
    $                        S r SSKJr  SSKJr  SSKJr  SSKrSSKrSSKrSSKrSSK	r	SSK
Jr  SSK
Jr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKrSrSrSr " S S\R0                  5      rS rS rS rS rS rSS jrS r S r!g)zUtility library for configuring access to the Google Container Registry.

Sets docker up to authenticate with the Google Container Registry using the
active gcloud credential.
    )absolute_import)division)unicode_literalsN)
exceptions)log)store)
client_lib)	constants)filesgclouddockertokenz
not@val.id
credsStorec                   $    \ rS rSrSrS rS rSrg)UnsupportedRegistryError-   z4Indicates an attempt to use an unsupported registry.c                     Xl         g )N	image_url)selfr   s     (lib/googlecloudsdk/core/docker/docker.py__init__!UnsupportedRegistryError.__init__0   s    N    c                 V    SR                  U R                  [        R                  5      $ )NzA{0} is not in a supported registry.  Supported registries are {1})formatr   r
   ALL_SUPPORTED_REGISTRIES)r   s    r   __str__ UnsupportedRegistryError.__str__3   s#    &)K)KLNr   r   N)__name__
__module____qualname____firstlineno____doc__r   r   __static_attributes__ r   r   r   r   -   s    <Nr   r   c                 x   [         R                  " U 5      nUR                  5       n S/nUR                  SU-   5        UR                  SU-   5        UR                  U 5        [         R                  " U[
        R                  [        R                  [        R                  S9nUR                  5       u  pgUR                  S:X  a  [        Xg5        g[        R                  " S5        [        R                  R                  U5        [        R                   R                  U5        [         R"                  " S5      e)	GRegister the username / token for the given server on Docker's keyring.loginz--username=z--password=)
stdin_filestdout_filestderr_filer   zDocker CLI operation failed:zDocker login failed.N)r	   GetNormalizedURLgeturlappendGetDockerProcesssysstdin
subprocessPIPEcommunicate
returncode_SurfaceUnexpectedInfor   erroroutPrintstatusDockerError)serverusernameaccess_token
parsed_urldocker_argsdocker_p
stdoutdata
stderrdatas           r   DockerLoginrC   8   s     **62*& 	+]X-.]\12V((////	#( $//1*A:2 II,-GGMM*JJZ 

 
 !7
88r   c                    U R                  5        Vs/ s H  o"R                  5       PM     nnUR                  5        Vs/ s H  o"R                  5       PM     nnU HH  nUS:w  d  M  SU;  d  M  U< [        R                  < 3n[        R
                  R                  U5        MJ     U HJ  n[        U5      (       a  M  U< [        R                  < 3n[        R                  R                  U5        ML     gs  snf s  snf )a  Reads docker's output and surfaces unexpected lines.

Docker's CLI has a certain amount of chattiness, even on successes.

Args:
  stdoutdata: The raw data output from the pipe given to Popen as stdout.
  stderrdata: The raw data output from the pipe given to Popen as stderr.
zLogin Succeededlogin credentials saved inN)	
splitlinesstriposlinesepr   r7   r8   _IsExpectedErrorLiner9   )rA   rB   sstdoutstderrlines         r   r5   r5   [   s      *44676!GGI6&7)44676!GGI6&7d!!$D0RZZ(d	ggmmD  d%%RZZ(d	jjt  87s   C: C?c                       [         R                  " 5       u  p[         R                  " U 5      nU(       a	  [        U;   $ g! [         a     gf = f)zReturns True if a credential store is specified in the docker config.

Returns:
  True if a credential store is specified in the docker config.
  False if the config file does not exist or does not contain a
  'credsStore' key.
F)r	   GetDockerConfigPathReadConfigurationFile_CREDENTIAL_STORE_KEYIOError)pathis_new_formatcontentss      r   _CredentialStoreConfiguredrW   v   sO     %88:D//5H"h.. 	 s   <A   
AAc                      [         R                  " 5       u  p[         R                  " U 5      nU(       a  SU;   a  US   $ 0 $ U$ )zRetrieve the contents of the Docker authorization entry.

NOTE: This is public only to facilitate testing.

Returns:
  The map of authorizations used by docker.
auths)r	   rP   rQ   )rT   
new_format	structures      r   ReadDockerAuthConfigr\      sE      335$..t4)!(I!59W=2=r   c                     [         R                  " 5       u  p[         R                  " U5      nU(       a  UnXS'   [        R                  " USS9nO[        R                  " U SS9n[
        R                  " X5        g)zWrite out a complete set of Docker authorization entries.

This is public only to facilitate testing.

Args:
  structure: The dict of authorization mappings to write to the
             Docker configuration file.
rY      )indentN)r	   rP   rQ   jsondumpsr   WriteFileAtomically)r[   rT   rU   rV   full_cfgfile_contentss         r   WriteDockerAuthConfigre      sc     #668$--d3(H!WJJx2MJJy3MD0r   c                    U(       a  [         R                  " 5       nO[         R                  " 5       nU(       d  [        R                  " S5      e[        5       (       a   [        U [        U5        g[        U [        U5        g! [        R                   aZ  n[        R                  " U5      [        R                  :w  a  e [        U [        U5        [        R                  " S5         SnAgSnAff = f)a  Updates the docker config to have fresh credentials.

This reads the current contents of Docker's keyring, and extends it with
a fresh entry for the provided 'server', based on the active gcloud
credential.  If a credential exists for 'server' this replaces it.

Args:
  server: The hostname of the registry for which we're freshening
     the credential.
  refresh: Whether to force a token refresh on the active credential.

Raises:
  core.credentials.exceptions.Error: There was an error loading the
    credentials.
z?No access token could be obtained from the current credentials.z'docker' was not discovered on the path. Credentials have been stored, but are not guaranteed to work with the Docker client  if an external credential store is configured.N)r   GetFreshAccessTokenGetAccessTokenr   ErrorrW   rC   	_USERNAMEr	   r:   six	text_typeDOCKER_NOT_FOUND_ERROR_UpdateDockerConfigr   warning)r;   refreshr=   es       r   UpdateDockerCredentialsrr      s    " ,,.L'')L	


IK K  !!= &)\2 	<8 !! =	q	Z>>	> &)\:	kk<= ==s    B C2AC--C2c                 t    [        5       nUS-   U-   n[        R
                  " UR                  S5      5      R                  S5      n[        R                  " U 5      nUR                  5       n UR                  nXc;   a  X6	 U[        S.X0'   [        U5        g! [        [        R                  4 a    0 n Nf = f)r&   :ascii)authemailN)r\   rS   r	   InvalidDockerConfigErrorbase64	b64encodeencodedecoder+   r,   hostname_EMAILre   )r;   r<   r=   dockercfg_contentsrv   r>   server_unqualifieds          r   rn   rn      s    
-/ 
C,	&$			$++g.	/	6	6w	?$ **62*&!** -.(,v>*+) :66	7 s   
B B76B7c                 ,    / SQnU H
  nX ;   d  M
    g   g)zReturns whether or not the given line was expected from the Docker client.

Args:
  line: The line received in stderr from Docker
Returns:
  True if the line was expected, False otherwise.
)z--emailrE   zHWARNING! Using --password via the CLI is insecure. Use --password-stdin.TFr$   )rN   expected_line_substrsexpected_line_substrs      r   rJ   rJ     s%     4# 4 
r   )T)"r"   
__future__r   r   r   ry   r`   rH   r1   r/   googlecloudsdk.corer   r   googlecloudsdk.core.credentialsr   googlecloudsdk.core.dockerr	   r
   googlecloudsdk.core.utilr   rk   rj   r~   rR   r:   r   rC   r5   rW   r\   re   rr   rn   rJ   r$   r   r   <module>r      s    '  '   	  
 * # 1 1 0 * 
  		$ Nz55 N 9F60$1,,9^,<r   