Add image verifier transfer service plugin system based on a binary directory

Signed-off-by: Ethan Lowman <ethan.lowman@datadoghq.com>

pkg/imageverifier/bindir/testdata/verifier_templates/verifier_test_input_output_management.go.tmpl

@@ -0,0 +1,45 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+func main() {
+	err := os.WriteFile(`{{.ArgsFile}}`, []byte(strings.Join(os.Args[1:], " ")), 0644)
+	if err != nil {
+		panic(err)
+	}
+
+	stdin, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		panic(err)
+	}
+	err = os.WriteFile(`{{.StdinFile}}`, stdin, 0644)
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println("Reason A line 1")
+	fmt.Fprintln(os.Stderr, "Debug A line 1")
+	fmt.Println("Reason A line 2")
+	fmt.Fprintln(os.Stderr, "Debug A line 2")
+}

pkg/imageverifier/bindir/testdata/verifiers/accept_reason_a.go

@@ -0,0 +1,23 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("Reason A")
+}

pkg/imageverifier/bindir/testdata/verifiers/accept_reason_b.go

@@ -0,0 +1,23 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("Reason B")
+}

pkg/imageverifier/bindir/testdata/verifiers/accept_reason_c.go

@@ -0,0 +1,23 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("Reason C")
+}

pkg/imageverifier/bindir/testdata/verifiers/large_stderr.go

@@ -0,0 +1,35 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+func main() {
+	n := 50000
+	fmt.Fprintf(os.Stderr, "attempting to write %v bytes to stderr\n", n)
+
+	wrote, err := fmt.Fprintf(os.Stderr, strings.Repeat("A", n))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "got error writing to stderr: %v\n", err)
+	}
+
+	fmt.Fprintf(os.Stderr, "wrote %v bytes to stderr\n", wrote)
+}

pkg/imageverifier/bindir/testdata/verifiers/large_stderr_chunked.go

@@ -0,0 +1,45 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	n := 500000
+	fmt.Fprintf(os.Stderr, "attempting to write %v bytes to stderr\n", n)
+
+	// Writing this all in one fmt.Fprintf has a different interaction with
+	// stderr pipe buffering than writing one byte at a time.
+	wrote := 0
+	for i := 0; i < n; i++ {
+		w, err := fmt.Fprintf(os.Stderr, "A")
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "got error writing to stderr: %v\n", err)
+		}
+
+		wrote += w
+
+		if i%10000 == 0 {
+			fmt.Fprintf(os.Stderr, "progress: wrote %v bytes to stderr\n", wrote)
+		}
+	}
+
+	fmt.Fprintf(os.Stderr, "wrote %v bytes to stderr\n", wrote)
+}

pkg/imageverifier/bindir/testdata/verifiers/large_stdout.go

@@ -0,0 +1,35 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+func main() {
+	n := 50000
+	fmt.Fprintf(os.Stderr, "attempting to write %v bytes to stdout\n", n)
+
+	wrote, err := fmt.Print(strings.Repeat("A", n))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "got error writing to stdout: %v\n", err)
+	}
+
+	fmt.Fprintf(os.Stderr, "wrote %v bytes to stdout\n", wrote)
+}

pkg/imageverifier/bindir/testdata/verifiers/large_stdout_chunked.go

@@ -0,0 +1,45 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	n := 500000
+	fmt.Fprintf(os.Stderr, "attempting to write %v bytes to stdout\n", n)
+
+	// Writing this all in one fmt.Print has a different interaction with stdout
+	// pipe buffering than writing one byte at a time.
+	wrote := 0
+	for i := 0; i < n; i++ {
+		w, err := fmt.Print("A")
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "got error writing to stdout: %v\n", err)
+		}
+
+		wrote += w
+
+		if i%10000 == 0 {
+			fmt.Fprintf(os.Stderr, "progress: wrote %v bytes to stdout\n", wrote)
+		}
+	}
+
+	fmt.Fprintf(os.Stderr, "wrote %v bytes to stdout\n", wrote)
+}

pkg/imageverifier/bindir/testdata/verifiers/reject_reason_d.go

@@ -0,0 +1,27 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	fmt.Println("Reason D")
+	os.Exit(1)
+}

pkg/imageverifier/bindir/testdata/verifiers/slow_child_process.go

@@ -0,0 +1,40 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+)
+
+func main() {
+	// Launch a slow child process by re-executing this binary with the -sleep-forever flag.
+	if len(os.Args) == 2 && os.Args[1] == "-sleep-forever" {
+		fmt.Println("sleeping forever...")
+		for {
+		}
+	}
+
+	thisBin := os.Args[0]
+	cmd := exec.Command(thisBin, "-sleep-forever")
+	b, err := cmd.CombinedOutput()
+	fmt.Println(string(b))
+	if err != nil {
+		panic(err)
+	}
+}