
    	<                        S r SSKJr  SSKJr  SSKJr  SSKrSSKrSSKrSSKJ	r	  SSKJ
r
  SSKJ	r  SSKrSSKrSSKrSrS	r\rS
r\\\\/rSrSrSrSrSrSrSrSrSrSrSr Sr!Sr"Sr#\\/r$\/r%\/r&\\/r'\\/r(\\!\"/r) " S S\*5      r+S r, " S S\-5      r. " S S\-5      r/ " S  S!\/5      r0S,S" jr1S#r2S$r3S%r4S&r5S'r6 " S( S)\*5      r7S* r8S+ r9g)-z<This package facilitates HTTP/REST requests to the registry.    )absolute_import)division)print_functionN)docker_creds)docker_namepullz	push,pullcatalogz4application/vnd.docker.distribution.manifest.v1+jsonz9application/vnd.docker.distribution.manifest.v1+prettyjwsz4application/vnd.docker.distribution.manifest.v2+jsonz9application/vnd.docker.distribution.manifest.list.v2+jsonz1application/vnd.docker.image.rootfs.diff.tar.gzipz9application/vnd.docker.image.rootfs.foreign.diff.tar.gzipz.application/vnd.docker.container.image.v1+jsonz*application/vnd.oci.image.manifest.v1+jsonz'application/vnd.oci.image.index.v1+jsonz&application/vnd.oci.image.layer.v1.tarz+application/vnd.oci.image.layer.v1.tar+gzipz7application/vnd.oci.image.layer.nondistributable.v1.tarz<application/vnd.oci.image.layer.nondistributable.v1.tar+gzipz(application/vnd.oci.image.config.v1+jsonc                   T    \ rS rSrSrS rS r\S 5       r\S 5       r	\S 5       r
Srg	)

DiagnosticH   a'  Diagnostic encapsulates a Registry v2 diagnostic message.

This captures one of the "errors" from a v2 Registry error response
message, as outlined here:
  https://github.com/docker/distribution/blob/master/docs/spec/api.md#errors

Args:
  error: the decoded JSON of the "errors" array element.
c                     Xl         g N_error)selferrors     =lib/third_party/containerregistry/client/v2_2/docker_http_.py__init__Diagnostic.__init__S   s    K    c                     U R                   UR                   :H  =(       a9    U R                  UR                  :H  =(       a    U R                  UR                  :H  $ r   )codemessagedetail)r   others     r   __eq__Diagnostic.__eq__V   sA    II# (LLEMM)(KK5<<')r   c                 8    U R                   R                  S5      $ )Nr   r   getr   s    r   r   Diagnostic.code[   s    ;;??6""r   c                 8    U R                   R                  S5      $ )Nr   r   r!   s    r   r   Diagnostic.message_   s    ;;??9%%r   c                 8    U R                   R                  S5      $ )Nr   r   r!   s    r   r   Diagnostic.detailc   s    ;;??8$$r   r   N)__name__
__module____qualname____firstlineno____doc__r   r   propertyr   r   r   __static_attributes__ r   r   r   r   H   sM    )
 # # & & % %r   r   c                      U R                  S5      n  [        R                  " U 5      nUR                  S/ 5       Vs/ s H  n[	        U5      PM     sn$ !    NG= fs  snf !   [	        SU S.5      /s $ = f)z0Extract and return the diagnostics from content.utf8errorsUNKNOWN)r   r   )decodejsonloadsr    r   )contentods      r   _DiagnosticsFromContentr9   h   s    	nnV$G


7A#$552#67#6aJqM#677	 	 8   s'   A *A" AA" AA" "A5c                   \   ^  \ rS rSrSrU 4S jr\S 5       r\S 5       r\S 5       r	Sr
U =r$ )V2DiagnosticExceptionz   z6Exceptions when an unexpected HTTP status is returned.c           	         > Xl         [        U5      U l        SR                  SU-  /U R                   Vs/ s H  o3R                  < SUR
                  < 3PM!     sn-   5      n[        [        U ]#  U5        g s  snf )N
zresponse: %sz: )	_respr9   _diagnosticsjoinr   r   superr;   r   )r   respr6   r8   r   	__class__s        r   r   V2DiagnosticException.__init__}   sr    J/8Dii	$	373D3DE3DaYY	)3DE	FGG 

/8 	Fs   &A9
c                     U R                   $ r   )r@   r!   s    r   diagnostics!V2DiagnosticException.diagnostics   s    r   c                     U R                   $ r   )r?   r!   s    r   responseV2DiagnosticException.response   s    ::r   c                 .    U R                   R                  $ r   )r?   statusr!   s    r   rM   V2DiagnosticException.status   s    ::r   )r@   r?   )r'   r(   r)   r*   r+   r   r,   rG   rJ   rM   r-   __classcell__)rD   s   @r   r;   r;   z   sG    >9      r   r;   c                       \ rS rSrSrSrg)BadStateException   z4Exceptions when we have entered an unexpected state.r.   Nr'   r(   r)   r*   r+   r-   r.   r   r   rQ   rQ      s    <r   rQ   c                       \ rS rSrSrSrg)TokenRefreshException   z#Exception when token refresh fails.r.   NrS   r.   r   r   rU   rU      s    +r   rU   c                 B    U (       d  [        U(       a  U5      eS5      eg )NUnknown)rQ   )	predicater   s     r   _CheckStaterZ      s    	
wG
>>I
>> 
r    BasicBearerzrealm=zservice=c                   V    \ rS rSrSrS rS rS rS r     SS jr	    SS	 jr
S
rg)	Transport   a  HTTP Transport abstraction to handle automatic v2 reauthentication.

In the v2 Registry protocol, all of the API endpoints expect to receive
'Bearer' authentication.  These Bearer tokens are generated by exchanging
'Basic' or 'Anonymous' authentication with an authentication endpoint
designated by the opening ping request.

The Bearer tokens are scoped to a resource (typically repository), and
are generated with a set of capabilities embedded (e.g. push, pull).

The Docker client has a baked in 60-second expiration for Bearer tokens,
and upon expiration, registries can reject any request with a 401.  The
transport should automatically refresh the Bearer token and reissue the
request.

Args:
   name: the structured name of the docker resource being referenced.
   creds: the basic authentication credentials to use for authentication
          challenge exchanges.
   transport: the HTTP transport to use under the hood.
   action: One of docker_http.ACTIONS, for which we plan to use this transport
c                 ~   Xl         X l        X0l        X@l        [        R
                  " 5       U l        [        U[        ;   SU-  5        U R                  5         U R                  [        :X  a  U R                  5         g U R                  [        :X  a  U R                  U l        g [        R                   " 5       U l        g )Nz4Invalid action supplied to docker_http.Transport: %s)_name_basic_creds
_transport_action	threadingLock_lockrZ   ACTIONS_Ping_authentication_BEARER_Refresh_BASIC_credsr   	Anonymous)r   namecreds	transportactions        r   r   Transport.__init__   s     JOL!DJ'!FOQ
 	JJLw&
mmo				'%%dk **,dkr   c                 6   S[         R                  S.nU R                  R                  SR	                  [        U R                  R                  5      U R                  R                  S9SSUS9u  p#[        UR                  [        R                  R                  R                  [        R                  R                  R                  4;   SR	                  UR                  U=(       d    S	5      5        UR                  [        R                  R                  R                  :X  a  [        U l        S
U l        S
U l        gUS   n[        SU;   SU-  5        UR'                  SS5      u  U l        nU R                   R)                  5       U l        [        U R                   [*        [,        4;   SU R                   -  5        U R                  R                  U l        UR'                  S5      nU H  nUR/                  [0        5      (       a(  U[3        [0        5      S R5                  S5      U l        ME  UR/                  [6        5      (       d  Ma  U[3        [6        5      S R5                  S5      U l        M     [        U R$                  S[0        < SU< 35        g)zPing the v2 Registry.

Only called during transport construction, this pings the listed
v2 registry.  The point of this ping is to establish the "realm"
and "service" to use for Basic for Bearer-Token exchanges.
application/json)content-type
user-agentz{scheme}://{registry}/v2/)schemeregistryGETNbodyheadersz5Unexpected response pinging the registry: {}
Body: {}z<empty>nonezwww-authenticate z-Unexpected "www-authenticate" header form: %s   z0Unexpected "www-authenticate" challenge type: %s,"zExpected a "z " in "www-authenticate" header: )r   
USER_AGENTrd   requestformatSchemerb   r{   rZ   rM   sixmoveshttp_clientOKUNAUTHORIZED
_ANONYMOUSrk   _service_realmsplit
capitalizern   rl   
startswith
_REALM_PFXlenstrip_SERVICE_PFX)r   r   rC   r6   	challenge	remaindertokensts           r   rj   Transport._Ping   s#    +!,,G OO++#**$**--.9L9L 	+ 	N , MD II!!$$cii&;&;&H&H
 	
CJJKK-I/0 {{cii++...'ddmdk'(Iy ?)KM )2Q(?%T9
  //::<D$$(99B$$%&
 JJ''DM__S!F	
j	!	!J()//4<<%%#l+,-33C8	   *I7 8r   c                 L    U R                   R                  U R                  5      $ )z;Construct the resource scope to pass to a v2 auth endpoint.)rb   scopere   r!   s    r   _ScopeTransport._Scope  s    ::DLL))r   c                 P   S[         R                  U R                  R                  5       S.nU R	                  5       U R
                  S.nU R                  R                  SR                  U R                  [        R                  R                  R                  R                  U5      S9SSUS9u  p4UR                  [        R                  R                   R"                  :w  a  [%        S	UR                  U4-  5      e UR'                  S
5      n[(        R*                  " U5      nUR-                  S5      =(       d    UR-                  S5      n[/        USLSU-  5        U R0                     [2        R4                  " U5      U l        SSS5        g!    N= f! , (       d  f       g= f)a  Refreshes the Bearer token credentials underlying this transport.

This utilizes the "realm" and "service" established during _Ping to
set up _creds with up-to-date credentials, by passing the
client-provided _basic_creds to the authorization realm.

This is generally called under two circumstances:
  1) When the transport is created (eagerly)
  2) When a request fails on a 401 Unauthorized

Raises:
  TokenRefreshException: Error during token exchange.
rw   )rx   ry   Authorization)r   servicez{realm}?{query})realmqueryr|   Nr}   z'Bad status during token exchange: %d
%sr0   tokenaccess_tokenzMalformed JSON response: %s)r   r   rc   Getr   r   rd   r   r   r   r   r   urllibparse	urlencoderM   r   r   rU   r3   r4   r5   r    rZ   rh   
v2_2_credsr]   ro   )r   r   
parametersrC   r6   wrapper_objectr   s          r   rm   Transport._Refresh  sn    +!,,**..0G ==J OO++  ++))""((22:> 	! 	@ 	 , MD {{cii++...!"L#';;"8#9 : :v&g
 ZZ(Nw'M>+=+=n+MET!#@7#JK	%%e,dk 
 
 
s   >F +FF
F%Nc                 V   U(       d  U(       d  SOSnU R                   [        :H  S4 H  nS[        R                  0nU R                  R                  5       n	U	(       a  XS'   U(       a  U(       a  UOSUS'   Ub  SR                  U5      US	'   US
;   a  U(       d  SUS'   U R                  R                  XXHS9u  pU(       aD  U
R                  [        R                  R                  R                  :X  a  U R                  5         M    O   W
R                  U;  a  [        U
W5      eU
W4$ )a  Wrapper containing much of the boilerplate REST logic for Registry calls.

Args:
  url: the URL to which to talk
  accepted_codes: the list of acceptable http status codes
  method: the HTTP method to use (defaults to GET/PUT depending on
          whether body is provided)
  body: the body to pass into the PUT request (or None for GET)
  content_type: the mime-type of the request (or None for JSON).
          content_type is ignored when body is None.
  accepted_mimes: the list of acceptable mime-types

Raises:
  BadStateException: an unexpected internal state has been encountered.
  V2DiagnosticException: an error has occurred interacting with v2.

Returns:
  The response of the HTTP request, and its contents.
r|   PUTFry   r   rw   rx   r   Accept)POSTr   0zcontent-lengthr}   )rk   rl   r   r   ro   r   rA   rd   r   rM   r   r   r   r   rm   r;   )r   urlaccepted_codesmethodr~   content_typeaccepted_mimesretry_unauthorizedr   authrC   r6   s               r   RequestTransport.RequestK  s   6  uef  $33w>F ..g [[__d	#' 	(L.@ 	 
	#HH^4 
?	"4$' !oo--
D . 3md 
++..;;
;; G> {{.(!$00=r   c              #   |   #    UnU(       a/  U R                  XbX4U5      u  pxXx4v   [        U5      nU(       a  M.  gg7f)a  Wrapper around Request that follows Link headers if they exist.

Args:
  url: the URL to which to talk
  accepted_codes: the list of acceptable http status codes
  method: the HTTP method to use (defaults to GET/PUT depending on
          whether body is provided)
  body: the body to pass into the PUT request (or None for GET)
  content_type: the mime-type of the request (or None for JSON)

Yields:
  The return value of calling Request for each page of results.
N)r   ParseNextLinkHeader)	r   r   r   r   r~   r   	next_pagerC   r6   s	            r   PaginatedRequestTransport.PaginatedRequest  s?     ( I
ll9f#/1mdM%d+i )s   6<<)	re   rk   rc   ro   rh   rb   r   r   rd   )NNNNN)NNNN)r'   r(   r)   r*   r+   r   rj   r   rm   r   r   r-   r.   r   r   r_   r_      sH    .-,=8~*0-j  $!#CN )- $"&*,r   r_   c                     U R                  S5      nU(       d  g[        R                  " SU5      nU(       d  gUR                  S5      $ )zEReturns "next" link from RFC 5988 Link header or None if not present.linkNz.*<(.+)>;\s*rel="next".*r   )r    rematchgroup)rC   r   ms      r   r   r     s;    	&	$	hh*D1!	
	
r   c                 l    U R                  S5      (       a  g[        R                  " SU 5      (       a  gg)z<Returns https scheme for all the endpoints except localhost.z
localhost:httpz .*\.local(?:host)?(?::\d{1,5})?$https)r   r   r   )endpoints    r   r   r     s.    &&	xx3X>>r   r   ):r+   
__future__r   r   r   r4   r   rf   containerregistry.clientr   r   containerregistry.client.v2_2r   httplib2six.moves.http_clientr   six.moves.urllib.parsePULLPUSHDELETECATALOGri   MANIFEST_SCHEMA1_MIMEMANIFEST_SCHEMA1_SIGNED_MIMEMANIFEST_SCHEMA2_MIMEMANIFEST_LIST_MIME
LAYER_MIMEFOREIGN_LAYER_MIMECONFIG_JSON_MIMEOCI_MANIFEST_MIMEOCI_IMAGE_INDEX_MIMEOCI_LAYER_MIMEOCI_GZIP_LAYER_MIMEOCI_NONDISTRIBUTABLE_LAYER_MIME$OCI_NONDISTRIBUTABLE_GZIP_LAYER_MIMEOCI_CONFIG_JSON_MIMEMANIFEST_SCHEMA1_MIMESMANIFEST_SCHEMA2_MIMESOCI_MANIFEST_MIMESSUPPORTED_MANIFEST_MIMESMANIFEST_LIST_MIMESNON_DISTRIBUTABLE_LAYER_MIMESobjectr   r9   	Exceptionr;   rQ   rU   rZ   r   rn   rl   r   r   r_   r   r   r.   r   r   <module>r      sb   C &  %  	  1 0 D    	
vw
'N Z N P @
P C @ @ 9C "[ 'e $A /1MN /0 '(  ./DE  ,-?@  7(! % %@$I 0=	 =,- ,?
 
	

D, D,N
r   