spin_oci/lib.rs
1//! OCI registries integration.
2#![deny(missing_docs)]
3
4mod auth;
5pub mod client;
6mod loader;
7pub mod utils;
8
9pub use client::{Client, ComposeMode};
10pub use loader::OciLoader;
11
12/// URL scheme used for the locked app "origin" metadata field for OCI-sourced apps.
13pub const ORIGIN_URL_SCHEME: &str = "vnd.fermyon.origin-oci";
14
15/// Applies heuristics to check if the given string "looks like" it may be
16/// an OCI reference.
17///
18/// This is primarily intended to differentiate OCI references from file paths,
19/// which determines the particular heuristics applied.
20pub fn is_probably_oci_reference(maybe_oci: &str) -> bool {
21 // A relative file path such as foo/spin.toml will successfully
22 // parse as an OCI reference, because the parser infers the Docker
23 // registry and the `latest` version. So if the registry resolves
24 // to Docker, but the source *doesn't* contain the string 'docker',
25 // we can guess this is likely a false positive.
26 //
27 // This could be fooled by, e.g., dockerdemo/spin.toml. But we only
28 // go down this path if the file does not exist, and the chances of
29 // a user choosing a filename containing 'docker' THAT ALSO does not
30 // exist are A MILLION TO ONE...
31
32 // If it doesn't parse as a reference, it isn't a reference
33 let Ok(reference) = oci_distribution::Reference::try_from(maybe_oci) else {
34 return false;
35 };
36 // If it has an explicit tag, its probably a reference
37 if reference.tag() != Some("latest") || maybe_oci.ends_with(":latest") {
38 return true;
39 }
40 // If it doesn't have an explicit registry it's hard to tell whether its a
41 // reference; we'll lean towards "no". The reference parser will set the
42 // registry to the Docker default if none is set, which we try to detect.
43 if reference.registry().contains("docker") && !maybe_oci.contains("docker") {
44 return false;
45 }
46 // Passed all the tests; likely a reference
47 true
48}