[WIP] [EXP] proofing

pkg/testutil/images.env

@@ -0,0 +1,28 @@
+# Future: images to update once we have proofing in place.
+#BUSYBOX=busybox:1.37.0@sha256:37f7b378a29ceb4c551b1b5582e27747b855bbfaa73fa11914fe0df028dc581f
+#DEBIAN=debian:bookworm-slim@sha256:b1211f6d19afd012477bd34fdcabb6b663d680e0f4b0537da6e6b0fd057a3ec3
+#GITLAB=gitlab/gitlab-ee:17.11.0-ee.0@sha256:e0d9d5e0d0068f4b4bac3e15eb48313b5c3bb508425645f421bf2773a964c4ae
+#HARBOR=bitnami/harbor-portal:v2.13.0@sha256:636f39610b359369aeeddd7859cb56274d9a1bc3e467e21d74ea89e1516c1a0c
+#MARIADB=mariadb:11.7.2@sha256:81e893032978c4bf8ad43710b7a979774ed90787fa32d199162148ce28fe3b76
+#NGINX=nginx:alpine3.21@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
+#WORDPRESS=wordpress:6.8.0-php8.4-fpm-alpine@sha256:309b64fa4266d8a3fe6f0973ae3172fec1023c9b18242ccf1dffbff5dc8b81a8
+
+ALPINE=ghcr.io/stargz-containers/alpine:3.13-org
+BUSYBOX=ghcr.io/containerd/busybox:1.36
+DOCKER_AUTH=ghcr.io/stargz-containers/cesanta/docker_auth:1.7-org
+FLUENTD=fluentd:v1.18.0-debian-1.0
+GOLANG=golang:1.23.8-bookworm
+KUBO=ghcr.io/stargz-containers/ipfs/kubo:v0.16.0-org
+MARIADB=ghcr.io/stargz-containers/mariadb:10.5-org
+NANOSERVER=mcr.microsoft.com/windows/nanoserver:ltsc2022
+NGINX=ghcr.io/stargz-containers/nginx:1.19-alpine-org
+# FIXME: update to v3 soon. Right now, this is breaking tests.
+# REGISTRY=ghcr.io/distribution/distribution:3.0.0@sha256:4ba3adf47f5c866e9a29288c758c5328ef03396cb8f5f6454463655fa8bc83e2
+REGISTRY=ghcr.io/stargz-containers/registry:2-org
+STARGZ=ghcr.io/containerd/stargz-snapshotter:0.15.1-kind
+WORDPRESS=ghcr.io/stargz-containers/wordpress:5.7-org
+FEDORAESGZ=ghcr.io/stargz-containers/fedora:30-esgz
+# SOCI
+FFMPEGSOCI=public.ecr.aws/soci-workshop-examples/ffmpeg:latest
+# Large enough for testing soci index creation
+UBUNTU=public.ecr.aws/docker/library/ubuntu:23.10

pkg/testutil/images_linux.go

@@ -0,0 +1,62 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package testutil
+
+import (
+	_ "embed"
+	"fmt"
+	"strings"
+
+	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
+)
+
+//go:embed images.env
+var imagesList string
+
+// getImage retrieves (from the env file) the fully qualified reference of an image, from its short name.
+// No particular error handling effort is done here.
+// If the env file is broken, or if the requested image does not exist, this is fatal.
+func getImage(name string) string {
+	key := strings.ToUpper(name)
+
+	for _, k := range strings.Split(imagesList, "\n") {
+		k = strings.TrimSpace(k)
+		if strings.HasPrefix(k, "#") || k == "" {
+			continue
+		}
+
+		spl := strings.Split(k, "=")
+		if len(spl) != 2 {
+			continue
+		}
+
+		if key == spl[0] {
+			item, err := referenceutil.Parse(spl[1])
+
+			if err != nil {
+				panic(fmt.Errorf("malformed image found in env file: %w (%s)", err, spl[1]))
+			}
+
+			return item.Domain + "/" + item.Path + ":" + item.Tag
+		}
+	}
+
+	panic(fmt.Sprintf("no such test image is defined: %s", name))
+
+	//nolint:govet
+	return ""
+}

pkg/testutil/nerdtest/platform/platform_darwin.go

@@ -23,7 +23,6 @@ func DataHome() (string, error) {
 var (
 	// The following are here solely for darwin to compile / lint. They are not used, as the corresponding tests are running only on linux.
 	RegistryImageStable = "registry:2"
-	RegistryImageNext   = "ghcr.io/distribution/distribution:"
 	KuboImage           = "ipfs/kubo:v0.16.0"
 	DockerAuthImage     = "cesanta/docker_auth:1.7"
 )

pkg/testutil/nerdtest/platform/platform_freebsd.go

@@ -23,7 +23,6 @@ func DataHome() (string, error) {
 var (
 	// The following are here solely for freebsd to compile / lint. They are not used, as the corresponding tests are running only on linux.
 	RegistryImageStable = "registry:2"
-	RegistryImageNext   = "ghcr.io/distribution/distribution:"
 	KuboImage           = "ipfs/kubo:v0.16.0"
 	DockerAuthImage     = "cesanta/docker_auth:1.7"
 )

pkg/testutil/nerdtest/platform/platform_linux.go

@@ -27,7 +27,6 @@ func DataHome() (string, error) {
 
 var (
 	RegistryImageStable = testutil.RegistryImageStable
-	RegistryImageNext   = testutil.RegistryImageNext
 	KuboImage           = testutil.KuboImage
 	DockerAuthImage     = testutil.DockerAuthImage
 )

pkg/testutil/nerdtest/platform/platform_windows.go

@@ -16,22 +16,12 @@
 
 package platform
 
-import (
-	"fmt"
-)
-
 func DataHome() (string, error) {
 	panic("not supported")
 }
 
-// The following are here solely for windows to compile. They are not used, as the corresponding tests are running only on linux.
-func mirrorOf(s string) string {
-	return fmt.Sprintf("ghcr.io/stargz-containers/%s-org", s)
-}
-
 var (
-	RegistryImageStable = mirrorOf("registry:2")
-	RegistryImageNext   = "ghcr.io/distribution/distribution:"
-	KuboImage           = mirrorOf("ipfs/kubo:v0.16.0")
-	DockerAuthImage     = mirrorOf("cesanta/docker_auth:1.7")
+	RegistryImageStable = "there-is-no-such-test-on-windows"
+	KuboImage           = "there-is-no-such-test-on-windows"
+	DockerAuthImage     = "there-is-no-such-test-on-windows"
 )

pkg/testutil/nerdtest/registry/docker.go

@@ -19,7 +19,6 @@ package registry
 import (
 	"fmt"
 	"net"
-	"os"
 	"strconv"
 
 	"gotest.tools/v3/assert"
@@ -71,15 +70,7 @@ func NewDockerRegistry(data test.Data, helpers test.Helpers, currentCA *testca.C
 	// Attach authentication params returns by authenticator
 	args = append(args, auth.Params(data)...)
 
-	// Get the right registry version
 	registryImage := platform.RegistryImageStable
-	up := os.Getenv("DISTRIBUTION_VERSION")
-	if up != "" {
-		if up[0:1] != "v" {
-			up = "v" + up
-		}
-		registryImage = platform.RegistryImageNext + up
-	}
 	args = append(args, registryImage)
 
 	cleanup := func(data test.Data, helpers test.Helpers) {

pkg/testutil/nerdtest/requirements.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"os/exec"
 	"strings"
 
@@ -275,13 +274,6 @@ var Registry = require.All(
 				// - when we start a large number of registries in subtests, no need to round-trip to ghcr everytime
 				// This of course assumes that the subtests are NOT going to prune / rmi images
 				registryImage := platform.RegistryImageStable
-				up := os.Getenv("DISTRIBUTION_VERSION")
-				if up != "" {
-					if up[0:1] != "v" {
-						up = "v" + up
-					}
-					registryImage = platform.RegistryImageNext + up
-				}
 				helpers.Ensure("pull", "--quiet", registryImage)
 				helpers.Ensure("pull", "--quiet", platform.DockerAuthImage)
 				helpers.Ensure("pull", "--quiet", platform.KuboImage)

pkg/testutil/testregistry/testregistry_linux.go

@@ -56,13 +56,6 @@ type TokenAuthServer struct {
 
 func EnsureImages(base *testutil.Base) {
 	registryImage := platform.RegistryImageStable
-	up := os.Getenv("DISTRIBUTION_VERSION")
-	if up != "" {
-		if up[0:1] != "v" {
-			up = "v" + up
-		}
-		registryImage = platform.RegistryImageNext + up
-	}
 	base.Cmd("pull", "--quiet", registryImage).AssertOK()
 	base.Cmd("pull", "--quiet", platform.DockerAuthImage).AssertOK()
 	base.Cmd("pull", "--quiet", platform.KuboImage).AssertOK()
@@ -284,14 +277,6 @@ func NewRegistry(base *testutil.Base, ca *testca.CA, port int, auth Auth, boundC
 
 	args = append(args, auth.Params(base)...)
 	registryImage := testutil.RegistryImageStable
-
-	up := os.Getenv("DISTRIBUTION_VERSION")
-	if up != "" {
-		if up[0:1] != "v" {
-			up = "v" + up
-		}
-		registryImage = testutil.RegistryImageNext + up
-	}
 	args = append(args, registryImage)
 
 	cleanup := func(err error) {

pkg/testutil/testutil.go

@@ -763,8 +763,3 @@ func RegisterBuildCacheCleanup(t *testing.T) {
 		NewBase(t).Cmd("builder", "prune", "--all", "--force").Run()
 	})
 }
-
-func mirrorOf(s string) string {
-	// plain mirror, NOT stargz-converted images
-	return fmt.Sprintf("ghcr.io/stargz-containers/%s-org", s)
-}

pkg/testutil/testutil_darwin.go

@@ -28,8 +28,8 @@ const (
 )
 
 var (
-	BusyboxImage     = "ghcr.io/containerd/busybox:1.36"
-	AlpineImage      = mirrorOf("alpine:3.13")
-	NginxAlpineImage = mirrorOf("nginx:1.19-alpine")
-	GolangImage      = mirrorOf("golang:1.18")
+	BusyboxImage     = "there-is-no-test-on-darwin"
+	AlpineImage      = "there-is-no-test-on-darwin"
+	NginxAlpineImage = "there-is-no-test-on-darwin"
+	GolangImage      = "there-is-no-test-on-darwin"
 )

pkg/testutil/testutil_freebsd.go

@@ -28,8 +28,8 @@ const (
 )
 
 var (
-	BusyboxImage     = "ghcr.io/containerd/busybox:1.36"
-	AlpineImage      = mirrorOf("alpine:3.13")
-	NginxAlpineImage = mirrorOf("nginx:1.19-alpine")
-	GolangImage      = mirrorOf("golang:1.18")
+	BusyboxImage     = "there-is-no-such-test-on-freebsd"
+	AlpineImage      = "there-is-no-such-test-on-freebsd"
+	NginxAlpineImage = "there-is-no-such-test-on-freebsd"
+	GolangImage      = "there-is-no-such-test-on-freebsd"
 )

pkg/testutil/testutil_linux.go

@@ -17,38 +17,38 @@
 package testutil
 
 var (
-	BusyboxImage                = "ghcr.io/containerd/busybox:1.36"
-	AlpineImage                 = mirrorOf("alpine:3.13")
-	NginxAlpineImage            = mirrorOf("nginx:1.19-alpine")
-	NginxAlpineIndexHTMLSnippet = "<title>Welcome to nginx!</title>"
-	RegistryImageStable         = mirrorOf("registry:2")
-	RegistryImageNext           = "ghcr.io/distribution/distribution:"
-	WordpressImage              = mirrorOf("wordpress:5.7")
-	WordpressIndexHTMLSnippet   = "<title>WordPress &rsaquo; Installation</title>"
-	MariaDBImage                = mirrorOf("mariadb:10.5")
-	DockerAuthImage             = mirrorOf("cesanta/docker_auth:1.7")
-	FluentdImage                = "fluent/fluentd:v1.17.0-debian-1.0"
-	KuboImage                   = mirrorOf("ipfs/kubo:v0.16.0")
-	SystemdImage                = "ghcr.io/containerd/stargz-snapshotter:0.15.1-kind"
-	GolangImage                 = mirrorOf("golang:1.18")
-
-	// Source: https://gist.github.com/cpuguy83/fcf3041e5d8fb1bb5c340915aabeebe0
-	NonDistBlobImage = "ghcr.io/cpuguy83/non-dist-blob:latest"
-	// Foreign layer digest
-	NonDistBlobDigest = "sha256:be691b1535726014cdf3b715ff39361b19e121ca34498a9ceea61ad776b9c215"
+	AlpineImage         = getImage("alpine")
+	BusyboxImage        = getImage("busybox")
+	DockerAuthImage     = getImage("docker_auth")
+	FluentdImage        = getImage("fluentd")
+	GolangImage         = getImage("golang")
+	KuboImage           = getImage("kubo")
+	MariaDBImage        = getImage("mariadb")
+	NginxAlpineImage    = getImage("nginx")
+	RegistryImageStable = getImage("registry")
+	SystemdImage        = getImage("stargz")
+	WordpressImage      = getImage("wordpress")
 
 	CommonImage = AlpineImage
 
+	FedoraESGZImage = getImage("fedoraesgz") // eStargz
+	FfmpegSociImage = getImage("ffmpegsoci") // SOCI
+	UbuntuImage     = getImage("ubuntu")     // Large enough for testing soci index creation
+)
+
+const (
 	// This error string is expected when attempting to connect to a TCP socket
 	// for a service which actively refuses the connection.
 	// (e.g. attempting to connect using http to an https endpoint).
 	// It should be "connection refused" as per the TCP RFC.
 	// https://www.rfc-editor.org/rfc/rfc793
 	ExpectedConnectionRefusedError = "connection refused"
-)
 
-const (
-	FedoraESGZImage = "ghcr.io/stargz-containers/fedora:30-esgz"            // eStargz
-	FfmpegSociImage = "public.ecr.aws/soci-workshop-examples/ffmpeg:latest" // SOCI
-	UbuntuImage     = "public.ecr.aws/docker/library/ubuntu:23.10"          // Large enough for testing soci index creation
+	NginxAlpineIndexHTMLSnippet = "<title>Welcome to nginx!</title>"
+	WordpressIndexHTMLSnippet   = "<title>WordPress &rsaquo; Installation</title>"
+
+	// Source: https://gist.github.com/cpuguy83/fcf3041e5d8fb1bb5c340915aabeebe0
+	NonDistBlobImage = "ghcr.io/cpuguy83/non-dist-blob:latest@sha256:8859ffb0bb604463fe19f1e606ceda9f4f8f42e095bf78c42458cf6da7b5c7e7"
+	// Foreign layer digest
+	NonDistBlobDigest = "sha256:be691b1535726014cdf3b715ff39361b19e121ca34498a9ceea61ad776b9c215"
 )

pkg/testutil/testutil_windows.go

@@ -53,8 +53,8 @@ const (
 )
 
 var (
-	GolangImage = mirrorOf("fixme-test-using-this-image-is-disabled-on-windows")
-	AlpineImage = mirrorOf("fixme-test-using-this-image-is-disabled-on-windows")
+	GolangImage = "fixme-test-using-this-image-is-disabled-on-windows"
+	AlpineImage = "fixme-test-using-this-image-is-disabled-on-windows"
 
 	hypervContainer     bool
 	hypervSupported     bool