Merge from upstream

.travis.yml

@@ -1,25 +1,43 @@
 language: go
 go:
-  - 1.7
+  - 1.8
 
 install:
   - go get -v github.com/Masterminds/glide
   - cd $GOPATH/src/github.com/Masterminds/glide && git checkout tags/v0.12.3 && go install && cd -
   - glide install -v
+  - go get -u github.com/jteeuwen/go-bindata/...
 
+addons:
+  artifacts:
+    paths:
+      - out/clairctl-darwin-386
+      - out/clairctl-darwin-amd64
+      - out/clairctl-linux-386
+      - out/clairctl-linux-amd64
+    target_paths: latest
+    working_dir: out
+
 script:
-- go build -ldflags "-X github.com/jgsqware/clairctl/cmd.version=$(cat VERSION)" -v
+- go generate ./clair
+- go get github.com/mitchellh/gox
+- gox -os="linux" -os="darwin" -arch="amd64 386" -output="out/{{.Dir}}-{{.OS}}-{{.Arch}}" -ldflags "-X github.com/jgsqware/clairctl/cmd.version=$(cat VERSION)"
 
 deploy:
   provider: releases
   api_key:
-    secure: SPeZzw212p/0iYPLVWUkLq226j19oWHBogHIlbKzkp8zNk7tdJEHMthAhka1zxS5afr+JWu3BBdduPHbnvvpXtv2axsrCXVsW7jPEcxXgfM3m/YSxQwjsGojMG318nX/E5ApY8eDhiZuHoTAP67DJZEoLteV5GKvNk7np74bMNexBxCPDIbXepBbjrEqxrUG/uVDFrmFf0LlCKVGxALK42uriaDM1tPGDy0+7zX7a3RqG9J4ROmZCQNzd9+rcur4DndrxYPCvJK3awUwXL5XzdRed24m5S8IG6Q/gMMUhUVECMNZ6/Z+KZ4CKqcQ9e9NvOtHYvO0OtPNrd4/HajZpUpfO008imSj6/g9NxdC6hJYvyK/HuRv5DsLgZukyvwroVSM5rC77FJeOmoLXfEBHo7E16I5XKGcp31NoCv5kdQuaHLxkBZk43CcnT/rraQ8cjCQAERQEh6u0fidyOvZ4vkTW30/c6H25zDejCzDcx1oHL4O8QwJwMfRSifSA8vk81saOurmQeviZK1UkpeWLxMYLpFZ8vN9kK/2Nn24ud9DN7N8bqGob13I8lJ69j9xcXuq/86vITziESZCHaYs2Hw1vSHD8vpkQxu8aSYqPXgwAKDwV9JkGV1/kcUdwpOlD/xkKunluu8Mf5K2JSm9G8xWr6foOibKsuHDn0nH+jY=
-  file: clairctl
+    secure: HgOSNmBsqtA3CutTWnRNp2LNROeoPYyU+zO6ZzFH+tkG8Bif+KEtQx9fRv2YNB7+TSYUkaoT3v0XqkHhKe7GmhTD9mZ2v5isKHhD/FhP/qRDAxugzf66+mJJBhQ5tS9gz2hVK1E+tnHK1L3IVIh47zeXEd2VpciuxPaTwC2zAWi97EHFivjClD3uE2cc1HztDF95cq+eZzo5hfJn4mYuaMfnIGdPD3yKZY1+hQ7aby/+MxNyIbVwefgxV/fNPiVmM9u07+uzHWHKTikp8UyHvdKOyJp31S20i22velRC0xf6g4/d9rwfaw1zFMnjeA4ClRGwNief0cfKVtB7/KMwGC8UNiHvtDEIJn5yelSpqatde96eK7NJ58uTYsWRHM5RPW9MphpxhHPzBNXiz2m9sfZ7Frf3NeA94nZT1WAkoF4jjgWPNbPjOJzpz80dzzbNFUSWSrJFrJSaleLQwdPMi0fwTh2VG6gvhqYcLqW0GMVIUHFA905SuJwXje+IPh74RtjDmyMrwaONZQDqDfldXvY04kmoUsEkWPQkI3gQivp8Ep+IGpz+L8LPG5GR3whCu+OQqto1yIAFFdveFuD1VBgVvqJQwODkDkYux1UJNek1vbgtuGxuThWILZ16WcrxBl0l/FhFqxQ76tsH5A+57euVc5SFHDN6f7c5K2rzLcU=
+  file: 
+    - out/clairctl-darwin-386
+    - out/clairctl-darwin-amd64
+    - out/clairctl-linux-386
+    - out/clairctl-linux-amd64
   skip_cleanup: true
   on:
     repo: jgsqware/clairctl
     tags: true
     branch: master
+
 env:
   global:
     secure: QpHC0r/d3sUNZ4Tisu7IjRnE+exzUUdTRlWUvvepWA2/wdsvsh9IFKmPgHvmt/V46RtByc52HVwE/uE6gF8eVhRs4L4DP/gSi0TxmfNi2m+6EdL1MmFvdIVGfPZDDbFnNNXpWcNJGv5/UDJ8eke003Mtm7/qQfJqH3UzxoWnTrvsA7IHbhxomgsHOFqHU+e6fmaQ3q7neUJEci2HSPLehl11yBwMcsYyFjeW+33GVQeI0m2j1TrcldG3KN63tszIx7tHXTUrIK369nrndLjYWnc7Hi+k6Uc8vPh111/hLBG4UtxffP+/DTkhEtzxDNn3hn4zSKTMIyeKA/UhnySYchzDYOdVZoM0oVxAkbTcdTPWCxS75W1u3AW3QAGxScNEqmy5enrW+kGyRpd1zIRJ1qS2tHAVmos8N6bl5Rp9UJF5UITr9/DyQS93O9DOSY5Z6UVGI5J+MlG89Nr4XJ5NW4ak5yC5fc+9IwM58VMk8ULS3I0g/YBWsWRWHGZrHurnvcGbiXHk5S+anQsiYUV8n3OUa67ai7Duil3qiPklEhHeFZzmXrJMvLdeVxywfvIfKzSEGqDrUYw3hO9pkMzLxDQfvaNzAHWZGJ970N7apX2pnAUgPDsNb8cOnbDSjX36FICAiUZlrkpsz6O6h3Fm/2t/HDCyYH7gf6eJXypUOYc=

Dockerfile

@@ -0,0 +1,53 @@
+FROM alpine:3.5
+
+ENV GOPATH=/go
+ENV PATH=${GOPATH}/bin:${PATH}
+ENV DOCKER_API_VERSION=1.24
+ARG DOCKER_VERSION=${DOCKER_VERSION:-latest}
+ARG CLAIRCTL_VERSION=${CLAIRCTL_VERSION:-master}
+ARG CLAIRCTL_COMMIT=
+
+RUN apk add --update curl \
+ && apk add --virtual build-dependencies go gcc build-base glide git \
+ && adduser clairctl -D \
+ && mkdir -p /reports \
+ && chown -R clairctl:clairctl /reports /tmp \
+ && curl https://get.docker.com/builds/Linux/x86_64/docker-${DOCKER_VERSION}.tgz -o docker.tgz \
+ && tar xfvz docker.tgz --strip 1 -C /usr/bin/ docker/docker \
+ && rm -f docker.tgz \
+ && go get -u github.com/jteeuwen/go-bindata/... \
+ && curl -sL https://github.com/jgsqware/clairctl/archive/${CLAIRCTL_VERSION}.zip -o clairctl.zip \
+ && mkdir -p ${GOPATH}/src/github.com/jgsqware/ \
+ && unzip clairctl.zip -d ${GOPATH}/src/github.com/jgsqware/ \
+ && rm -f clairctl.zip \
+ && mv ${GOPATH}/src/github.com/jgsqware/clairctl-* ${GOPATH}/src/github.com/jgsqware/clairctl \
+ && cd ${GOPATH}/src/github.com/jgsqware/clairctl \
+ && glide install -v \
+ && go generate ./clair \
+ && go build -o /usr/local/bin/clairctl -ldflags "-X github.com/jgsqware/clairctl/cmd.version=${CLAIRCTL_VERSION}-${CLAIRCTL_COMMIT}" \
+ && apk del build-dependencies \
+ && rm -rf /var/cache/apk/* \
+ && rm -rf /root/.glide/ \
+ && rm -rf /go \
+ && echo $'clair:\n\
+  port: 6060\n\
+  healthPort: 6061\n\
+  uri: http://clair\n\
+  priority: Low\n\
+  report:\n\
+    path: /reports\n\
+    format: html\n\
+clairctl:\n\
+  port: 44480\n\
+  tempfolder: /tmp'\
+    > /home/clairctl/clairctl.yml
+
+USER clairctl
+
+WORKDIR /home/clairctl/
+
+EXPOSE 44480
+
+VOLUME ["/tmp/", "/reports/"]
+
+CMD ["/usr/sbin/crond", "-f"]

README.md

@@ -1,11 +1,24 @@
 # clairctl
 [![Build Status](https://travis-ci.org/jgsqware/clairctl.svg?branch=master)](https://travis-ci.org/jgsqware/clairctl)
+[![Gitter chat](https://badges.gitter.im/gitterHQ/gitter.png)](https://gitter.im/clairctl/Lobby?utm_source=share-link&utm_medium=link&utm_campaign=share-link)
 
 > Tracking container vulnerabilities with Clair Control
 
 Clairctl is a lightweight command-line tool doing the bridge between Registries as Docker Hub, Docker Registry or Quay.io, and the CoreOS vulnerability tracker, Clair.
 Clairctl will play as reverse proxy for authentication.
 
+Clairctl version is align with the [CoreOS Clair](https://github.com/coreos/clair) supported version.
+
+# Installation
+
+  ## Released version:
+  Go to [Release](https://github.com/jgsqware/clairctl/releases) and download your corresponding version
+
+  ## Master branch version
+
+    curl -L https://raw.githubusercontent.com/jgsqware/clairctl/master/install.sh | sh
+
+
 # Usage
 
 [![asciicast](https://asciinema.org/a/41461.png)](https://asciinema.org/a/41461)
@@ -55,7 +68,7 @@ clair:
 
 # Building the latest binaries
 
-**clairctl** requires at least Go 1.7.
+**clairctl** requires Go 1.8+.
 
 Install Glide:
 ```
@@ -64,8 +77,10 @@ curl https://glide.sh/get | sh
 
 Clone and build:
 ```
-git clone github.com/jgsqware/clairctl  $GOPATH/src/github.com/jgsqware/clairctl
+git clone git@github.com:jgsqware/clairctl.git $GOPATH/src/github.com/jgsqware/clairctl
+cd $GOPATH/src/github.com/jgsqware/clairctl
 glide install -v
+go generate ./clair
 go build
 ```
 

VERSION

@@ -1 +1 @@
-1.2.2
+1.2.6

clair/layering.go

@@ -8,6 +8,7 @@ import (
 	"github.com/coreos/clair/api/v1"
 	"github.com/docker/docker/reference"
 	"github.com/jgsqware/clairctl/config"
+	"github.com/jgsqware/clairctl/docker/dockerdist"
 	"github.com/jgsqware/clairctl/xstrings"
 )
 
@@ -49,20 +50,21 @@ func (layers *layering) pushAll() error {
 
 		lUID := xstrings.Substr(digest, 0, 12)
 		log.Infof("Pushing Layer %d/%d [%v]", index+1, layerCount, lUID)
-
 		insertRegistryMapping(digest, layers.image.Hostname())
+		u, _ := dockerdist.GetPushURL(layers.image.Hostname())
 		payload := v1.LayerEnvelope{Layer: &v1.Layer{
 			Name:       digest,
-			Path:       blobsURI(layers.image.Hostname(), layers.image.RemoteName(), digest),
+			Path:       blobsURI(u.String(), layers.image.RemoteName(), digest),
 			ParentName: layers.parentID,
 			Format:     "Docker",
 		}}
 
 		//FIXME Update to TLS
 		if config.IsLocal {
+			payload.Layer.Path = strings.Replace(payload.Layer.Path, u.String(), layers.hURL, 1)
 			payload.Layer.Path += "/layer.tar"
 		}
-		payload.Layer.Path = strings.Replace(payload.Layer.Path, layers.image.Hostname(), layers.hURL, 1)
+
 		if err := pushLayer(payload); err != nil {
 			log.Infof("adding layer %d/%d [%v]: %v", index+1, layerCount, lUID, err)
 			if err != ErrUnanalizedLayer {

clair/push.go

@@ -2,18 +2,22 @@ package clair
 
 import (
 	"bytes"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/coreos/clair/api/v1"
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/manifest/schema1"
 	"github.com/docker/distribution/manifest/schema2"
 	"github.com/docker/docker/reference"
+	"github.com/jgsqware/clairctl/config"
 	"github.com/jgsqware/clairctl/docker/dockerdist"
+	"github.com/spf13/viper"
 )
 
 // ErrUnanalizedLayer is returned when the layer was not correctly analyzed
@@ -49,11 +53,15 @@ func Push(image reference.NamedTagged, manifest distribution.Manifest) error {
 		}
 		return layers.pushAll()
 	default:
-		return errors.New("Unsupported Schema version.")
+		return errors.New("unsupported Schema version")
 	}
 }
 
 func pushLayer(layer v1.LayerEnvelope) error {
+	if !config.IsLocal {
+		layer = auth(layer)
+	}
+
 	lJSON, err := json.Marshal(layer)
 	if err != nil {
 		return fmt.Errorf("marshalling layer: %v", err)
@@ -83,6 +91,33 @@ func pushLayer(layer v1.LayerEnvelope) error {
 	return nil
 }
 
+func auth(layer v1.LayerEnvelope) v1.LayerEnvelope {
+
+	out, _ := url.Parse(layer.Layer.Path)
+	client := &http.Client{Transport: &http.Transport{
+		TLSClientConfig:    &tls.Config{InsecureSkipVerify: viper.GetBool("auth.insecureSkipVerify")},
+		DisableCompression: true,
+	}}
+
+	log.Debugf("auth.insecureSkipVerify: %v", viper.GetBool("auth.insecureSkipVerify"))
+	log.Debugf("request.URL.String(): %v", out)
+	req, _ := http.NewRequest("HEAD", out.String(), nil)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Errorf("response error: %v", err)
+		return v1.LayerEnvelope{}
+	}
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		log.Info("pull from clair is unauthorized")
+		dockerdist.AuthenticateResponse(client, resp, req)
+	}
+	layer.Layer.Headers = make(map[string]string)
+	layer.Layer.Headers["Authorization"] = req.Header.Get("Authorization")
+	return layer
+}
+
 func blobsURI(registry string, name string, digest string) string {
 	return strings.Join([]string{registry, name, "blobs", digest}, "/")
 }