diff --git a/go.mod b/go.mod index 25d241573d..d6b4d2bb00 100644 --- a/go.mod +++ b/go.mod @@ -40,8 +40,8 @@ require ( github.com/mattn/go-sqlite3 v1.14.46 github.com/mdlayher/vsock v1.3.0 github.com/moby/docker-image-spec v1.3.1 - github.com/moby/moby/api v1.54.2 - github.com/moby/moby/client v0.4.1 + github.com/moby/moby/api v1.55.0 + github.com/moby/moby/client v0.5.0 github.com/moby/sys/capability v0.4.0 github.com/moby/sys/user v0.4.0 github.com/moby/term v0.5.2 diff --git a/go.sum b/go.sum index e453f3cba0..7f3ce90524 100644 --- a/go.sum +++ b/go.sum @@ -255,10 +255,10 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8= github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU= -github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg= -github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= -github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY= -github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ= +github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc= +github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= +github.com/moby/moby/client v0.5.0 h1:5XhyPk2fuOWf6RlSFa3MkIIgDZkF25xToXW8Q/BH7cc= +github.com/moby/moby/client v0.5.0/go.mod h1:rcVpF8ncl9vo5gaIBdol6CnbEtSj1uxMvEV/UrykF/s= github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U= github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk= diff --git a/vendor/github.com/moby/moby/api/Dockerfile b/vendor/github.com/moby/moby/api/Dockerfile index 1fa30f6781..008059df9c 100644 --- a/vendor/github.com/moby/moby/api/Dockerfile +++ b/vendor/github.com/moby/moby/api/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26.2 +ARG GO_VERSION=1.26.4 FROM golang:${GO_VERSION}-alpine AS base RUN apk add --no-cache bash make yamllint diff --git a/vendor/github.com/moby/moby/api/swagger.yaml b/vendor/github.com/moby/moby/api/swagger.yaml index bb2ad6dc60..72cf3de4d8 100644 --- a/vendor/github.com/moby/moby/api/swagger.yaml +++ b/vendor/github.com/moby/moby/api/swagger.yaml @@ -19,10 +19,10 @@ produces: consumes: - "application/json" - "text/plain" -basePath: "/v1.54" +basePath: "/v1.55" info: title: "Docker Engine API" - version: "1.54" + version: "1.55" x-logo: url: "https://docs.docker.com/assets/images/logo-docker-main.png" description: | @@ -55,8 +55,8 @@ info: the URL is not supported by the daemon, a HTTP `400 Bad Request` error message is returned. - If you omit the version-prefix, the current version of the API (v1.50) is used. - For example, calling `/info` is the same as calling `/v1.52/info`. Using the + If you omit the version-prefix, the current version of the API is used. + For example, calling `/info` is the same as calling `/v1.55/info`. Using the API without a version-prefix is deprecated and will be removed in a future release. Engine releases in the near future should support this version of the API, @@ -1835,13 +1835,6 @@ definitions: compatibility. x-nullable: true $ref: "#/definitions/OCIDescriptor" - Identity: - description: |- - Identity holds information about the identity and origin of the image. - This is trusted information verified by the daemon and cannot be modified - by tagging an image to a different name. - x-nullable: true - $ref: "#/definitions/Identity" Manifests: description: | Manifests is a list of image manifests available in this image. It @@ -1857,6 +1850,13 @@ definitions: x-nullable: true items: $ref: "#/definitions/ImageManifestSummary" + Identity: + description: |- + Identity holds information about the identity and origin of the image. + This is trusted information verified by the daemon and cannot be modified + by tagging an image to a different name. + x-nullable: true + $ref: "#/definitions/Identity" RepoTags: description: | List of image names/tags in the local image cache that reference this @@ -8140,6 +8140,25 @@ definitions: additionalProperties: type: "string" + AttestationStatement: + x-go-name: "AttestationStatement" + description: | + AttestationStatement is a single in-toto statement attached to an image. + type: "object" + required: ["Descriptor", "PredicateType"] + properties: + Descriptor: + $ref: "#/definitions/OCIDescriptor" + PredicateType: + description: The in-toto predicate type URI of this statement. + type: "string" + example: "https://slsa.dev/provenance/v0.2" + Statement: + description: | + The verbatim in-toto statement JSON. Only included when the caller + opts in via the `statement=true` query parameter; otherwise absent. + type: "object" + x-nullable: true ImageManifestSummary: x-go-name: "ManifestSummary" description: | @@ -10157,6 +10176,94 @@ paths: Example: `{"os": "linux", "architecture": "arm", "variant": "v5"}` tags: ["Image"] + /images/{name}/attestations: + get: + summary: "Get attestation statements for an image" + description: | + Return the in-toto attestation statements attached to the image for the + given platform. The daemon locates the attestation manifest(s) that + reference the matching platform image manifest, reads their statement + layers, and returns the verbatim statement JSON together with layer + metadata. + + If the image has no attestations an empty array is returned. + operationId: "ImageAttestations" + produces: + - "application/json" + responses: + 200: + description: "No error" + schema: + type: "array" + items: + $ref: "#/definitions/AttestationStatement" + 400: + description: "Bad parameter (e.g. malformed `platform` value)" + schema: + $ref: "#/definitions/ErrorResponse" + 404: + description: "No such image, or no manifest found for the requested platform" + schema: + $ref: "#/definitions/ErrorResponse" + 500: + description: "Server error" + schema: + $ref: "#/definitions/ErrorResponse" + 501: + description: | + The daemon's image backend does not support attestations. This + is returned by the legacy (graphdriver) image store, which does + not preserve OCI image indexes. + schema: + $ref: "#/definitions/ErrorResponse" + parameters: + - name: "name" + in: "path" + description: "Image name or id" + type: "string" + required: true + - name: "platform" + type: "array" + items: + type: "string" + collectionFormat: "multi" + in: "query" + description: |- + JSON-encoded OCI platform to select the image variant whose + attestations to return. + If omitted, the daemon's default (host) platform is used. + + Only one platform value is currently accepted; passing more than + one returns an error. The parameter is declared as an array so the + wire shape can accept multiple values in the future without an + API version bump. + + Example: `{"os": "linux", "architecture": "amd64"}` + required: false + - name: "type" + type: "array" + items: + type: "string" + collectionFormat: "multi" + in: "query" + description: |- + In-toto predicate type URI to filter returned statements. May be + repeated to accept any of several predicate types. If omitted, all + statements are returned. + + Example: `type=https://slsa.dev/provenance/v0.2&type=https://spdx.dev/Document` + required: false + - name: "statement" + type: "boolean" + in: "query" + description: |- + Include the verbatim in-toto statement body in each returned + entry. Defaults to false; when omitted or false, only the + descriptor and predicate type are returned and statement blobs + are not read. + default: false + required: false + tags: ["Image"] /images/{name}/history: get: summary: "Get the history of an image" @@ -12556,7 +12663,9 @@ paths: description: | Listen address used for inter-manager communication if the node gets promoted to manager, as well as determining the networking - interface used for the VXLAN Tunnel Endpoint (VTEP). + interface used for the VXLAN Tunnel Endpoint (VTEP). This is + required for joining a swarm. If the port number is omitted, + the default swarm listening port is used. type: "string" AdvertiseAddr: description: | @@ -12590,6 +12699,7 @@ paths: JoinToken: description: "Secret token for joining this swarm." type: "string" + required: [ListenAddr, RemoteAddrs, JoinToken] example: ListenAddr: "0.0.0.0:2377" AdvertiseAddr: "192.168.1.1:2377" diff --git a/vendor/github.com/moby/moby/api/types/image/attestation.go b/vendor/github.com/moby/moby/api/types/image/attestation.go new file mode 100644 index 0000000000..4233d68330 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/attestation.go @@ -0,0 +1,19 @@ +package image + +import ( + "encoding/json" + + ocispec "github.com/opencontainers/image-spec/specs-go/v1" +) + +// AttestationStatement is a single in-toto statement attached to an image. +type AttestationStatement struct { + // Descriptor is the OCI descriptor of the statement blob (media type, + // digest, size, annotations). + Descriptor ocispec.Descriptor `json:"Descriptor"` + // PredicateType is the in-toto predicate type URI of this statement. + PredicateType string `json:"PredicateType"` + // Statement is the verbatim in-toto statement JSON. Omitted unless the + // caller opts in via the statement=true query parameter. + Statement *json.RawMessage `json:"Statement,omitempty"` +} diff --git a/vendor/github.com/moby/moby/client/client.go b/vendor/github.com/moby/moby/client/client.go index 89ba88ee5c..4b4ef976a3 100644 --- a/vendor/github.com/moby/moby/client/client.go +++ b/vendor/github.com/moby/moby/client/client.go @@ -109,7 +109,7 @@ const DummyHost = "api.moby.localhost" // overriding the version and disable API-version negotiation. // // This version may be lower than the version of the api library module used. -const MaxAPIVersion = "1.54" +const MaxAPIVersion = "1.55" // MinAPIVersion is the minimum API version supported by the client. API versions // below this version are not considered when performing API-version negotiation. diff --git a/vendor/github.com/moby/moby/client/client_interfaces.go b/vendor/github.com/moby/moby/client/client_interfaces.go index 4bbd45a6e5..fd1b9dac39 100644 --- a/vendor/github.com/moby/moby/client/client_interfaces.go +++ b/vendor/github.com/moby/moby/client/client_interfaces.go @@ -133,6 +133,7 @@ type ImageAPIClient interface { ImageInspect(ctx context.Context, image string, _ ...ImageInspectOption) (ImageInspectResult, error) ImageHistory(ctx context.Context, image string, _ ...ImageHistoryOption) (ImageHistoryResult, error) + ImageAttestations(ctx context.Context, image string, _ ...ImageAttestationsOption) (ImageAttestationsResult, error) ImageLoad(ctx context.Context, input io.Reader, _ ...ImageLoadOption) (ImageLoadResult, error) ImageSave(ctx context.Context, images []string, _ ...ImageSaveOption) (ImageSaveResult, error) diff --git a/vendor/github.com/moby/moby/client/image_attestations.go b/vendor/github.com/moby/moby/client/image_attestations.go new file mode 100644 index 0000000000..c02d975197 --- /dev/null +++ b/vendor/github.com/moby/moby/client/image_attestations.go @@ -0,0 +1,51 @@ +package client + +import ( + "context" + "encoding/json" + "net/url" +) + +// ImageAttestations returns the in-toto attestation statements attached to an +// image for the given platform. This requires API version 1.55 or higher. +func (cli *Client) ImageAttestations(ctx context.Context, imageID string, opts ...ImageAttestationsOption) (ImageAttestationsResult, error) { + if imageID == "" { + return ImageAttestationsResult{}, objectNotFoundError{object: "image", id: imageID} + } + + if err := cli.requiresVersion(ctx, "1.55", "attestations"); err != nil { + return ImageAttestationsResult{}, err + } + + var o imageAttestationsOpts + for _, opt := range opts { + if err := opt.Apply(&o); err != nil { + return ImageAttestationsResult{}, err + } + } + + query := url.Values{} + if o.platform != nil { + p, err := encodePlatform(o.platform) + if err != nil { + return ImageAttestationsResult{}, err + } + query.Set("platform", p) + } + for _, pt := range o.predicateTypes { + query.Add("type", pt) + } + if o.includeStatement { + query.Set("statement", "1") + } + + resp, err := cli.get(ctx, "/images/"+imageID+"/attestations", query, nil) + defer ensureReaderClosed(resp) + if err != nil { + return ImageAttestationsResult{}, err + } + + var result ImageAttestationsResult + err = json.NewDecoder(resp.Body).Decode(&result.Items) + return result, err +} diff --git a/vendor/github.com/moby/moby/client/image_attestations_opts.go b/vendor/github.com/moby/moby/client/image_attestations_opts.go new file mode 100644 index 0000000000..4a7c3bcf84 --- /dev/null +++ b/vendor/github.com/moby/moby/client/image_attestations_opts.go @@ -0,0 +1,56 @@ +package client + +import ( + "github.com/moby/moby/api/types/image" + ocispec "github.com/opencontainers/image-spec/specs-go/v1" +) + +// ImageAttestationsResult is the result of an ImageAttestations operation. +type ImageAttestationsResult struct { + Items []image.AttestationStatement +} + +// ImageAttestationsOption is a functional option for the ImageAttestations operation. +type ImageAttestationsOption interface { + Apply(*imageAttestationsOpts) error +} + +type imageAttestationsOptionFunc func(*imageAttestationsOpts) error + +func (f imageAttestationsOptionFunc) Apply(o *imageAttestationsOpts) error { return f(o) } + +type imageAttestationsOpts struct { + platform *ocispec.Platform + predicateTypes []string + includeStatement bool +} + +// ImageAttestationsWithPlatform filters attestations to those for the given +// platform variant. If omitted, the daemon's default platform is used. +func ImageAttestationsWithPlatform(platform ocispec.Platform) ImageAttestationsOption { + return imageAttestationsOptionFunc(func(o *imageAttestationsOpts) error { + o.platform = &platform + return nil + }) +} + +// ImageAttestationsWithPredicateTypes filters returned statements to those +// whose in-toto predicate type matches one of the given URIs. +// If not set, all statements are returned. +func ImageAttestationsWithPredicateTypes(types ...string) ImageAttestationsOption { + return imageAttestationsOptionFunc(func(o *imageAttestationsOpts) error { + o.predicateTypes = append(o.predicateTypes, types...) + return nil + }) +} + +// ImageAttestationsWithStatement asks the daemon to include the verbatim +// in-toto statement body in each returned entry. Without this option, only +// the descriptor and predicate type are returned and statement blobs are +// not read. +func ImageAttestationsWithStatement() ImageAttestationsOption { + return imageAttestationsOptionFunc(func(o *imageAttestationsOpts) error { + o.includeStatement = true + return nil + }) +} diff --git a/vendor/modules.txt b/vendor/modules.txt index 3dc3a5c50b..2341fcba2e 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -377,7 +377,7 @@ github.com/moby/docker-image-spec/specs-go/v1 github.com/moby/go-archive github.com/moby/go-archive/compression github.com/moby/go-archive/tarheader -# github.com/moby/moby/api v1.54.2 +# github.com/moby/moby/api v1.55.0 ## explicit; go 1.24 github.com/moby/moby/api github.com/moby/moby/api/pkg/stdcopy @@ -398,7 +398,7 @@ github.com/moby/moby/api/types/storage github.com/moby/moby/api/types/swarm github.com/moby/moby/api/types/system github.com/moby/moby/api/types/volume -# github.com/moby/moby/client v0.4.1 +# github.com/moby/moby/client v0.5.0 ## explicit; go 1.24 github.com/moby/moby/client github.com/moby/moby/client/internal