[Request]: Allow repository length to be greater than 127 symbols

[valmanassiev]

Feature or enhancement request details

There is validation on the length of the repository which limits you to 127 symbols wether you try to run or build with a container image.

For example:
xxxxxxx-xxxxxxxxx-xxxxxxxx.xxx.xxxxxxxx.xxx/xxxxxx-xxxxxx/xxxxxx-xxx.xx-xxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxx/xxxxxxx/xxxxx/xxxxxx/xxxxxxx-xxxxx/xxxxxx:vv-vvvvv
Triggers: Error: invalidArgument: "Repo length 170 greater than 127"
Where 170 in this case is the length of the repository without the tag

This validation is consistent from from 0.1.0 until current 0.7.1

Code of Conduct

• I agree to follow this project's Code of Conduct

[jglogan]

Imageref validation is done in containerization, not in container, transferring this issue.

[jglogan]

@valmanassiev Good catch. It looks like image reference validation isn't being done quite right.

What I see is that we're enforcing a 127 character limit on the image name, consisting of the registry and repository name together.

I believe we should be enforcing a 255 character total name limit on the image reference, a 127 character limit on the tag, and appropriate domain name component length limits (63 characters each IIRC) on the registry name.

I'd like for the developer who did the image store to weigh in on this however, just to make sure there weren't other considerations, before making any changes. Assuming there are no other issues we can look at merging a fix after the holiday.

[jglogan]

In a previous iteration of imageref validation code that I wrote, I used something along the lines of this:

    // Maximum length for the host and repository.
    public static let maxHostAndRepositoryLength = 255
    public static let maxTagLength = 128
    public static let minPort: UInt16 = 1
    public static let maxPort: UInt16 = 65535
    public static let defaultRegistry = "docker.com/library"
    public static let defaultTag = "latest"
    public static let hostAndPortRegex = #/(?<host>[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)(?::(?<port>\d+))?/#
    public static let repositoryAndTagRegex = #/(?<repository>[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*)*)(?::(?<tag>[a-zA-Z0-9_][a-zA-Z0-9._-]*))?(?:@(?<digest>sha256:[0-9a-f]{64}))?/#
    public static let digestRegex = #/sha256:[0-9a-f]{64}/#

    public init(_ name: String, digest: String? = nil) throws {
        self.originalRef = name

        // Validate the digest, if provided.
        if let digest {
            if (try? Self.digestRegex.wholeMatch(in: digest)) == nil {
                throw Error.digestInvalid
            }
        }

        let repositoryAndTag: String
        (_host, _port, repositoryAndTag) = try Self.parseHost(originalRef)
        (_repository, _tag, _digest) = try Self.parseRepository(repositoryAndTag, argDigest: digest)

        // Ensure lengths are not exceeded.
        let host = _host ?? Self.defaultRegistry
        if host.count + 1 + _repository.count > Self.maxHostAndRepositoryLength {
            throw Error.hostAndRepositoryTooLong("\(host)/\(_repository)")
        }

        let tagLength = _tag?.count ?? 0
        if tagLength > Self.maxTagLength {
            throw Error.tagTooLong
        }
    }

    //  swiftlint:disable large_tuple
    private static func parseHost(_ ref: String) throws -> (String?, UInt16?, String) {
        let host: String?
        let port: UInt16?
        let repositoryAndTag: String

        // break into a tentative host and repository on the initial slash if present
        let hostComponents = ref.split(separator: "/", maxSplits: 1, omittingEmptySubsequences: false)

        if hostComponents.count == 1 {
            // no host, only a repository
            if hostComponents[0] == "" {
                // and the repository is empty, fail
                throw Error.empty
            }
            host = nil
            port = nil
            repositoryAndTag = String(hostComponents[0])
        } else {
            // maybe a host and repository, or maybe just a repository?
            // https://stackoverflow.com/questions/37861791/how-are-docker-image-names-parsed
            let hostAndPort = String(hostComponents[0])
            if let hostAndPortMatch = try? Self.hostAndPortRegex.wholeMatch(in: hostAndPort) {
                // regex matches a valid hostname, apply heuristic - contains "." or ":", or is "localhost"
                // https://github.com/moby/moby/blob/master/registry/search.go, func splitReposSearchTerm
                let tentativeHost = String(hostAndPortMatch.host)
                if tentativeHost.contains(#/[:.]/#) || tentativeHost == "localhost" {
                    // heuristic passed, so it's an honest to goodness host, validate port
                    host = tentativeHost
                    repositoryAndTag = String(hostComponents[1])
                    if let portText = hostAndPortMatch.port {
                        guard let portNumber = UInt16(portText) else {
                            throw Error.portInvalid
                        }
                        guard portNumber != 0 else {
                            throw Error.portInvalid
                        }
                        port = portNumber
                    } else {
                        port = nil
                    }
                } else {
                    // heuristic failed, so treat the whole thing as repository+tag
                    host = nil
                    port = nil
                    repositoryAndTag = ref
                }
            } else {
                // regex failed, so treate the whole thing as repository+tag
                host = nil
                port = nil
                repositoryAndTag = ref
            }
        }

        return (host, port, repositoryAndTag)
    }

    private static func parseRepository(_ repositoryAndTag: String, argDigest: String?) throws -> (String, String?, String?) {
        let repository: String
        let tag: String?
        let digest: String?

        // Validate the repository and tag.
        if repositoryAndTag.lowercased() != repositoryAndTag {
            throw Self.Error.notLowercased
        }

        guard let repositoryAndTagMatch = try? Self.repositoryAndTagRegex.wholeMatch(in: repositoryAndTag) else {
            throw Error.repositoryInvalid(repositoryAndTag)
        }

        repository = String(repositoryAndTagMatch.repository)

        if let digestSubstring = repositoryAndTagMatch.digest {
            let refDigest = String(digestSubstring)
            if let argDigest {
                if argDigest != refDigest {
                    throw Error.digestMismatch(refDigest: refDigest, argDigest: argDigest)
                }
            }
            digest = refDigest
            tag = nil
        } else {
            digest = argDigest
            if let tagSubstring = repositoryAndTagMatch.tag {
                tag = String(tagSubstring)
            } else {
                tag = Self.defaultTag
            }
        }

        return (repository, tag, digest)
    }