init

.gitignore

@@ -0,0 +1,6 @@
+dist
+node_modules
+transpiled
+worker
+wrangler.toml
+!wrangler.toml.sample

.prettierrc

@@ -0,0 +1,7 @@
+{
+  "singleQuote": true,
+  "semi": false,
+  "trailingComma": "all",
+  "tabWidth": 2,
+  "printWidth": 80
+}

LICENSE_APACHE

@@ -0,0 +1,176 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

LICENSE_MIT

@@ -0,0 +1,25 @@
+Copyright (c) 2020 Cloudflare, Inc. <wrangler@cloudflare.com>
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,53 @@
+# hammal
+
+Hammal 是运行于 cloudflare workers 上的 Docker 镜像加速工具，用于解决获取 Docker 官方镜像速度缓慢以及完全无法获取 k8s.gcr.io 上镜像的问题。
+
+### 食用方式
+
+首先安装 wrangler 命令行工具 https://developers.cloudflare.com/workers/cli-wrangler/install-update
+
+```
+git clone https://github.com/tomwei7/hammal.git
+cd hammal
+mv wrangler.toml.sample wrangler.toml
+
+# 获取 account_id id
+wrangler whoami
+
+# 创建 KV namespace
+wrangler kv:namespace create hammal_cache
+
+```
+
+修改 wrangler.toml 文件填充 account_id 与 kv_namespaces 中的 id
+
+```toml
+name = "hammal"
+type = "webpack"
+account_id = "your account_id"
+workers_dev = true
+route = ""
+zone_id = ""
+webpack_config = "webpack.config.js"
+kv_namespaces = [
+	 { binding = "HAMMAL_CACHE", id = "you kv id" }
+]
+```
+
+发布 workers
+
+```
+wrangler publish
+```
+
+发布 workers 可以获得类似 https://hammal.{your_name}.workers.dev  的地址，修改 registry-mirrors 地址为该地址即可
+
+```
+<<EOF sudo tee /etc/docker/daemon.json
+{
+  "registry-mirrors": [
+    "https://hammal.{your_name}.workers.dev"
+  ]
+}
+EOF
+```

package.json

@@ -0,0 +1,30 @@
+{
+  "name": "pname",
+  "version": "1.0.0",
+  "description": "Cloudflare worker TypeScript template",
+  "main": "index.js",
+  "scripts": {
+    "build": "webpack",
+    "dev": "NODE_ENV=development npm run build",
+    "format": "prettier --write '**/*.{ts,js,css,json,md}'",
+    "test:clean": "rimraf ./transpiled/src ./transpiled/test",
+    "test": "npm run test:clean && npm run transpile && mocha --require source-map-support/register --recursive transpiled/test",
+    "transpile": "tsc --project ./test"
+  },
+  "author": "author",
+  "license": "MIT OR Apache-2.0",
+  "devDependencies": {
+    "@cloudflare/workers-types": "^2.0.0",
+    "@types/chai": "^4.2.11",
+    "@types/mocha": "^7.0.2",
+    "chai": "^4.2.0",
+    "mocha": "^8.0.1",
+    "prettier": "^2.0.5",
+    "rimraf": "^3.0.2",
+    "service-worker-mock": "^2.0.5",
+    "ts-loader": "^7.0.5",
+    "typescript": "^3.9.5",
+    "webpack": "^4.43.0",
+    "webpack-cli": "^3.3.12"
+  }
+}

src/backend.ts

@@ -0,0 +1,38 @@
+import { TokenProvider, Token } from './token'
+
+interface ProxyArgs {
+  headers: Headers
+}
+
+class Backend {
+  private host: string;
+  private tokenProvider: TokenProvider|undefined;
+
+  constructor(host: string, tokenProvider?: TokenProvider) {
+    this.host = host;
+    this.tokenProvider = tokenProvider
+  }
+
+  async proxy(pathname: string, args: ProxyArgs): Promise<Response> {
+    const url = new URL(this.host)
+    url.pathname = pathname
+    const response = await fetch(url.toString(), {method: "GET", headers:args.headers, redirect: "follow"})
+    if (this.tokenProvider === undefined) {
+      return response
+    }
+    if (response.status !== 401) {
+      return response
+    }
+
+    const authenticateStr = response.headers.get("Www-Authenticate")
+    if (authenticateStr === null || this.tokenProvider === undefined) {
+      return response
+    }
+    const token: Token = await this.tokenProvider.token(authenticateStr)
+    const authenticatedHeaders = new Headers(args.headers)
+    authenticatedHeaders.append("Authorization", `Bearer ${token.token}`)
+    return await fetch(url.toString(), {method: "GET", headers:authenticatedHeaders, redirect: "follow"})
+  }
+}
+
+export {Backend}

src/handler.ts

@@ -0,0 +1,63 @@
+import { TokenProvider } from './token'
+import { Backend } from './backend'
+
+const PROXY_HEADER_ALLOW_LIST: string[] = ["accept", "user-agent", "accept-encoding"]
+
+const ORG_NAME_BACKEND:{ [key: string]: string; } = {
+  "gcr": "https://gcr.io",
+  "k8sgcr": "https://k8s.gcr.io",
+  "quay": "https://quay.io",
+}
+
+const DEFAULT_BACKEND_HOST: string = "https://registry-1.docker.io"
+
+export async function handleRequest(request: Request): Promise<Response> {
+  return handleRegistryRequest(request)
+}
+
+function copyProxyHeaders(inputHeaders: Headers) : Headers {
+  const headers = new Headers;
+  for(const pair of inputHeaders.entries()) {
+    if (pair[0].toLowerCase() in PROXY_HEADER_ALLOW_LIST) {
+      headers.append(pair[0], pair[1])
+    }
+  }
+  return headers
+}
+
+function orgNameFromPath(pathname: string): string|null {
+  const splitedPath: string[] = pathname.split("/", 3)
+  if (splitedPath.length === 3 && splitedPath[0] === "" && splitedPath[1] === "v2") {
+    return splitedPath[2].toLowerCase()
+  }
+  return null
+}
+
+function hostByOrgName(orgName: string|null): string {
+  if (orgName !== null && orgName in ORG_NAME_BACKEND) {
+    return ORG_NAME_BACKEND[orgName]
+  }
+  return DEFAULT_BACKEND_HOST
+}
+
+function rewritePathByOrg(orgName: string|null, pathname: string): string {
+  if (orgName === null || !(orgName in ORG_NAME_BACKEND)) {
+    return pathname
+  }
+  const splitedPath: string[] = pathname.split("/")
+  const cleanSplitedPath = splitedPath.filter(function(value: string, index: number) {
+    return value !== orgName || index !== 2;
+  })
+  return cleanSplitedPath.join("/")
+}
+
+async function handleRegistryRequest(request: Request): Promise<Response> {
+  const reqURL = new URL(request.url)
+  const orgName = orgNameFromPath(reqURL.pathname)
+  const pathname = rewritePathByOrg(orgName, reqURL.pathname)
+  const host = hostByOrgName(orgName)
+  const tokenProvider = new TokenProvider()
+  const backend = new Backend(host, tokenProvider)
+  const headers = copyProxyHeaders(request.headers)
+  return backend.proxy(pathname, {headers: request.headers})
+}

src/index.ts

@@ -0,0 +1,9 @@
+import { handleRequest } from './handler'
+
+declare global {
+  const HAMMAL_CACHE: KVNamespace
+}
+
+addEventListener('fetch', (event) => {
+  event.respondWith(handleRequest(event.request))
+})

src/token.ts

@@ -0,0 +1,99 @@
+interface WwwAuthenticate {
+  realm: string
+  service: string
+  scope: string
+}
+
+interface Token {
+  token: string
+  expires_in: number
+}
+
+function parseAuthenticateStr(authenticateStr: string): WwwAuthenticate {
+  const bearer = authenticateStr.split(/\s+/, 2)
+  if (bearer.length != 2 && bearer[0].toLowerCase() !== "bearer") {
+    throw new Error(`Invalid Www-Authenticate ${authenticateStr}`)
+  }
+  const params = bearer[1].split(",")
+  let get_param = function(name: string): string {
+    for(const param of params) {
+      const kvPair = param.split("=", 2)
+      if (kvPair.length !== 2 || kvPair[0] !== name) {
+        continue
+      }
+      return kvPair[1].replace(/['"]+/g, '')
+    }
+    return ""
+  }
+  return {
+    realm: get_param("realm"),
+    service: get_param("service"),
+    scope: get_param("scope"),
+  };
+}
+
+class TokenProvider {
+  private username: string|undefined;
+  private password: string|undefined;
+
+  constructor(username?: string, password?: string) {
+    this.username = username;
+    this.password = password;
+  }
+
+  private async authenticateCacheKey(wwwAuthenticate: WwwAuthenticate): Promise<string> {
+    const keyStr = `${this.username}:${this.password}/${wwwAuthenticate.realm}/${wwwAuthenticate.service}/${wwwAuthenticate.scope}`
+    const keyStrText = new TextEncoder().encode(keyStr)
+    const digestArray = await crypto.subtle.digest({name: "SHA-256"}, keyStrText)
+    const digestUint8Array = new Uint8Array(digestArray);
+    let hexArray = []
+    for(const num of digestUint8Array) {
+      hexArray.push(num.toString(16))
+    }
+    const digestHex = hexArray.join('')
+    return `token/${digestHex}`
+  }
+
+  private async tokenFromCache(cacheKey: string): Promise<Token|null> {
+    const value = await HAMMAL_CACHE.get(cacheKey)
+    if (value === null) {
+      return null
+    }
+    return JSON.parse(value)
+  }
+
+  private async tokenToCache(cacheKey: string, token: Token) {
+    await HAMMAL_CACHE.put(cacheKey, JSON.stringify(token), {expirationTtl: token.expires_in})
+  }
+
+  private async fetchToken(wwwAuthenticate: WwwAuthenticate): Promise<Token> {
+    const url = new URL(wwwAuthenticate.realm)
+    if (wwwAuthenticate.service.length) {
+      url.searchParams.set("service", wwwAuthenticate.service)
+    }
+    if (wwwAuthenticate.scope.length) {
+      url.searchParams.set("scope", wwwAuthenticate.scope)
+    }
+    // TODO: support basic auth
+    const response = await fetch(url.toString(), {method: "GET", headers: {}})
+    if (response.status !== 200) {
+      throw new Error(`Unable to fetch token from ${url.toString()} status code ${response.status}`)
+    }
+    const body = await response.json()
+    return {token: body.token, expires_in: body.expires_in}
+  }
+
+  async token(authenticateStr: string): Promise<Token> {
+    const wwwAuthenticate: WwwAuthenticate = parseAuthenticateStr(authenticateStr)
+    const cacheKey = await this.authenticateCacheKey(wwwAuthenticate)
+    const cachedToken: Token|null = await this.tokenFromCache(cacheKey)
+    if (cachedToken !== null) {
+      return cachedToken
+    }
+    const token: Token = await this.fetchToken(wwwAuthenticate)
+    await this.tokenToCache(cacheKey, token)
+    return token
+  }
+}
+
+export { TokenProvider, Token }

test/_setup.ts

@@ -0,0 +1,4 @@
+// set up global namespace for worker environment
+import * as makeServiceWorkerEnv from 'service-worker-mock'
+declare var global: any
+Object.assign(global, makeServiceWorkerEnv())

test/handler.ts

@@ -0,0 +1,23 @@
+import { expect } from 'chai'
+import { handleRequest } from '../src/handler'
+
+describe('handler returns response with request method', () => {
+  const methods = [
+    'GET',
+    'HEAD',
+    'POST',
+    'PUT',
+    'DELETE',
+    'CONNECT',
+    'OPTIONS',
+    'TRACE',
+    'PATCH',
+  ]
+  methods.forEach((method) => {
+    it(method, async () => {
+      const result = await handleRequest(new Request('/', { method }))
+      const text = await result.text()
+      expect(text).to.include(method)
+    })
+  })
+})

test/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "outDir": "../transpiled",
+    "target": "esnext",
+    "module": "commonjs",
+    "sourceMap": true,
+    "experimentalDecorators": true,
+    "lib": ["esnext", "webworker"]
+  },
+  "include": ["./*.ts", "../node_modules/@cloudflare/workers-types/index.d.ts"]
+}

tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "outDir": "./dist",
+    "module": "commonjs",
+    "target": "esnext",
+    "lib": ["esnext", "webworker"],
+    "alwaysStrict": true,
+    "strict": true,
+    "preserveConstEnums": true,
+    "moduleResolution": "node",
+    "sourceMap": true,
+    "esModuleInterop": true,
+    "types": ["@cloudflare/workers-types"]
+  },
+  "include": [
+    "./src/*.ts",
+    "./test/*.ts",
+    "./src/**/*.ts",
+    "./test/**/*.ts",
+    "./node_modules/@cloudflare/workers-types/index.d.ts"
+  ],
+  "exclude": ["node_modules/", "dist/"]
+}

webpack.config.js

@@ -0,0 +1,27 @@
+const path = require('path')
+const webpack = require('webpack')
+
+const mode = process.env.NODE_ENV || 'production'
+
+module.exports = {
+  output: {
+    filename: `worker.${mode}.js`,
+    path: path.join(__dirname, 'dist'),
+  },
+  mode,
+  resolve: {
+    extensions: ['.ts', '.tsx', '.js'],
+    plugins: [],
+  },
+  module: {
+    rules: [
+      {
+        test: /\.tsx?$/,
+        loader: 'ts-loader',
+        options: {
+          transpileOnly: true,
+        },
+      },
+    ],
+  },
+}

wrangler.toml.sample

@@ -0,0 +1,10 @@
+name = "hammal"
+type = "webpack"
+account_id = "your account_id"
+workers_dev = true
+route = ""
+zone_id = ""
+webpack_config = "webpack.config.js"
+kv_namespaces = [
+	 { binding = "HAMMAL_CACHE", id = "you kv id" }
+]