OCI — imagem e runtime#

fn apply_layer(blob: &Path, media_type: &str, rootfs: &Path) -> Result<()> {
    let file = fs::File::open(blob).ctx(|| format!("opening {}", blob.display()))?;
    let reader: Box<dyn Read> = match media_type {
        "application/vnd.oci.image.layer.v1.tar+gzip" => Box::new(flate2::read::GzDecoder::new(file)),
        "application/vnd.oci.image.layer.v1.tar" => Box::new(file),
        other => return Err(Error::Unsupported(format!("layer media type {other}"))),
    };
    let mut archive = tar::Archive::new(reader);
    archive.set_preserve_ownerships(false); // sem root não há chown; e não devia haver.
    archive.set_overwrite(true);

    for entry in archive.entries().ctx(|| format!("reading {}", blob.display()))? {
        let mut entry = entry.ctx(|| "reading tar entry".to_string())?;
        let path = entry.path().ctx(|| "tar entry path".to_string())?.into_owned();
        let kind = entry.header().entry_type();

        // Whiteouts: `.wh.<nome>` apaga o que as layers de baixo puseram; `.wh..wh..opq` esvazia o dir.
        if let Some(name) = path.file_name().and_then(|n| n.to_str())
            && let Some(target) = name.strip_prefix(".wh.")
        {
            let parent =
                crate::fsutil::resolve_in_root(rootfs, path.parent().unwrap_or_else(|| Path::new("")), false);
            if let Ok(parent) = parent {
                if target == ".wh..opq" {
                    empty_dir(&parent)?;
                } else {
                    remove_any(&parent.join(target))?;
                }
            }
            continue;
        }
        // Sem root não se criam device nodes — e um device dentro de uma imagem é suspeito.
        if kind.is_block_special() || kind.is_character_special() {
            eprintln!("warning: skipping device node {}", path.display());
            continue;
        }
        // `unpack_in` recusa `..` e symlinks que escapem do destino.
        if !entry.unpack_in(rootfs).ctx(|| format!("unpacking {}", path.display()))? {
            return Err(Error::UnsafePath(path));
        }
    }
    make_dirs_writable(rootfs)
}

/// Devolve o caminho do blob **já verificado**.
fn verified_blob(layout: &Path, digest: &str) -> Result<PathBuf> {
    let (path, expected) = blob_path(layout, digest)?;
    let actual = sha256_file(&path)?;
    if actual != expected {
        return Err(Error::Digest { what: digest.into(), expected, actual });
    }
    Ok(path)
}

/// `sha256:<64 hex>` → caminho do blob. A validação do formato NÃO é cosmética:
/// um `digest` como `sha256:../../etc/passwd` sairia do layout.
fn blob_path(layout: &Path, digest: &str) -> Result<(PathBuf, String)> {
    let hex = digest
        .strip_prefix("sha256:")
        .filter(|h| h.len() == 64 && h.bytes().all(|b| b.is_ascii_hexdigit()))
        .ok_or_else(|| Error::Spec(format!("unsupported digest {digest:?}")))?;
    Ok((layout.join("blobs/sha256").join(hex), hex.to_ascii_lowercase()))
}

/// When `reference` names a content digest (`sha256:...`), verifies the fetched
/// manifest bytes hash to EXACTLY that digest. A digest-pinned pull
/// (`repo@sha256:...`) is the whole point of pinning: even a compromised or
/// MITM'd registry must not be able to substitute the content. The blobs are
/// already checked against the digests the manifest declares — but if the
/// manifest ITSELF is not checked against the pinned reference, the registry
/// can serve a completely different, internally-consistent manifest (pointing
/// at the attacker's blobs) and the pin becomes decorative. The chain of trust
/// for a digest pull rests entirely on this check. A tag reference (`:latest`)
/// has no digest to verify, so it is a no-op there — TLS is the only integrity
/// for tags, same as `docker pull`.
fn verify_manifest_digest(reference: &str, manifest_bytes: &[u8]) -> Result<()> {
    if let Some(want) = reference.strip_prefix("sha256:") {
        let got = sha256_hex(manifest_bytes);
        if !got.eq_ignore_ascii_case(want) {
            return Err(Error::DigestMismatch(format!(
                "manifest digest mismatch: reference pins sha256:{want} but the registry \
                 served a manifest hashing to sha256:{got} — refusing (possible compromised \
                 registry or MITM)"
            )));
        }
    }
    Ok(())
}