Remove debug statements and add docs

Signed-off-by: Brandon Lum <lumjjb@gmail.com>

commit.go

@@ -466,23 +466,7 @@ func Push(ctx context.Context, image string, dest types.ImageReference, options
 		systemContext.DirForceCompress = true
 	}
 	var manifestBytes []byte
-	/*
-			cc, err := encconfig.EncryptWithJwe([][]byte{[]byte(`-----BEGIN PUBLIC KEY-----
-		MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwYTsImU3nbWSA3ktMfc3IiJ9Z
-		sUkPYe8h3ul54uAptbAf4lYDf50jhsUqQyFdFSd25Uoj/s5qwG3+aQwWbt3b5LX0
-		8IM6c/XNrUcQ028fBVM0oQMYQla1d57lJI3bGqj1CHCPzND1SOHThBHqk/O+Qkv5
-		fJ/vnRQZl+yCNhLxLwIDAQAB
-		-----END PUBLIC KEY-----`)})
-			if err != nil {
-				return nil, "", err
-			}
-	*/
-	logrus.Debugf("Calling from Push")
-	copyOptions := getCopyOptions(options.Store, options.ReportWriter, nil, systemContext, options.ManifestType, options.RemoveSignatures, options.SignBy, options.OciEncryptLayers, options.OciEncryptConfig, nil)
-	//copyOptions.OciEncryptConfig = cc.EncryptConfig
-	//copyOptions.OciEncryptLayers = &[]int{}
-
-	if manifestBytes, err = retryCopyImage(ctx, policyContext, dest, maybeCachedSrc, dest, "push", copyOptions, options.MaxRetries, options.RetryDelay); err != nil {
+	if manifestBytes, err = retryCopyImage(ctx, policyContext, dest, maybeCachedSrc, dest, "push", getCopyOptions(options.Store, options.ReportWriter, nil, systemContext, options.ManifestType, options.RemoveSignatures, options.SignBy, options.OciEncryptLayers, options.OciEncryptConfig, nil), options.MaxRetries, options.RetryDelay); err != nil {
 		return nil, "", errors.Wrapf(err, "error copying layers and metadata from %q to %q", transports.ImageName(maybeCachedSrc), transports.ImageName(dest))
 	}
 	if options.ReportWriter != nil {

docs/buildah-bud.md

@@ -178,6 +178,10 @@ The [username[:password]] to use to authenticate with the registry if required.
 If one or both values are not supplied, a command line prompt will appear and the
 value can be entered.  The password is entered without echo.
 
+**--decryption-key** *key*
+
+A reference required to perform decryption of container images. This should point to files which represent keys and/or certificates that can be used for decryption. Decryption will be tried with all keys. This feature is still *experimental*.
+
 **--device**=*device*
 
 Add a host device or devices under a directory to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)

docs/buildah-pull.md

@@ -62,6 +62,10 @@ The [username[:password]] to use to authenticate with the registry if required.
 If one or both values are not supplied, a command line prompt will appear and the
 value can be entered.  The password is entered without echo.
 
+**--decryption-key** *key*
+
+A reference required to perform decryption of container images. This should point to files which represent keys and/or certificates that can be used for decryption. Decryption will be tried with all keys. This feature is still *experimental*.
+
 **--quiet, -q**
 
 If an image needs to be pulled from the registry, suppress progress output.

docs/buildah-push.md

@@ -66,6 +66,10 @@ After copying the image, write the digest of the resulting image to the file.
 
 Don't compress copies of filesystem layers which will be pushed.
 
+**--encryption-key** *key*
+
+A reference prefixed with the encryption protocol to use. The supported protocols are JWE, PGP and PKCS7. For instance, jwe:/path/to/key.pem or pgp:admin@example.com or pkcs7:/path/to/x509-file. This feature is still *experimental*.
+
 **--format, -f**
 
 Manifest Type (oci, v2s1, or v2s2) to use when saving image to directory using the 'dir:' transport (default is manifest type of source)

imagebuildah/stage_executor.go

@@ -582,7 +582,6 @@ func (s *StageExecutor) UnrecognizedInstruction(step *imagebuilder.Step) error {
 // isn't specified, the first argument passed to the first FROM instruction we
 // can find in the stage's parsed tree.
 func (s *StageExecutor) prepare(ctx context.Context, from string, initializeIBConfig, rebase bool) (builder *buildah.Builder, err error) {
-	logrus.Debugf("stage_executor:prepare, %v", s.executor.ociDecryptConfig)
 	stage := s.stage
 	ib := stage.Builder
 	node := stage.Node

new.go

@@ -29,7 +29,6 @@ const (
 )
 
 func pullAndFindImage(ctx context.Context, store storage.Store, srcRef types.ImageReference, options BuilderOptions, sc *types.SystemContext) (*storage.Image, types.ImageReference, error) {
-	logrus.Debugf("pullAndFindImage")
 	pullOptions := PullOptions{
 		ReportWriter:     options.ReportWriter,
 		Store:            store,
@@ -105,7 +104,6 @@ func newContainerIDMappingOptions(idmapOptions *IDMappingOptions) storage.IDMapp
 }
 
 func resolveImage(ctx context.Context, systemContext *types.SystemContext, store storage.Store, options BuilderOptions) (types.ImageReference, string, *storage.Image, error) {
-	logrus.Debugf("resolveImage: %v", options.OciDecryptConfig)
 	type failure struct {
 		resolvedImageName string
 		err               error
@@ -268,7 +266,6 @@ func findUnusedContainer(name string, containers []storage.Container) string {
 }
 
 func newBuilder(ctx context.Context, store storage.Store, options BuilderOptions) (*Builder, error) {
-	logrus.Debugf("newBuilder: %v", options.OciDecryptConfig)
 	var (
 		ref types.ImageReference
 		img *storage.Image

pull.go

@@ -280,8 +280,6 @@ func pullImage(ctx context.Context, store storage.Store, srcRef types.ImageRefer
 	}()
 
 	logrus.Debugf("copying %q to %q", transports.ImageName(srcRef), destName)
-	logrus.Debugf("OCI Decrypt config : %v", options.OciDecryptConfig)
-	logrus.Debugf("Calling from pullImage")
 	if _, err := retryCopyImage(ctx, policyContext, maybeCachedDestRef, srcRef, srcRef, "pull", getCopyOptions(store, options.ReportWriter, sc, nil, "", options.RemoveSignatures, "", nil, nil, options.OciDecryptConfig), options.MaxRetries, options.RetryDelay); err != nil {
 		logrus.Debugf("error copying src image [%q] to dest image [%q] err: %v", transports.ImageName(srcRef), destName, err)
 		return nil, err