Merge 6c3316089f into 83be5fb151

This can be done with the newly added `--runtime` flag, which needs to
be passed to the first group, e.g:

```bash
dangerzone-cli --runtime docker COMMAND
```

.github/workflows/scan_released.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Download container image for the latest release and load it
         run: |
           VERSION=$(curl https://api.github.com/repos/freedomofpress/dangerzone/releases/latest | grep "tag_name" | cut -d '"' -f 4)
-          CONTAINER_FILENAME=container-${VERSION:1}-${{ matrix.arch }}.tar.gz
+          CONTAINER_FILENAME=container-${VERSION:1}-${{ matrix.arch }}.tar
           wget https://github.com/freedomofpress/dangerzone/releases/download/${VERSION}/${CONTAINER_FILENAME} -O ${CONTAINER_FILENAME}
           docker load -i ${CONTAINER_FILENAME}
       - name: Get image tag

dangerzone/container_utils.py

@@ -11,9 +11,7 @@ from .settings import Settings
 from .util import get_resource_path, get_subprocess_startupinfo
 
 OLD_CONTAINER_NAME = "dangerzone.rocks/dangerzone"
-CONTAINER_NAME = (
+CONTAINER_NAME = "ghcr.io/almet/dangerzone/dangerzone"  # FIXME: Change this to the correct container name
-    "ghcr.io/almet/dangerzone/dangerzone"
-)  # FIXME: Change this to the correct container name
 
 log = logging.getLogger(__name__)
 
@@ -230,7 +228,9 @@ def get_image_id_by_digest(digest: str) -> str:
     return process.stdout.decode().strip().split("\n")[0]
 
 
-def container_pull(image: str, manifest_digest: str, callback: Callable):
+def container_pull(
+    image: str, manifest_digest: str, callback: Optional[Callable] = None
+):
     """Pull a container image from a registry."""
     runtime = Runtime()
     cmd = [str(runtime.path), "pull", f"{image}@sha256:{manifest_digest}"]
@@ -242,6 +242,7 @@ def container_pull(image: str, manifest_digest: str, callback: Callable):
         bufsize=1,
     )
 
+    if callback:
         for line in process.stdout:  # type: ignore
             callback(line)
 

dangerzone/updater/__init__.py

@@ -1,10 +1,3 @@
 import logging
 
 log = logging.getLogger(__name__)
-
-from .signatures import (
-    DEFAULT_PUBKEY_LOCATION,
-    is_update_available,
-    upgrade_container_image,
-    verify_local_image,
-)

dangerzone/updater/signatures.py

@@ -485,7 +485,7 @@ def prepare_airgapped_archive(image_name: str, destination: str) -> None:
 
 
 def upgrade_container_image(
-    image: str, manifest_digest: str, pubkey: str, callback: Callable
+    image: str, manifest_digest: str, pubkey: str, callback: Optional[Callable] = None
 ) -> str:
     """Verify and upgrade the image to the latest, if signed."""
     update_available, remote_digest = registry.is_new_remote_image_available(image)

dangerzone/util.py

@@ -8,7 +8,7 @@ from pathlib import Path
 try:
     import platformdirs
 except ImportError:
-    import appdirs as platformdirs  # type: ignore[no-redef]
+    import appdirs as platformdirs
 
 
 def get_config_dir() -> Path:

tests/test_signatures.py

@@ -265,68 +265,6 @@ def test_stores_signatures_updates_last_log_index(valid_signature, mocker, tmp_p
         return_value=100,
     )
 
-    # Call store_signatures
-    with pytest.raises(errors.SignatureMismatch):
-        store_signatures(signatures, image_digest, TEST_PUBKEY_PATH)
-        ("dangerzone.updater.signatures.get_last_log_index",)
-    # Verify that the signatures file was not created
-    assert not (signatures_path / f"{image_digest}.json").exists()
-
-    # Verify that the log index file was not updated
-    assert not (signatures_path / "last_log_index").exists()
-
-
-def test_stores_signatures_updates_last_log_index(valid_signature, mocker, tmp_path):
-    """Test that store_signatures updates the last log index file."""
-    signatures = [valid_signature]
-    # Extract the digest from the signature
-    image_digest = Signature(valid_signature).manifest_digest
-    signatures = [valid_signature, signature_other_digest]
-    breakpoint()
-    valid_signature, signature_other_digest, mocker, tmp_path
-
-    """Test that store_signatures raises an error when a signature's digest doesn't match."""
-
-    image_digest = "sha256:123456"
-
-    # Mock the signatures path
-    signatures_path = tmp_path / "signatures"
-    signatures_path.mkdir()
-    mocker.patch("dangerzone.updater.signatures.SIGNATURES_PATH", signatures_path)
-
-    # Mock get_log_index_from_signatures
-    mocker.patch(
-        "dangerzone.updater.signatures.get_log_index_from_signatures",
-        return_value=100,
-    )
-
-    # Mock get_last_log_index
-    mocker.patch(
-        "dangerzone.updater.signatures.get_last_log_index",
-        return_value=50,
-    )
-
-
-def test_stores_signatures_updates_last_log_index():
-    pass
-
-
-def test_get_file_digest():
-    # Mock the signatures path
-    signatures_path = tmp_path / "signatures"
-    signatures_path.mkdir()
-    mocker.patch("dangerzone.updater.signatures.SIGNATURES_PATH", signatures_path)
-
-    # Create an existing last_log_index file with a lower value
-    with open(signatures_path / "last_log_index", "w") as f:
-        f.write("50")
-
-    # Mock get_log_index_from_signatures to return a higher value
-    mocker.patch(
-        "dangerzone.updater.signatures.get_log_index_from_signatures",
-        return_value=100,
-    )
-
     # Call store_signatures
     store_signatures(signatures, image_digest, TEST_PUBKEY_PATH)