​

​

// ImageIndex defines the interface to interact with OCI ImageIndex
type ImageIndex interface {
  // Returns the MediaType of the current imageIndex
  MediaType() (types.MediaType, error)

  // Returns the sha256 value of this ImageIndex manifest.
  Digest() (Hash, error)

  // Returns the size of this ImageIndex manifest
  Size() (int64, error)

  // Returns the manifest structure of this ImageIndex
  IndexManifest() (*IndexManifest, error)

  // Returns the array of manifest bytes of this ImageIndex
  RawManifest() ([]byte, error)

  // Returns the Image referenced by this ImageIndex
  Image(Hash) (Image, error)

  // Returns the ImageIndex referenced by this ImageIndex
  ImageIndex(Hash) (ImageIndex, error)
}

// Image defines the interface to interact with OCI Image
type Image interface {
  // All levels of the current image are returned. The oldest / most basic layer is in front of the array, and the uppermost / latest layer is behind the array
  Layers() ([]Layer, error)

  // Returns the MediaType of the current image
  MediaType() (types.MediaType, error)

  // Returns the size of the Image manifest
  Size() (int64, error)

  // Returns the hash value of the ConfigFile of the image, which is also the ImageID of the image
  ConfigName() (Hash, error)

  // Returns the ConfigFile of this image
  ConfigFile() (*ConfigFile, error)

  // Returns the byte array of ConfigFile for this image
  RawConfigFile() ([]byte, error)

  // Returns the sha256 value of this Image Manifest
  Digest() (Hash, error)

  // Return this Image Manifest
  Manifest() (*Manifest, error)

  // Returns the bytes array of ImageManifest
  RawManifest() ([]byte, error)

  // Return a layer in the image and find it according to digest (compressed hash value)
  LayerByDigest(Hash) (Layer, error)

  // Return a layer in the image and find it according to diffid (uncompressed hash value)
  LayerByDiffID(Hash) (Layer, error)
}

// Layer defines the interface to access the specific layer of OCI Image
type Layer interface {
  // Returns the sha256 value of the compressed layer
  Digest() (Hash, error)

  // The sha256 value of uncompressed layer is returned
  DiffID() (Hash, error)

  // The compressed mirror layer is returned
  Compressed() (io.ReadCloser, error)

  // Uncompressed mirror layer returned
  Uncompressed() (io.ReadCloser, error)

  // Returns the size of the mirror layer after compression
  Size() (int64, error)

  // Returns the MediaType of the current layer
  MediaType() (types.MediaType, error)
}

package main

import (
  "github.com/google/go-containerregistry/pkg/authn"
  "github.com/google/go-containerregistry/pkg/name"
  "github.com/google/go-containerregistry/pkg/v1/remote"
)

func main() {
  ref, err := name.ParseReference("xxx")
  if err != nil {
    panic(err)
  }
  tryRemote(context.TODO(), ref, GetDockerOption())
  if err != nil {
    panic(err)
  }

  // do stuff with img
}

type DockerOption struct {
  // Auth
  UserName string
  Password string

  // RegistryToken is a bearer token to be sent to a registry
  RegistryToken string

  // ECR
  AwsAccessKey    string
  AwsSecretKey    string
  AwsSessionToken string
  AwsRegion       string

  // GCP
  GcpCredPath string

  InsecureSkipTLSVerify bool
  NonSSL                bool
  SkipPing              bool // this is ignored now
  Timeout               time.Duration
}

func GetDockerOption() (types.DockerOption, error) {
  cfg := DockerConfig{}
  if err := env.Parse(&cfg); err != nil {
    return types.DockerOption{}, fmt.Errorf("unable to parse environment variables: %w", err)
  }

  return types.DockerOption{
    UserName:              cfg.UserName,
    Password:              cfg.Password,
    RegistryToken:         cfg.RegistryToken,
    InsecureSkipTLSVerify: cfg.Insecure,
    NonSSL:                cfg.NonSSL,
  }, nil
}

func tryRemote(ctx context.Context, ref name.Reference, option types.DockerOption) (v1.Image, extender, error) {
  var remoteOpts []remote.Option
  if option.InsecureSkipTLSVerify {
    t := &http.Transport{
      TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    }
    remoteOpts = append(remoteOpts, remote.WithTransport(t))
  }

  domain := ref.Context().RegistryStr()
  auth := token.GetToken(ctx, domain, option)

  if auth.Username != "" && auth.Password != "" {
    remoteOpts = append(remoteOpts, remote.WithAuth(&auth))
  } else if option.RegistryToken != "" {
    bearer := authn.Bearer{Token: option.RegistryToken}
    remoteOpts = append(remoteOpts, remote.WithAuth(&bearer))
  } else {
    remoteOpts = append(remoteOpts, remote.WithAuthFromKeychain(authn.DefaultKeychain))
  }

  desc, err := remote.Get(ref, remoteOpts...)
  if err != nil {
    return nil, nil, err
  }

  img, err := desc.Image()
  if err != nil {
    return nil, nil, err
  }

  // Return v1.Image if the image is found in Docker Registry
  return img, remoteExtender{
    ref:        implicitReference{ref: ref},
    descriptor: desc,
  }, nil
}

// Taronceoperator reads the file once and shares the content so that the analyzer can share the data
func tarOnceOpener(r io.Reader) func() ([]byte, error) {
  var once sync.Once
  var b []byte
  var err error

  return func() ([]byte, error) {
    once.Do(func() {
      b, err = ioutil.ReadAll(r)
    })
    if err != nil {
      return nil, xerrors.Errorf("unable to read tar file: %w", err)
    }
    return b, nil
  }
}

// This method mainly traverses the entire io stream, first parses the path (prefix, suffix) of the file, and then calls the analyzeFn method to parse the contents of the file.
func WalkLayerTar(layer io.Reader, analyzeFn WalkFunc) ([]string, []string, error) {
  var opqDirs, whFiles []string
  var result *AnalysisResult
  tr := tar.NewReader(layer)
  opq := ".wh..wh..opq"
  wh  := ".wh."
  for {
    hdr, err := tr.Next()
    if err == io.EOF {
      break
    }
    if err != nil {
      return nil, nil, xerrors.Errorf("failed to extract the archive: %w", err)
    }

    filePath := hdr.Name
    filePath = strings.TrimLeft(filepath.Clean(filePath), "/")
    fileDir, fileName := filepath.Split(filePath)

    // e.g. etc/.wh..wh..opq
    if opq == fileName {
      opqDirs = append(opqDirs, fileDir)
      continue
    }
    // etc/.wh.hostname
    if strings.HasPrefix(fileName, wh) {
      name := strings.TrimPrefix(fileName, wh)
      fpath := filepath.Join(fileDir, name)
      whFiles = append(whFiles, fpath)
      continue
    }

    if hdr.Typeflag == tar.TypeSymlink || hdr.Typeflag == tar.TypeLink || hdr.Typeflag == tar.TypeReg {
      analyzeFn(filePath, hdr.FileInfo(), tarOnceOpener(tr), result)
      if err != nil {
        return nil, nil, xerrors.Errorf("failed to analyze file: %w", err)
      }
    }
  }

  return opqDirs, whFiles, nil
}

// Call different driver s to parse the same file
func analyzeFn(filePath string, info os.FileInfo, opener analyzer.Opener,result *AnalysisResult) error {
    if info.IsDir() {
        return nil, nil
    }
    
    var wg sync.WaitGroup
    for _, d := range drivers {
      // filepath extracted from tar file doesn't have the prefix "/"
      if !d.Required(strings.TrimLeft(filePath, "/"), info) {
        continue
      }
      b, err := opener()
      if err != nil {
        return nil, xerrors.Errorf("unable to open a file (%s): %w", filePath, err)
      }

      if err = limit.Acquire(ctx, 1); err != nil {
        return nil, xerrors.Errorf("semaphore acquire: %w", err)
      }
      wg.Add(1)

      go func(a analyzer, target AnalysisTarget) {
        defer limit.Release(1)
        defer wg.Done()

        ret, err := a.Analyze(target)
        if err != nil && !xerrors.Is(err, aos.AnalyzeOSError) {
          log.Logger.Debugf("Analysis error: %s", err)
          return nil, err
        }
        result.Merge(ret)
      }(d, AnalysisTarget{Dir: dir, FilePath: filePath, Content: b})
    }
    
    
    return result, nil
}

// drivers: used to parse files in tar package
func (a alpinePkgAnalyzer) Analyze(target analyzer.AnalysisTarget) (*analyzer.AnalysisResult, error) {
  scanner := bufio.NewScanner(bytes.NewBuffer(target.Content))
  var pkg types.Package
  var version string
  for scanner.Scan() {
    line := scanner.Text()

    // check package if paragraph end
    if len(line) < 2 {
      if analyzer.CheckPackage(&pkg) {
        pkgs = append(pkgs, pkg)
      }
      pkg = types.Package{}
      continue
    }

    switch line[:2] {
    case "P:":
      pkg.Name = line[2:]
    case "V:":
      version = string(line[2:])
      if !apkVersion.Valid(version) {
        log.Printf("Invalid Version Found : OS %s, Package %s, Version %s", "alpine", pkg.Name, version)
        continue
      }
      pkg.Version = version
    case "o:":
      origin := line[2:]
      pkg.SrcName = origin
      pkg.SrcVersion = version
    }
  }
  // in case of last paragraph
  if analyzer.CheckPackage(&pkg) {
    pkgs = append(pkgs, pkg)
  }

  parsedPkgs := a.uniquePkgs(pkgs)

  return &analyzer.AnalysisResult{
    PackageInfos: []types.PackageInfo{
      {
        FilePath: target.FilePath,
        Packages: parsedPkgs,
      },
    },
  }, nil
}

func parseArtifact(c conf, fileName string, r io.ReadCloser) ([]types.Library, error) {
  defer r.Close()
  b, err := ioutil.ReadAll(r)
  if err != nil {
    return nil, xerrors.Errorf("unable to read the jar file: %w", err)
  }
  zr, err := zip.NewReader(bytes.NewReader(b), int64(len(b)))
  if err != nil {
    return nil, xerrors.Errorf("zip error: %w", err)
  }

  fileName = filepath.Base(fileName)
  fileProps := parseFileName(fileName)

  var libs []types.Library
  var m manifest
  var foundPomProps bool

  for _, fileInJar := range zr.File {
    switch {
    case filepath.Base(fileInJar.Name) == "pom.properties":
      props, err := parsePomProperties(fileInJar)
      if err != nil {
        return nil, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
      }
      libs = append(libs, props.library())
      if fileProps.artifactID == props.artifactID && fileProps.version == props.version {
        foundPomProps = true
      }
    case filepath.Base(fileInJar.Name) == "MANIFEST.MF":
      m, err = parseManifest(fileInJar)
      if err != nil {
        return nil, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
      }
    case isArtifact(fileInJar.Name):
      fr, err := fileInJar.Open()
      if err != nil {
        return nil, xerrors.Errorf("unable to open %s: %w", fileInJar.Name, err)
      }

      // Recursive parsing jar/war/ear 
      innerLibs, err := parseArtifact(c, fileInJar.Name, fr)
      if err != nil {
        return nil, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
      }
      libs = append(libs, innerLibs...)
    }
  }

  // If you find POM Properties file, the libs object is returned directly
  if foundPomProps {
    return libs, nil
  }
  // If POM is not found Properties file, parse manifest MF file
  manifestProps := m.properties()
  if manifestProps.valid() {
    // Even if artifactid or groupid is found here, it may be illegal. Here, you will visit maven and other warehouses to confirm whether the jar package really exists
    if ok, _ := exists(c, manifestProps); ok {
      return append(libs, manifestProps.library()), nil
    }
  }
  p, err := searchBySHA1(c, b)
  if err == nil {
    return append(libs, p.library()), nil
  } else if !xerrors.Is(err, ArtifactNotFoundErr) {
    return nil, xerrors.Errorf("failed to search by SHA1: %w", err)
  }
  return libs, nil
}