do the remote registry operations it needs to verify the child

registry.

(cherry picked from commit 5d8fd2d1be914a26e128ab97be6f00e9c34bfa9d)

---

 common/flatpak-dir.c          |  8 ++++++--

 common/flatpak-oci-registry.c | 15 +++++++++++++++

 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c

index 19de4fd38..25f874ecf 100644

--- a/common/flatpak-dir.c

+++ b/common/flatpak-dir.c

@@ -92,6 +92,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC (AutoPolkitSubject, g_object_unref)

 static FlatpakOciRegistry *flatpak_dir_create_system_child_oci_registry (FlatpakDir   *self,

                                                                          GLnxLockFile *file_lock,

+                                                                         const char   *token,

                                                                          GError      **error);

 static OstreeRepo * flatpak_dir_create_child_repo (FlatpakDir   *self,

@@ -8602,6 +8603,7 @@ flatpak_dir_deploy_update (FlatpakDir   *self,

 static FlatpakOciRegistry *

 flatpak_dir_create_system_child_oci_registry (FlatpakDir   *self,

                                               GLnxLockFile *file_lock,

+                                              const char   *token,

                                               GError      **error)

 {

   g_autoptr(GFile) cache_dir = NULL;

@@ -8636,6 +8638,8 @@ flatpak_dir_create_system_child_oci_registry (FlatpakDir   *self,

   if (new_registry == NULL)

     return NULL;

+  flatpak_oci_registry_set_token (new_registry, token);

+

   return g_steal_pointer (&new_registry);

 }

@@ -8952,7 +8956,7 @@ flatpak_dir_install (FlatpakDir          *self,

           g_autoptr(FlatpakOciRegistry) registry = NULL;

           g_autoptr(GFile) registry_file = NULL;

-          registry = flatpak_dir_create_system_child_oci_registry (self, &child_repo_lock, error);

+          registry = flatpak_dir_create_system_child_oci_registry (self, &child_repo_lock, token, error);

           if (registry == NULL)

             return FALSE;

@@ -9662,7 +9666,7 @@ flatpak_dir_update (FlatpakDir                           *self,

           g_autoptr(FlatpakOciRegistry) registry = NULL;

           g_autoptr(GFile) registry_file = NULL;

-          registry = flatpak_dir_create_system_child_oci_registry (self, &child_repo_lock, error);

+          registry = flatpak_dir_create_system_child_oci_registry (self, &child_repo_lock, token, error);

           if (registry == NULL)

             return FALSE;

diff --git a/common/flatpak-oci-registry.c b/common/flatpak-oci-registry.c

index fdeee56bd..c3ddb8c2b 100644

--- a/common/flatpak-oci-registry.c

+++ b/common/flatpak-oci-registry.c

@@ -223,8 +223,15 @@ flatpak_oci_registry_set_token (FlatpakOciRegistry *self,

 {

   g_free (self->token);

   self->token = g_strdup (token);

+

+  if (self->token)

+    (void)glnx_file_replace_contents_at (self->dfd, ".token",

+                                         (guchar *)self->token,

+                                         strlen (self->token),

+                                         0, NULL, NULL);

 }

+

 FlatpakOciRegistry *

 flatpak_oci_registry_new (const char   *uri,

                           gboolean      for_write,

@@ -415,6 +422,7 @@ flatpak_oci_registry_ensure_local (FlatpakOciRegistry *self,

   int dfd;

   g_autoptr(GError) local_error = NULL;

   g_autoptr(GBytes) oci_layout_bytes = NULL;

+  g_autoptr(GBytes) token_bytes = NULL;

   gboolean not_json;

   if (self->dfd != -1)

@@ -476,6 +484,13 @@ flatpak_oci_registry_ensure_local (FlatpakOciRegistry *self,

   else if (!verify_oci_version (oci_layout_bytes, &not_json, cancellable, error))

     return FALSE;

+  if (self->dfd != -1)

+    {

+      token_bytes = local_load_file (self->dfd, ".token", cancellable, NULL);

+      if (token_bytes != NULL)

+        self->token = g_strndup (g_bytes_get_data (token_bytes, NULL), g_bytes_get_size (token_bytes));

+    }

+

   if (self->dfd == -1 && local_dfd != -1)

     self->dfd = glnx_steal_fd (&local_dfd);

From 36f87863baa848c8709b75958c85857f45e97e0a Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Thu, 11 Jun 2020 15:43:16 +0200

Subject: [PATCH 5/7] OCI: Also look for the docker media type when looking

 manifests

We handle both types, so look for both.

(cherry picked from commit 0fdec95fe068cd497b1c5a5b60d21103c711d2a4)

---

 common/flatpak-json-oci.c | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/common/flatpak-json-oci.c b/common/flatpak-json-oci.c

index 6d60279d0..f5b3f0a0c 100644

--- a/common/flatpak-json-oci.c

+++ b/common/flatpak-json-oci.c

@@ -469,7 +469,8 @@ const char *

 flatpak_oci_manifest_descriptor_get_ref (FlatpakOciManifestDescriptor *m)

 {

   if (m->parent.mediatype == NULL ||

-      strcmp (m->parent.mediatype, FLATPAK_OCI_MEDIA_TYPE_IMAGE_MANIFEST) != 0)

+      (strcmp (m->parent.mediatype, FLATPAK_OCI_MEDIA_TYPE_IMAGE_MANIFEST) != 0 &&

+       strcmp (m->parent.mediatype, FLATPAK_DOCKER_MEDIA_TYPE_IMAGE_MANIFEST2) != 0))

     return NULL;

   if (m->parent.annotations == NULL)

From 0da4a6c82c16d4560d4931d567e2685efd8dff0d Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Mon, 4 May 2020 15:51:48 +0200

Subject: [PATCH 6/7] tests: Make OCI authenticator available

(cherry picked from commit 4d79110cb682b79819913aa6ce033cb7a7787c86)

---

 tests/Makefile.am.inc | 7 ++++++-

 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/Makefile.am.inc b/tests/Makefile.am.inc

index 7c2e8271f..15f521485 100644

--- a/tests/Makefile.am.inc

+++ b/tests/Makefile.am.inc

@@ -105,11 +105,15 @@ tests/services/org.flatpak.Authenticator.test.service: tests/org.flatpak.Authent

 	mkdir -p tests/services

 	$(AM_V_GEN) $(SED) -e "s|\@libexecdir\@|$(abs_top_builddir)/tests|" $< > $@

+tests/services/org.flatpak.Authenticator.Oci.service: oci-authenticator/org.flatpak.Authenticator.Oci.service.in

+	mkdir -p tests/services

+	$(AM_V_GEN) $(SED) -e "s|\@libexecdir\@|$(abs_top_builddir)|" $< > $@

+

 tests/share/xdg-desktop-portal/portals/test.portal: tests/test.portal.in

 	mkdir -p tests/share/xdg-desktop-portal/portals

 	$(AM_V_GEN) install -m644 $< $@

-tests/libtest.sh: tests/services/org.freedesktop.Flatpak.service tests/services/org.freedesktop.Flatpak.SystemHelper.service tests/services/org.freedesktop.portal.Flatpak.service tests/share/xdg-desktop-portal/portals/test.portal tests/services/org.freedesktop.impl.portal.desktop.test.service tests/services/org.flatpak.Authenticator.test.service

+tests/libtest.sh: tests/services/org.freedesktop.Flatpak.service tests/services/org.freedesktop.Flatpak.SystemHelper.service tests/services/org.freedesktop.portal.Flatpak.service tests/share/xdg-desktop-portal/portals/test.portal tests/services/org.freedesktop.impl.portal.desktop.test.service tests/services/org.flatpak.Authenticator.test.service tests/services/org.flatpak.Authenticator.Oci.service

 install-test-data-hook:

 if ENABLE_INSTALLED_TESTS

@@ -223,6 +227,7 @@ DISTCLEANFILES += \

 	tests/services/org.freedesktop.portal.Flatpak.service \

 	tests/services/org.freedesktop.impl.portal.desktop.test.service \

 	tests/services/org.flatpak.Authenticator.test.service \

+	tests/services/org.flatpak.Authenticator.Oci.service \

 	tests/share/xdg-desktop-portal/portals/test.portal \

 	tests/package_version.txt \

 	$(NULL)

From 8fb4369439e57cc25c706610c5ce1ee776220278 Mon Sep 17 00:00:00 2001

From: Alexander Larsson <alexl@redhat.com>

Date: Mon, 4 May 2020 15:51:59 +0200

Subject: [PATCH 7/7] Tests: Support HEAD requests in oci-registry-server

This just does a GET, which is not quite right, but will work.

This is needed for the authenticator.

(cherry picked from commit 530475b9abff81d990424ca46ec57458e1bb9604)

---

 tests/oci-registry-server.py | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/tests/oci-registry-server.py b/tests/oci-registry-server.py

index 23c2db916..33c3b646b 100755

--- a/tests/oci-registry-server.py

+++ b/tests/oci-registry-server.py

@@ -135,6 +135,9 @@ def do_GET(self):

             else:

                 self.wfile.write(response_string.encode('utf-8'))

+    def do_HEAD(self):

+        return self.do_GET()

+

     def do_POST(self):

         if self.check_route('/testing/@repo_name/@tag'):

             repo_name = self.matches['repo_name']