From ec00b857941e6899c68e94714ace456578f0da4f Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 23 Aug 2025 16:18:09 +0200 Subject: [PATCH 1/2] cli/command/image: runPush: minor cleanups and linting issues - Remove redundant intermediate variables - Explicitly use an early return on error instead of combining with other checks. - Fix unhandled errors and combine defers - Remove outstanding TODO that unlikely will be addressed Signed-off-by: Sebastiaan van Stijn (cherry picked from commit c36e67d7b68601870936c9b0f7285a7f7c8544f3) Signed-off-by: Sebastiaan van Stijn --- cli/command/image/push.go | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/cli/command/image/push.go b/cli/command/image/push.go index 5da2f3e46963..950846df857d 100644 --- a/cli/command/image/push.go +++ b/cli/command/image/push.go @@ -100,9 +100,11 @@ To push the complete multi-platform image, remove the --platform flag. } ref, err := reference.ParseNormalizedNamed(opts.remote) - switch { - case err != nil: + if err != nil { return err + } + + switch { case opts.all && !reference.IsNameOnly(ref): return errors.New("tag can't be used with --all-tags/-a") case !opts.all && reference.IsNameOnly(ref): @@ -121,34 +123,32 @@ To push the complete multi-platform image, remove the --platform flag. if err != nil { return err } - options := image.PushOptions{ + + responseBody, err := dockerCli.Client().ImagePush(ctx, reference.FamiliarString(ref), image.PushOptions{ All: opts.all, RegistryAuth: encodedAuth, PrivilegeFunc: nil, Platform: platform, - } - - responseBody, err := dockerCli.Client().ImagePush(ctx, reference.FamiliarString(ref), options) + }) if err != nil { return err } defer func() { + _ = responseBody.Close() for _, note := range notes { out.PrintNote(note) } }() - defer responseBody.Close() if !opts.untrusted { - // TODO pushTrustedReference currently doesn't respect `--quiet` return pushTrustedReference(ctx, dockerCli, indexInfo, ref, authConfig, responseBody) } if opts.quiet { err = jsonstream.Display(ctx, responseBody, streams.NewOut(io.Discard), jsonstream.WithAuxCallback(handleAux())) if err == nil { - fmt.Fprintln(dockerCli.Out(), ref.String()) + _, _ = fmt.Fprintln(dockerCli.Out(), ref.String()) } return err } From d5c181abf4e2eb732f8a096fa4ff8c1b00a2435c Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 8 Sep 2025 17:40:39 +0200 Subject: [PATCH 2/2] cli/command/image: pushTrustedReference: internalize constructing indexInfo All information needed can be deducted from the image reference, which is used to create a indexInfo, repoInfo, and to resolve auth-config. In some situations this may result in resolving the auth-config twice after it already was resolved to an encoded auth-config. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 9a6313ed3bddb3721916cccb15efcc037e8cad82) Signed-off-by: Sebastiaan van Stijn --- cli/command/image/push.go | 10 ++-------- cli/command/image/trust.go | 11 +++++++++-- cli/trust/trust.go | 5 ++++- 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/cli/command/image/push.go b/cli/command/image/push.go index 950846df857d..db19e8fb4c2b 100644 --- a/cli/command/image/push.go +++ b/cli/command/image/push.go @@ -17,11 +17,9 @@ import ( "github.com/docker/cli/cli/streams" "github.com/docker/cli/cli/trust" "github.com/docker/cli/internal/jsonstream" - "github.com/docker/cli/internal/registry" "github.com/docker/cli/internal/tui" "github.com/docker/docker/api/types/auxprogress" "github.com/docker/docker/api/types/image" - registrytypes "github.com/docker/docker/api/types/registry" "github.com/morikuni/aec" ocispec "github.com/opencontainers/image-spec/specs-go/v1" "github.com/pkg/errors" @@ -114,12 +112,8 @@ To push the complete multi-platform image, remove the --platform flag. } } - // Resolve the Repository name from fqn to RepositoryInfo - indexInfo := registry.NewIndexInfo(ref) - // Resolve the Auth config relevant for this server - authConfig := command.ResolveAuthConfig(dockerCli.ConfigFile(), indexInfo) - encodedAuth, err := registrytypes.EncodeAuthConfig(authConfig) + encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCli.ConfigFile(), ref.String()) if err != nil { return err } @@ -142,7 +136,7 @@ To push the complete multi-platform image, remove the --platform flag. }() if !opts.untrusted { - return pushTrustedReference(ctx, dockerCli, indexInfo, ref, authConfig, responseBody) + return pushTrustedReference(ctx, dockerCli, ref, responseBody) } if opts.quiet { diff --git a/cli/command/image/trust.go b/cli/command/image/trust.go index 58c69a9bf719..cb17505592a4 100644 --- a/cli/command/image/trust.go +++ b/cli/command/image/trust.go @@ -12,6 +12,7 @@ import ( "github.com/docker/cli/cli/streams" "github.com/docker/cli/cli/trust" "github.com/docker/cli/internal/jsonstream" + "github.com/docker/cli/internal/registry" "github.com/docker/docker/api/types/image" registrytypes "github.com/docker/docker/api/types/registry" "github.com/opencontainers/go-digest" @@ -42,12 +43,18 @@ func newNotaryClient(cli command.Streams, imgRefAndAuth trust.ImageRefAndAuth) ( } // pushTrustedReference pushes a canonical reference to the trust server. -func pushTrustedReference(ctx context.Context, ioStreams command.Streams, indexInfo *registrytypes.IndexInfo, ref reference.Named, authConfig registrytypes.AuthConfig, in io.Reader) error { +func pushTrustedReference(ctx context.Context, dockerCLI command.Cli, ref reference.Named, responseBody io.Reader) error { + // Resolve the Repository name from fqn to RepositoryInfo, and create an + // IndexInfo. Docker Content Trust uses the IndexInfo.Official field to + // select the right domain for Docker Hub's Notary server; + // https://github.com/docker/cli/blob/v28.4.0/cli/trust/trust.go#L65-L79 + indexInfo := registry.NewIndexInfo(ref) repoInfo := &trust.RepositoryInfo{ Name: reference.TrimNamed(ref), Index: indexInfo, } - return trust.PushTrustedReference(ctx, ioStreams, repoInfo, ref, authConfig, in, command.UserAgent()) + authConfig := command.ResolveAuthConfig(dockerCLI.ConfigFile(), indexInfo) + return trust.PushTrustedReference(ctx, dockerCLI, repoInfo, ref, authConfig, responseBody, command.UserAgent()) } // trustedPull handles content trust pulling of an image diff --git a/cli/trust/trust.go b/cli/trust/trust.go index 0e9be5d36412..a48cfc7b8391 100644 --- a/cli/trust/trust.go +++ b/cli/trust/trust.go @@ -342,7 +342,10 @@ func GetImageReferencesAndAuth(ctx context.Context, return ImageRefAndAuth{}, err } - // Resolve the Repository name from fqn to RepositoryInfo + // Resolve the Repository name from fqn to RepositoryInfo, and create an + // IndexInfo. Docker Content Trust uses the IndexInfo.Official field to + // select the right domain for Docker Hub's Notary server; + // https://github.com/docker/cli/blob/v28.4.0/cli/trust/trust.go#L65-L79 indexInfo := registry.NewIndexInfo(ref) authConfig := authResolver(ctx, indexInfo) return ImageRefAndAuth{