Support for registry (insecure / blocked) from registries.conf

Signed-off-by: Valentin Delaye <jonesbusy@users.noreply.github.com>

Author: jonesbusy

src/main/java/land/oras/ContainerRef.java

@@ -411,6 +411,62 @@ public ContainerRef forRegistry(String registry) {
         return new ContainerRef(registry, false, namespace, repository, tag, digest);
     }
 
+    /**
+     * Check if access to this container reference is insecure by the registry configuration
+     * @param registry The registry
+     * @return True if access to this container reference is insecure, false otherwise
+     */
+    public boolean isInsecure(Registry registry) {
+        String effectiveRegistry = getEffectiveRegistry(registry);
+        if (registry.getRegistriesConf().isInsecure(effectiveRegistry)) {
+            LOG.info(
+                    "Access to container reference {} is insecure by location configuration for registry {}",
+                    this,
+                    effectiveRegistry);
+            return true;
+        }
+        return registry.isInsecure();
+    }
+
+    /**
+     * Check if access to this container reference is blocked by the registry configuration
+     * @param registry The registry
+     * @return True if access to this container reference is blocked, false otherwise
+     */
+    public boolean isBlocked(Registry registry) {
+        boolean blocked = false;
+        String effectiveRegistry = getEffectiveRegistry(registry);
+        if (registry.getRegistriesConf().isBlocked(effectiveRegistry)) {
+            LOG.info(
+                    "Access to container reference {} is blocked by location configuration for registry {}",
+                    this,
+                    effectiveRegistry);
+            blocked = true;
+        }
+        String location = "%s/%s".formatted(effectiveRegistry, getFullRepository(registry));
+        if (registry.getRegistriesConf().isBlocked(location)) {
+            LOG.info(
+                    "Access to container reference {} is blocked by location configuration for registry/repository {}",
+                    this,
+                    location);
+            blocked = true;
+        }
+        return blocked;
+    }
+
+    /**
+     * Check if access to this container reference is blocked by the registry configuration and throw exception if it is
+     * @param registry The registry
+     * @throws OrasException if access to this container reference is blocked by the registry configuration
+     */
+    ContainerRef checkBlocked(Registry registry) throws OrasException {
+        if (isBlocked(registry)) {
+            throw new OrasException(
+                    "Access to container reference %s is blocked by registry configuration".formatted(this));
+        }
+        return this;
+    }
+
     /**
      * Return a copy of reference for a registry other registry
      * @param registry The registry
@@ -459,7 +515,7 @@ private String determineFirstUnqualifiedSearchRegistry(Registry registry) {
                 registry.getRegistriesConf().getUnqualifiedRegistries());
         List<String> unqualifiedRegistries = registry.getRegistriesConf().getUnqualifiedRegistries();
         for (String searchRegistry : unqualifiedRegistries) {
-            Registry targetRegistry = registry.copy(registry, searchRegistry);
+            Registry targetRegistry = registry.copy(searchRegistry);
             LOG.debug("Checking if container {} exists in unqualified search registry {}", this, searchRegistry);
             if (targetRegistry.exists(this)) {
                 LOG.debug("Found container {} in unqualified search registry {}", this, searchRegistry);

src/main/java/land/oras/Registry.java

@@ -115,6 +115,14 @@ private void setInsecure(boolean insecure) {
         this.insecure = insecure;
     }
 
+    /**
+     * Return if this registry is insecure
+     * @return True if insecure
+     */
+    public boolean isInsecure() {
+        return insecure;
+    }
+
     /**
      * Return this registry with the auth provider
      * @param authProvider The auth provider
@@ -158,12 +166,19 @@ public String getScheme() {
 
     /**
      * Return a new registry with the given registry URL but with same settings
-     * @param existing The registry
      * @param newRegistry The new target registry URL to use in the new registry
      * @return The new registry
      */
-    public Registry copy(Registry existing, String newRegistry) {
-        return new Builder().from(existing).withRegistry(newRegistry).build();
+    public Registry copy(String newRegistry) {
+        return new Builder().from(this).withRegistry(newRegistry).build();
+    }
+
+    /**
+     * Return a new registry as insecure but with same settings
+     * @return The new registry
+     */
+    public Registry asInsecure() {
+        return new Builder().from(this).withInsecure(true).build();
     }
 
     /**
@@ -176,7 +191,10 @@ public Registry copy(Registry existing, String newRegistry) {
 
     @Override
     public Tags getTags(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().getTags(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getTagsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.get(
                 uri, Map.of(Const.ACCEPT_HEADER, Const.DEFAULT_JSON_MEDIA_TYPE), Scopes.of(this, ref), authProvider);
@@ -186,13 +204,13 @@ public Tags getTags(ContainerRef containerRef) {
 
     @Override
     public Repositories getRepositories() {
-        ContainerRef containerRef = ContainerRef.parse("default").forRegistry(this);
-        URI uri = URI.create("%s://%s".formatted(getScheme(), containerRef.getRepositoriesPath(this)));
+        if (registry != null && getRegistriesConf().isInsecure(registry) && !this.isInsecure()) {
+            return asInsecure().getRepositories();
+        }
+        ContainerRef ref = ContainerRef.parse("default").forRegistry(this);
+        URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getRepositoriesPath(this)));
         HttpClient.ResponseWrapper<String> response = client.get(
-                uri,
-                Map.of(Const.ACCEPT_HEADER, Const.DEFAULT_JSON_MEDIA_TYPE),
-                Scopes.of(this, containerRef),
-                authProvider);
+                uri, Map.of(Const.ACCEPT_HEADER, Const.DEFAULT_JSON_MEDIA_TYPE), Scopes.of(this, ref), authProvider);
         handleError(response);
         return JsonUtils.fromJson(response.response(), Repositories.class);
     }
@@ -202,7 +220,10 @@ public Referrers getReferrers(ContainerRef containerRef, @Nullable ArtifactType
         if (containerRef.getDigest() == null) {
             throw new OrasException("Digest is required to get referrers");
         }
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().getReferrers(containerRef, artifactType);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getReferrersPath(this, artifactType)));
         HttpClient.ResponseWrapper<String> response = client.get(
                 uri, Map.of(Const.ACCEPT_HEADER, Const.DEFAULT_INDEX_MEDIA_TYPE), Scopes.of(this, ref), authProvider);
@@ -215,7 +236,11 @@ public Referrers getReferrers(ContainerRef containerRef, @Nullable ArtifactType
      * @param containerRef The artifact
      */
     public void deleteManifest(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            asInsecure().deleteManifest(containerRef);
+            return;
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getManifestsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.delete(uri, Map.of(), Scopes.of(this, ref), authProvider);
         logResponse(response);
@@ -231,7 +256,10 @@ public Manifest pushManifest(ContainerRef containerRef, Manifest manifest) {
             manifestAnnotations.put(Const.ANNOTATION_CREATED, Const.currentTimestamp());
             manifest = manifest.withAnnotations(manifestAnnotations);
         }
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().pushManifest(containerRef, manifest);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getManifestsPath(this)));
         byte[] manifestData = manifest.getJson() != null
                 ? manifest.getJson().getBytes()
@@ -257,7 +285,10 @@ public Manifest pushManifest(ContainerRef containerRef, Manifest manifest) {
 
     @Override
     public Index pushIndex(ContainerRef containerRef, Index index) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().pushIndex(containerRef, index);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getManifestsPath(this)));
         byte[] indexData = JsonUtils.toJson(index).getBytes();
         LOG.debug("Index data to push: {}", new String(indexData, StandardCharsets.UTF_8));
@@ -277,7 +308,11 @@ public Index pushIndex(ContainerRef containerRef, Index index) {
      * @param containerRef The container
      */
     public void deleteBlob(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            asInsecure().deleteBlob(containerRef);
+            return;
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getBlobsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.delete(uri, Map.of(), Scopes.of(this, ref), authProvider);
         logResponse(response);
@@ -286,7 +321,11 @@ public void deleteBlob(ContainerRef containerRef) {
 
     @Override
     public void pullArtifact(ContainerRef containerRef, Path path, boolean overwrite) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            asInsecure().pullArtifact(containerRef, path, overwrite);
+            return;
+        }
         // Only collect layer that are files
         String contentType = getContentType(ref);
         List<Layer> layers = collectLayers(ref, contentType, false);
@@ -371,7 +410,10 @@ public Manifest pushArtifact(
     public Layer pushBlob(ContainerRef containerRef, Path blob, Map<String, String> annotations) {
         String digest = containerRef.getAlgorithm().digest(blob);
         LOG.debug("Digest: {}", digest);
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().pushBlob(containerRef, blob, annotations);
+        }
         // This might not works with registries performing HEAD request
         if (hasBlob(ref.withDigest(digest))) {
             LOG.info("Blob already exists: {}", digest);
@@ -426,7 +468,10 @@ public Layer pushBlob(ContainerRef containerRef, Path blob, Map<String, String>
     @Override
     public Layer pushBlob(ContainerRef containerRef, byte[] data) {
         String digest = containerRef.getAlgorithm().digest(data);
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().pushBlob(containerRef, data);
+        }
         if (ref.getDigest() != null) {
             ensureDigest(ref, data);
         }
@@ -489,7 +534,10 @@ private boolean hasBlob(ContainerRef containerRef) {
     }
 
     private HttpClient.ResponseWrapper<String> headBlob(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().headBlob(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getBlobsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.head(
                 uri,
@@ -507,7 +555,10 @@ private HttpClient.ResponseWrapper<String> headBlob(ContainerRef containerRef) {
      */
     @Override
     public byte[] getBlob(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().getBlob(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getBlobsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.get(
                 uri,
@@ -523,7 +574,11 @@ public byte[] getBlob(ContainerRef containerRef) {
 
     @Override
     public void fetchBlob(ContainerRef containerRef, Path path) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            asInsecure().fetchBlob(containerRef, path);
+            return;
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getBlobsPath(this)));
         HttpClient.ResponseWrapper<Path> response = client.download(
                 uri,
@@ -538,7 +593,10 @@ public void fetchBlob(ContainerRef containerRef, Path path) {
 
     @Override
     public InputStream fetchBlob(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().fetchBlob(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getBlobsPath(this)));
         HttpClient.ResponseWrapper<InputStream> response = client.download(
                 uri,
@@ -639,7 +697,10 @@ public Descriptor probeDescriptor(ContainerRef ref) {
      * @return True if exists
      */
     boolean exists(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().exists(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getManifestsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.head(
                 uri, Map.of(Const.ACCEPT_HEADER, Const.MANIFEST_ACCEPT_TYPE), Scopes.of(this, ref), authProvider);
@@ -653,7 +714,10 @@ boolean exists(ContainerRef containerRef) {
      * @return The response
      */
     private HttpClient.ResponseWrapper<String> getManifestResponse(ContainerRef containerRef) {
-        ContainerRef ref = containerRef.forRegistry(this);
+        ContainerRef ref = containerRef.forRegistry(this).checkBlocked(this);
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().getManifestResponse(containerRef);
+        }
         URI uri = URI.create("%s://%s".formatted(getScheme(), ref.getManifestsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.head(
                 uri, Map.of(Const.ACCEPT_HEADER, Const.MANIFEST_ACCEPT_TYPE), Scopes.of(this, ref), authProvider);
@@ -799,17 +863,17 @@ URI createLocationWithDigest(String location, String digest) {
 
     /**
      * Execute a head request on the manifest URL and return the headers
-     * @param containerRef The container
+     * @param ref The container
      * @return The headers
      */
-    Map<String, String> getHeaders(ContainerRef containerRef) {
+    Map<String, String> getHeaders(ContainerRef ref) {
+        if (ref.isInsecure(this) && !this.isInsecure()) {
+            return asInsecure().getHeaders(ref);
+        }
         URI uri = URI.create(
-                "%s://%s".formatted(getScheme(), containerRef.forRegistry(this).getManifestsPath(this)));
+                "%s://%s".formatted(getScheme(), ref.forRegistry(this).getManifestsPath(this)));
         HttpClient.ResponseWrapper<String> response = client.head(
-                uri,
-                Map.of(Const.ACCEPT_HEADER, Const.MANIFEST_ACCEPT_TYPE),
-                Scopes.of(this, containerRef),
-                authProvider);
+                uri, Map.of(Const.ACCEPT_HEADER, Const.MANIFEST_ACCEPT_TYPE), Scopes.of(this, ref), authProvider);
         logResponse(response);
         handleError(response);
         return response.headers();