Add ability to pull images directly from a registry (#378)

* add registry image source

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* use explicit source for fetching image + add scheme and registry tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* adjust test variable name and add credential helper function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

test/cli/packages_cmd_test.go

@@ -21,7 +21,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			args: []string{"packages", "-o", "json", request},
 			assertions: []traitAssertion{
 				assertJsonReport,
-				assertSource(source.SquashedScope),
+				assertScope(source.SquashedScope),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -56,7 +56,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "squashed-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "squashed", request},
 			assertions: []traitAssertion{
-				assertSource(source.SquashedScope),
+				assertScope(source.SquashedScope),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -64,7 +64,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "all-layers-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "all-layers", request},
 			assertions: []traitAssertion{
-				assertSource(source.AllLayersScope),
+				assertScope(source.AllLayersScope),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -75,7 +75,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			},
 			args: []string{"packages", "-o", "json", request},
 			assertions: []traitAssertion{
-				assertSource(source.AllLayersScope),
+				assertScope(source.AllLayersScope),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -137,3 +137,75 @@ func TestPackagesCmdFlags(t *testing.T) {
 		})
 	}
 }
+
+func TestRegistryAuth(t *testing.T) {
+	tests := []struct {
+		name       string
+		args       []string
+		env        map[string]string
+		assertions []traitAssertion
+	}{
+		{
+			name: "fallback to keychain",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			assertions: []traitAssertion{
+				assertInOutput("source=OciRegistry"),
+				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput("no registry credentials configured, using the default keychain"),
+			},
+		},
+		{
+			name: "use creds",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			env: map[string]string{
+				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+				"SYFT_REGISTRY_AUTH_USERNAME":  "username",
+				"SYFT_REGISTRY_AUTH_PASSWORD":  "password",
+			},
+			assertions: []traitAssertion{
+				assertInOutput("source=OciRegistry"),
+				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput(`using registry credentials for "localhost:5000"`),
+			},
+		},
+		{
+			name: "use token",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			env: map[string]string{
+				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+				"SYFT_REGISTRY_AUTH_TOKEN":     "token",
+			},
+			assertions: []traitAssertion{
+				assertInOutput("source=OciRegistry"),
+				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput(`using registry token for "localhost:5000"`),
+			},
+		},
+		{
+			name: "not enough info fallsback to keychain",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			env: map[string]string{
+				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+			},
+			assertions: []traitAssertion{
+				assertInOutput("source=OciRegistry"),
+				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput(`no registry credentials configured, using the default keychain`),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cmd, stdout, stderr := runSyftCommand(t, test.env, test.args...)
+			for _, traitAssertionFn := range test.assertions {
+				traitAssertionFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
+			}
+			if t.Failed() {
+				t.Log("STDOUT:\n", stdout)
+				t.Log("STDERR:\n", stderr)
+				t.Log("COMMAND:", strings.Join(cmd.Args, " "))
+			}
+		})
+	}
+}

test/cli/trait_assertions_test.go

@@ -27,7 +27,7 @@ func assertTableReport(tb testing.TB, stdout, _ string, _ int) {
 	}
 }
 
-func assertSource(scope source.Scope) traitAssertion {
+func assertScope(scope source.Scope) traitAssertion {
 	return func(tb testing.TB, stdout, stderr string, rc int) {
 		// we can only verify source with the json report
 		assertJsonReport(tb, stdout, stderr, rc)

test/integration/catalog_packages_test.go

@@ -23,7 +23,7 @@ func BenchmarkImagePackageCatalogers(b *testing.B) {
 	var pc *pkg.Catalog
 	for _, c := range cataloger.ImageCatalogers() {
 		// in case of future alteration where state is persisted, assume no dependency is safe to reuse
-		theSource, cleanupSource, err := source.New("docker-archive:" + tarPath)
+		theSource, cleanupSource, err := source.New("docker-archive:"+tarPath, nil)
 		b.Cleanup(cleanupSource)
 		if err != nil {
 			b.Fatalf("unable to get source: %+v", err)

test/integration/utils_test.go

@@ -14,7 +14,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (*pkg.Catalog, *
 	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
 	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 
-	theSource, cleanupSource, err := source.New("docker-archive:" + tarPath)
+	theSource, cleanupSource, err := source.New("docker-archive:"+tarPath, nil)
 	t.Cleanup(cleanupSource)
 	if err != nil {
 		t.Fatalf("unable to get source: %+v", err)
@@ -29,7 +29,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (*pkg.Catalog, *
 }
 
 func catalogDirectory(t *testing.T, dir string) (*pkg.Catalog, *distro.Distro, source.Source) {
-	theSource, cleanupSource, err := source.New("dir:" + dir)
+	theSource, cleanupSource, err := source.New("dir:"+dir, nil)
 	t.Cleanup(cleanupSource)
 	if err != nil {
 		t.Fatalf("unable to get source: %+v", err)