Merge pull request #2133 from poettering/import-drop-dkr

importd: drop dkr support

8 files changed, 8 insertions, 1779 deletions

diff --git a/src/import/importd.c b/src/import/importd.c
index 1f308b36b3..1b777c32b6 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -55,7 +55,6 @@ typedef enum TransferType {
         TRANSFER_EXPORT_RAW,
         TRANSFER_PULL_TAR,
         TRANSFER_PULL_RAW,
-        TRANSFER_PULL_DKR,
         _TRANSFER_TYPE_MAX,
         _TRANSFER_TYPE_INVALID = -1,
 } TransferType;
@@ -74,7 +73,6 @@ struct Transfer {
         bool force_local;
         bool read_only;
 
-        char *dkr_index_url;
         char *format;
 
         pid_t pid;
@@ -117,7 +115,6 @@ static const char* const transfer_type_table[_TRANSFER_TYPE_MAX] = {
         [TRANSFER_EXPORT_RAW] = "export-raw",
         [TRANSFER_PULL_TAR] = "pull-tar",
         [TRANSFER_PULL_RAW] = "pull-raw",
-        [TRANSFER_PULL_DKR] = "pull-dkr",
 };
 
 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(transfer_type, TransferType);
@@ -134,7 +131,6 @@ static Transfer *transfer_unref(Transfer *t) {
 
         free(t->remote);
         free(t->local);
-        free(t->dkr_index_url);
         free(t->format);
         free(t->object_path);
 
@@ -383,12 +379,11 @@ static int transfer_start(Transfer *t) {
         if (t->pid == 0) {
                 const char *cmd[] = {
                         NULL, /* systemd-import, systemd-export or systemd-pull */
-                        NULL, /* tar, raw, dkr */
+                        NULL, /* tar, raw  */
                         NULL, /* --verify= */
                         NULL, /* verify argument */
                         NULL, /* maybe --force */
                         NULL, /* maybe --read-only */
-                        NULL, /* maybe --dkr-index-url */
                         NULL, /* if so: the actual URL */
                         NULL, /* maybe --format= */
                         NULL, /* if so: the actual format */
@@ -471,10 +466,8 @@ static int transfer_start(Transfer *t) {
 
                 if (IN_SET(t->type, TRANSFER_IMPORT_TAR, TRANSFER_EXPORT_TAR, TRANSFER_PULL_TAR))
                         cmd[k++] = "tar";
-                else if (IN_SET(t->type, TRANSFER_IMPORT_RAW, TRANSFER_EXPORT_RAW, TRANSFER_PULL_RAW))
-                        cmd[k++] = "raw";
                 else
-                        cmd[k++] = "dkr";
+                        cmd[k++] = "raw";
 
                 if (t->verify != _IMPORT_VERIFY_INVALID) {
                         cmd[k++] = "--verify";
@@ -486,11 +479,6 @@ static int transfer_start(Transfer *t) {
                 if (t->read_only)
                         cmd[k++] = "--read-only";
 
-                if (t->dkr_index_url) {
-                        cmd[k++] = "--dkr-index-url";
-                        cmd[k++] = t->dkr_index_url;
-                }
-
                 if (t->format) {
                         cmd[k++] = "--format";
                         cmd[k++] = t->format;
@@ -707,7 +695,7 @@ static int manager_new(Manager **ret) {
         return 0;
 }
 
-static Transfer *manager_find(Manager *m, TransferType type, const char *dkr_index_url, const char *remote) {
+static Transfer *manager_find(Manager *m, TransferType type, const char *remote) {
         Transfer *t;
         Iterator i;
 
@@ -718,8 +706,7 @@ static Transfer *manager_find(Manager *m, TransferType type, const char *dkr_ind
         HASHMAP_FOREACH(t, m->transfers, i) {
 
                 if (t->type == type &&
-                    streq_ptr(t->remote, remote) &&
-                    streq_ptr(t->dkr_index_url, dkr_index_url))
+                    streq_ptr(t->remote, remote))
                         return t;
         }
 
@@ -907,7 +894,7 @@ static int method_pull_tar_or_raw(sd_bus_message *msg, void *userdata, sd_bus_er
 
         type = streq_ptr(sd_bus_message_get_member(msg), "PullTar") ? TRANSFER_PULL_TAR : TRANSFER_PULL_RAW;
 
-        if (manager_find(m, type, NULL, remote))
+        if (manager_find(m, type, remote))
                 return sd_bus_error_setf(error, BUS_ERROR_TRANSFER_IN_PROGRESS, "Transfer for %s already in progress.", remote);
 
         r = transfer_new(m, &t);
@@ -939,105 +926,6 @@ static int method_pull_tar_or_raw(sd_bus_message *msg, void *userdata, sd_bus_er
         return sd_bus_reply_method_return(msg, "uo", id, object);
 }
 
-static int method_pull_dkr(sd_bus_message *msg, void *userdata, sd_bus_error *error) {
-        _cleanup_(transfer_unrefp) Transfer *t = NULL;
-        const char *index_url, *remote, *tag, *local, *verify, *object;
-        Manager *m = userdata;
-        ImportVerify v;
-        int force, r;
-        uint32_t id;
-
-        assert(msg);
-        assert(m);
-
-        r = bus_verify_polkit_async(
-                        msg,
-                        CAP_SYS_ADMIN,
-                        "org.freedesktop.import1.pull",
-                        NULL,
-                        false,
-                        UID_INVALID,
-                        &m->polkit_registry,
-                        error);
-        if (r < 0)
-                return r;
-        if (r == 0)
-                return 1; /* Will call us back */
-
-        r = sd_bus_message_read(msg, "sssssb", &index_url, &remote, &tag, &local, &verify, &force);
-        if (r < 0)
-                return r;
-
-        if (isempty(index_url))
-                index_url = DEFAULT_DKR_INDEX_URL;
-        if (!index_url)
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Index URL must be specified.");
-        if (!http_url_is_valid(index_url))
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Index URL %s is invalid", index_url);
-
-        if (!dkr_name_is_valid(remote))
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Remote name %s is not valid", remote);
-
-        if (isempty(tag))
-                tag = "latest";
-        else if (!dkr_tag_is_valid(tag))
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Tag %s is not valid", tag);
-
-        if (isempty(local))
-                local = NULL;
-        else if (!machine_name_is_valid(local))
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Local name %s is invalid", local);
-
-        if (isempty(verify))
-                v = IMPORT_VERIFY_SIGNATURE;
-        else
-                v = import_verify_from_string(verify);
-        if (v < 0)
-                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Unknown verification mode %s", verify);
-
-        if (v != IMPORT_VERIFY_NO)
-                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "DKR does not support verification.");
-
-        r = setup_machine_directory((uint64_t) -1, error);
-        if (r < 0)
-                return r;
-
-        if (manager_find(m, TRANSFER_PULL_DKR, index_url, remote))
-                return sd_bus_error_setf(error, BUS_ERROR_TRANSFER_IN_PROGRESS, "Transfer for %s already in progress.", remote);
-
-        r = transfer_new(m, &t);
-        if (r < 0)
-                return r;
-
-        t->type = TRANSFER_PULL_DKR;
-        t->verify = v;
-        t->force_local = force;
-
-        t->dkr_index_url = strdup(index_url);
-        if (!t->dkr_index_url)
-                return -ENOMEM;
-
-        t->remote = strjoin(remote, ":", tag, NULL);
-        if (!t->remote)
-                return -ENOMEM;
-
-        if (local) {
-                t->local = strdup(local);
-                if (!t->local)
-                        return -ENOMEM;
-        }
-
-        r = transfer_start(t);
-        if (r < 0)
-                return r;
-
-        object = t->object_path;
-        id = t->id;
-        t = NULL;
-
-        return sd_bus_reply_method_return(msg, "uo", id, object);
-}
-
 static int method_list_transfers(sd_bus_message *msg, void *userdata, sd_bus_error *error) {
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
         Manager *m = userdata;
@@ -1188,7 +1076,6 @@ static const sd_bus_vtable manager_vtable[] = {
         SD_BUS_METHOD("ExportRaw", "shs", "uo", method_export_tar_or_raw, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("PullTar", "sssb", "uo", method_pull_tar_or_raw, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("PullRaw", "sssb", "uo", method_pull_tar_or_raw, SD_BUS_VTABLE_UNPRIVILEGED),
-        SD_BUS_METHOD("PullDkr", "sssssb", "uo", method_pull_dkr, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ListTransfers", NULL, "a(usssdo)", method_list_transfers, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("CancelTransfer", "u", NULL, method_cancel_transfer, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_SIGNAL("TransferNew", "uo", 0),
diff --git a/src/import/org.freedesktop.import1.conf b/src/import/org.freedesktop.import1.conf
index ae36af422f..ed2539a03b 100644
--- a/src/import/org.freedesktop.import1.conf
+++ b/src/import/org.freedesktop.import1.conf
@@ -53,10 +53,6 @@
                        send_member="PullRaw"/>
 
                 <allow send_destination="org.freedesktop.import1"
-                       send_interface="org.freedesktop.import1.Manager"
-                       send_member="PullDkr"/>
-
-                <allow send_destination="org.freedesktop.import1"
                        send_interface="org.freedesktop.import1.Transfer"
                        send_member="Cancel"/>
 
diff --git a/src/import/pull-dkr.c b/src/import/pull-dkr.c
deleted file mode 100644
index 831470ff13..0000000000
--- a/src/import/pull-dkr.c
+++ /dev/null
@@ -1,1346 +0,0 @@
-/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
-
-/***
-  This file is part of systemd.
-
-  Copyright 2014 Lennart Poettering
-
-  systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU Lesser General Public License as published by
-  the Free Software Foundation; either version 2.1 of the License, or
-  (at your option) any later version.
-
-  systemd is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  Lesser General Public License for more details.
-
-  You should have received a copy of the GNU Lesser General Public License
-  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-#include <curl/curl.h>
-#include <sys/prctl.h>
-
-#include "sd-daemon.h"
-
-#include "alloc-util.h"
-#include "aufs-util.h"
-#include "btrfs-util.h"
-#include "curl-util.h"
-#include "fd-util.h"
-#include "fileio.h"
-#include "fs-util.h"
-#include "hostname-util.h"
-#include "import-common.h"
-#include "import-util.h"
-#include "json.h"
-#include "mkdir.h"
-#include "path-util.h"
-#include "process-util.h"
-#include "pull-common.h"
-#include "pull-dkr.h"
-#include "pull-job.h"
-#include "rm-rf.h"
-#include "string-util.h"
-#include "strv.h"
-#include "utf8.h"
-#include "web-util.h"
-
-typedef enum DkrProgress {
-        DKR_SEARCHING,
-        DKR_RESOLVING,
-        DKR_METADATA,
-        DKR_DOWNLOADING,
-        DKR_COPYING,
-} DkrProgress;
-
-struct DkrPull {
-        sd_event *event;
-        CurlGlue *glue;
-
-        char *index_protocol;
-        char *index_address;
-
-        char *index_url;
-        char *image_root;
-
-        PullJob *images_job;
-        PullJob *tags_job;
-        PullJob *ancestry_job;
-        PullJob *json_job;
-        PullJob *layer_job;
-
-        char *name;
-        char *reference;
-        char *id;
-
-        char *response_digest;
-        char *response_token;
-        char **response_registries;
-
-        char **ancestry;
-        unsigned n_ancestry;
-        unsigned current_ancestry;
-
-        DkrPullFinished on_finished;
-        void *userdata;
-
-        char *local;
-        bool force_local;
-        bool grow_machine_directory;
-
-        char *temp_path;
-        char *final_path;
-
-        pid_t tar_pid;
-};
-
-#define PROTOCOL_PREFIX "https://"
-
-#define HEADER_TOKEN "X-Do" /* the HTTP header for the auth token */ "cker-Token:"
-#define HEADER_REGISTRY "X-Do" /* the HTTP header for the registry */ "cker-Endpoints:"
-#define HEADER_DIGEST "Do" /* the HTTP header for the manifest digest */ "cker-Content-Digest:"
-#define LAYERS_MAX 127
-
-static void dkr_pull_job_on_finished(PullJob *j);
-
-DkrPull* dkr_pull_unref(DkrPull *i) {
-        if (!i)
-                return NULL;
-
-        if (i->tar_pid > 1) {
-                (void) kill_and_sigcont(i->tar_pid, SIGKILL);
-                (void) wait_for_terminate(i->tar_pid, NULL);
-        }
-
-        pull_job_unref(i->images_job);
-        pull_job_unref(i->tags_job);
-        pull_job_unref(i->ancestry_job);
-        pull_job_unref(i->json_job);
-        pull_job_unref(i->layer_job);
-
-        curl_glue_unref(i->glue);
-        sd_event_unref(i->event);
-
-        if (i->temp_path) {
-                (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
-                free(i->temp_path);
-        }
-
-        free(i->name);
-        free(i->reference);
-        free(i->id);
-        free(i->response_token);
-        strv_free(i->ancestry);
-        free(i->final_path);
-        free(i->index_address);
-        free(i->index_protocol);
-        free(i->index_url);
-        free(i->image_root);
-        free(i->local);
-        free(i);
-
-        return NULL;
-}
-
-int dkr_pull_new(
-                DkrPull **ret,
-                sd_event *event,
-                const char *index_url,
-                const char *image_root,
-                DkrPullFinished on_finished,
-                void *userdata) {
-
-        _cleanup_(dkr_pull_unrefp) DkrPull *i = NULL;
-        char *e;
-        int r;
-
-        assert(ret);
-        assert(index_url);
-
-        if (!http_url_is_valid(index_url))
-                return -EINVAL;
-
-        i = new0(DkrPull, 1);
-        if (!i)
-                return -ENOMEM;
-
-        i->on_finished = on_finished;
-        i->userdata = userdata;
-
-        i->image_root = strdup(image_root ?: "/var/lib/machines");
-        if (!i->image_root)
-                return -ENOMEM;
-
-        i->grow_machine_directory = path_startswith(i->image_root, "/var/lib/machines");
-
-        i->index_url = strdup(index_url);
-        if (!i->index_url)
-                return -ENOMEM;
-
-        e = endswith(i->index_url, "/");
-        if (e)
-                *e = 0;
-
-        if (event)
-                i->event = sd_event_ref(event);
-        else {
-                r = sd_event_default(&i->event);
-                if (r < 0)
-                        return r;
-        }
-
-        r = curl_glue_new(&i->glue, i->event);
-        if (r < 0)
-                return r;
-
-        i->glue->on_finished = pull_job_curl_on_finished;
-        i->glue->userdata = i;
-
-        *ret = i;
-        i = NULL;
-
-        return 0;
-}
-
-static void dkr_pull_report_progress(DkrPull *i, DkrProgress p) {
-        unsigned percent;
-
-        assert(i);
-
-        switch (p) {
-
-        case DKR_SEARCHING:
-                percent = 0;
-                if (i->images_job)
-                        percent += i->images_job->progress_percent * 5 / 100;
-                break;
-
-        case DKR_RESOLVING:
-                percent = 5;
-                if (i->tags_job)
-                        percent += i->tags_job->progress_percent * 5 / 100;
-                break;
-
-        case DKR_METADATA:
-                percent = 10;
-                if (i->ancestry_job)
-                        percent += i->ancestry_job->progress_percent * 5 / 100;
-                if (i->json_job)
-                        percent += i->json_job->progress_percent * 5 / 100;
-                break;
-
-        case DKR_DOWNLOADING:
-                percent = 20;
-                percent += 75 * i->current_ancestry / MAX(1U, i->n_ancestry);
-                if (i->layer_job)
-                        percent += i->layer_job->progress_percent * 75 / MAX(1U, i->n_ancestry) / 100;
-
-                break;
-
-        case DKR_COPYING:
-                percent = 95;
-                break;
-
-        default:
-                assert_not_reached("Unknown progress state");
-        }
-
-        sd_notifyf(false, "X_IMPORT_PROGRESS=%u", percent);
-        log_debug("Combined progress %u%%", percent);
-}
-
-static int parse_id(const void *payload, size_t size, char **ret) {
-        _cleanup_free_ char *buf = NULL, *id = NULL, *other = NULL;
-        union json_value v = {};
-        void *json_state = NULL;
-        const char *p;
-        int t;
-
-        assert(payload);
-        assert(ret);
-
-        if (size <= 0)
-                return -EBADMSG;
-
-        if (memchr(payload, 0, size))
-                return -EBADMSG;
-
-        buf = strndup(payload, size);
-        if (!buf)
-                return -ENOMEM;
-
-        p = buf;
-        t = json_tokenize(&p, &id, &v, &json_state, NULL);
-        if (t < 0)
-                return t;
-        if (t != JSON_STRING)
-                return -EBADMSG;
-
-        t = json_tokenize(&p, &other, &v, &json_state, NULL);
-        if (t < 0)
-                return t;
-        if (t != JSON_END)
-                return -EBADMSG;
-
-        if (!dkr_id_is_valid(id))
-                return -EBADMSG;
-
-        *ret = id;
-        id = NULL;
-
-        return 0;
-}
-
-static int parse_ancestry(const void *payload, size_t size, char ***ret) {
-        _cleanup_free_ char *buf = NULL;
-        void *json_state = NULL;
-        const char *p;
-        enum {
-                STATE_BEGIN,
-                STATE_ITEM,
-                STATE_COMMA,
-                STATE_END,
-        } state = STATE_BEGIN;
-        _cleanup_strv_free_ char **l = NULL;
-        size_t n = 0, allocated = 0;
-
-        if (size <= 0)
-                return -EBADMSG;
-
-        if (memchr(payload, 0, size))
-                return -EBADMSG;
-
-        buf = strndup(payload, size);
-        if (!buf)
-                return -ENOMEM;
-
-        p = buf;
-        for (;;) {
-                _cleanup_free_ char *str;
-                union json_value v = {};
-                int t;
-
-                t = json_tokenize(&p, &str, &v, &json_state, NULL);
-                if (t < 0)
-                        return t;
-
-                switch (state) {
-
-                case STATE_BEGIN:
-                        if (t == JSON_ARRAY_OPEN)
-                                state = STATE_ITEM;
-                        else
-                                return -EBADMSG;
-
-                        break;
-
-                case STATE_ITEM:
-                        if (t == JSON_STRING) {
-                                if (!dkr_id_is_valid(str))
-                                        return -EBADMSG;
-
-                                if (n+1 > LAYERS_MAX)
-                                        return -EFBIG;
-
-                                if (!GREEDY_REALLOC(l, allocated, n + 2))
-                                        return -ENOMEM;
-
-                                l[n++] = str;
-                                str = NULL;
-                                l[n] = NULL;
-
-                                state = STATE_COMMA;
-
-                        } else if (t == JSON_ARRAY_CLOSE)
-                                state = STATE_END;
-                        else
-                                return -EBADMSG;
-
-                        break;
-
-                case STATE_COMMA:
-                        if (t == JSON_COMMA)
-                                state = STATE_ITEM;
-                        else if (t == JSON_ARRAY_CLOSE)
-                                state = STATE_END;
-                        else
-                                return -EBADMSG;
-                        break;
-
-                case STATE_END:
-                        if (t == JSON_END) {
-
-                                if (strv_isempty(l))
-                                        return -EBADMSG;
-
-                                if (!strv_is_uniq(l))
-                                        return -EBADMSG;
-
-                                l = strv_reverse(l);
-
-                                *ret = l;
-                                l = NULL;
-                                return 0;
-                        } else
-                                return -EBADMSG;
-                }
-
-        }
-}
-
-static const char *dkr_pull_current_layer(DkrPull *i) {
-        assert(i);
-
-        if (strv_isempty(i->ancestry))
-                return NULL;
-
-        return i->ancestry[i->current_ancestry];
-}
-
-static const char *dkr_pull_current_base_layer(DkrPull *i) {
-        assert(i);
-
-        if (strv_isempty(i->ancestry))
-                return NULL;
-
-        if (i->current_ancestry <= 0)
-                return NULL;
-
-        return i->ancestry[i->current_ancestry-1];
-}
-
-static int dkr_pull_add_token(DkrPull *i, PullJob *j) {
-        const char *t;
-
-        assert(i);
-        assert(j);
-
-        if (i->response_token)
-                t = strjoina("Authorization: Token ", i->response_token);
-        else
-                t = HEADER_TOKEN " true";
-
-        j->request_header = curl_slist_new("Accept: application/json", t, NULL);
-        if (!j->request_header)
-                return -ENOMEM;
-
-        return 0;
-}
-
-static int dkr_pull_add_bearer_token(DkrPull *i, PullJob *j) {
-        const char *t = NULL;
-
-        assert(i);
-        assert(j);
-
-        if (i->response_token)
-                t = strjoina("Authorization: Bearer ", i->response_token);
-        else
-                return -EINVAL;
-
-        j->request_header = curl_slist_new("Accept: application/json", t, NULL);
-        if (!j->request_header)
-                return -ENOMEM;
-
-        return 0;
-}
-
-static bool dkr_pull_is_done(DkrPull *i) {
-        assert(i);
-        assert(i->images_job);
-        if (i->images_job->state != PULL_JOB_DONE)
-                return false;
-
-        if (!i->tags_job || i->tags_job->state != PULL_JOB_DONE)
-                return false;
-
-        if (!i->ancestry_job || i->ancestry_job->state != PULL_JOB_DONE)
-                return false;
-
-        if (i->json_job && i->json_job->state != PULL_JOB_DONE)
-                return false;
-
-        if (i->layer_job && i->layer_job->state != PULL_JOB_DONE)
-                return false;
-
-        if (dkr_pull_current_layer(i))
-                return false;
-
-        return true;
-}
-
-static int dkr_pull_make_local_copy(DkrPull *i, DkrPullVersion version) {
-        int r;
-        _cleanup_free_ char *p = NULL;
-
-        assert(i);
-
-        if (!i->local)
-                return 0;
-
-        if (!i->final_path) {
-                i->final_path = strjoin(i->image_root, "/.dkr-", i->id, NULL);
-                if (!i->final_path)
-                        return -ENOMEM;
-        }
-
-        if (version == DKR_PULL_V2) {
-                p = dirname_malloc(i->image_root);
-                if (!p)
-                        return -ENOMEM;
-        }
-
-        r = pull_make_local_copy(i->final_path, p ?: i->image_root, i->local, i->force_local);
-        if (r < 0)
-                return r;
-
-        if (version == DKR_PULL_V2) {
-                char **k;
-
-                STRV_FOREACH(k, i->ancestry) {
-                        _cleanup_free_ char *d;
-
-                        d = strjoin(i->image_root, "/.dkr-", *k, NULL);
-                        if (!d)
-                                return -ENOMEM;
-
-                        r = btrfs_subvol_remove(d, BTRFS_REMOVE_QUOTA);
-                        if (r < 0)
-                               return r;
-                }
-
-                r = rmdir(i->image_root);
-                if (r < 0)
-                        return r;
-        }
-
-        return 0;
-}
-
-static int dkr_pull_job_on_open_disk(PullJob *j) {
-        const char *base;
-        DkrPull *i;
-        int r;
-
-        assert(j);
-        assert(j->userdata);
-
-        i = j->userdata;
-        assert(i->layer_job == j);
-        assert(i->final_path);
-        assert(!i->temp_path);
-        assert(i->tar_pid <= 0);
-
-        r = tempfn_random(i->final_path, NULL, &i->temp_path);
-        if (r < 0)
-                return log_oom();
-
-        mkdir_parents_label(i->temp_path, 0700);
-
-        base = dkr_pull_current_base_layer(i);
-        if (base) {
-                const char *base_path;
-
-                base_path = strjoina(i->image_root, "/.dkr-", base);
-                r = btrfs_subvol_snapshot(base_path, i->temp_path, BTRFS_SNAPSHOT_FALLBACK_COPY|BTRFS_SNAPSHOT_QUOTA);
-        } else
-                r = btrfs_subvol_make(i->temp_path);
-        if (r < 0)
-                return log_error_errno(r, "Failed to make btrfs subvolume %s: %m", i->temp_path);
-
-        (void) import_assign_pool_quota_and_warn(i->temp_path);
-
-        j->disk_fd = import_fork_tar_x(i->temp_path, &i->tar_pid);
-        if (j->disk_fd < 0)
-                return j->disk_fd;
-
-        return 0;
-}
-
-static void dkr_pull_job_on_progress(PullJob *j) {
-        DkrPull *i;
-
-        assert(j);
-        assert(j->userdata);
-
-        i = j->userdata;
-
-        dkr_pull_report_progress(
-                        i,
-                        j == i->images_job                       ? DKR_SEARCHING :
-                        j == i->tags_job                         ? DKR_RESOLVING :
-                        j == i->ancestry_job || j == i->json_job ? DKR_METADATA :
-                                                                   DKR_DOWNLOADING);
-}
-
-static void dkr_pull_job_on_finished_v2(PullJob *j);
-
-static int dkr_pull_pull_layer_v2(DkrPull *i) {
-        _cleanup_free_ char *path = NULL;
-        const char *url, *layer = NULL;
-        int r;
-
-        assert(i);
-        assert(!i->layer_job);
-        assert(!i->temp_path);
-        assert(!i->final_path);
-
-        for (;;) {
-                layer = dkr_pull_current_layer(i);
-                if (!layer)
-                        return 0; /* no more layers */
-
-                path = strjoin(i->image_root, "/.dkr-", layer, NULL);
-                if (!path)
-                        return log_oom();
-
-                if (laccess(path, F_OK) < 0) {
-                        if (errno == ENOENT)
-                                break;
-
-                        return log_error_errno(errno, "Failed to check for container: %m");
-                }
-
-                log_info("Layer %s already exists, skipping.", layer);
-
-                i->current_ancestry++;
-
-                path = mfree(path);
-        }
-
-        log_info("Pulling layer %s...", layer);
-
-        i->final_path = path;
-        path = NULL;
-
-        url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v2/", i->name, "/blobs/", layer);
-        r = pull_job_new(&i->layer_job, url, i->glue, i);
-        if (r < 0)
-                return log_error_errno(r, "Failed to allocate layer job: %m");
-
-        r = dkr_pull_add_bearer_token(i, i->layer_job);
-        if (r < 0)
-                return log_oom();
-
-        i->layer_job->on_finished = dkr_pull_job_on_finished_v2;
-        i->layer_job->on_open_disk = dkr_pull_job_on_open_disk;
-        i->layer_job->on_progress = dkr_pull_job_on_progress;
-        i->layer_job->grow_machine_directory = i->grow_machine_directory;
-
-        r = pull_job_begin(i->layer_job);
-        if (r < 0)
-                return log_error_errno(r, "Failed to start layer job: %m");
-
-        return 0;
-}
-
-static int dkr_pull_pull_layer(DkrPull *i) {
-        _cleanup_free_ char *path = NULL;
-        const char *url, *layer = NULL;
-        int r;
-
-        assert(i);
-        assert(!i->layer_job);
-        assert(!i->temp_path);
-        assert(!i->final_path);
-
-        for (;;) {
-                layer = dkr_pull_current_layer(i);
-                if (!layer)
-                        return 0; /* no more layers */
-
-                path = strjoin(i->image_root, "/.dkr-", layer, NULL);
-                if (!path)
-                        return log_oom();
-
-                if (laccess(path, F_OK) < 0) {
-                        if (errno == ENOENT)
-                                break;
-
-                        return log_error_errno(errno, "Failed to check for container: %m");
-                }
-
-                log_info("Layer %s already exists, skipping.", layer);
-
-                i->current_ancestry++;
-
-                path = mfree(path);
-        }
-
-        log_info("Pulling layer %s...", layer);
-
-        i->final_path = path;
-        path = NULL;
-
-        url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v1/images/", layer, "/layer");
-        r = pull_job_new(&i->layer_job, url, i->glue, i);
-        if (r < 0)
-                return log_error_errno(r, "Failed to allocate layer job: %m");
-
-        r = dkr_pull_add_token(i, i->layer_job);
-        if (r < 0)
-                return log_oom();
-
-        i->layer_job->on_finished = dkr_pull_job_on_finished;
-        i->layer_job->on_open_disk = dkr_pull_job_on_open_disk;
-        i->layer_job->on_progress = dkr_pull_job_on_progress;
-        i->layer_job->grow_machine_directory = i->grow_machine_directory;
-
-        r = pull_job_begin(i->layer_job);
-        if (r < 0)
-                return log_error_errno(r, "Failed to start layer job: %m");
-
-        return 0;
-}
-
-static int dkr_pull_job_on_header(PullJob *j, const char *header, size_t sz)  {
-        _cleanup_free_ char *registry = NULL;
-        char *token, *digest;
-        DkrPull *i;
-        int r;
-
-        assert(j);
-        assert(j->userdata);
-
-        i = j->userdata;
-        r = curl_header_strdup(header, sz, HEADER_TOKEN, &token);
-        if (r < 0)
-                return log_oom();
-        if (r > 0) {
-                free(i->response_token);
-                i->response_token = token;
-                return 0;
-        }
-
-        r = curl_header_strdup(header, sz, HEADER_DIGEST, &digest);
-        if (r < 0)
-                return log_oom();
-        if (r > 0) {
-                free(i->response_digest);
-                i->response_digest = digest;
-                return 0;
-        }
-
-        r = curl_header_strdup(header, sz, HEADER_REGISTRY, &registry);
-        if (r < 0)
-                return log_oom();
-        if (r > 0) {
-                char **l, **k;
-
-                l = strv_split(registry, ",");
-                if (!l)
-                        return log_oom();
-
-                STRV_FOREACH(k, l) {
-                        if (!hostname_is_valid(*k, false)) {
-                                log_error("Registry hostname is not valid.");
-                                strv_free(l);
-                                return -EBADMSG;
-                        }
-                }
-
-                strv_free(i->response_registries);
-                i->response_registries = l;
-        }
-
-        return 0;
-}
-
-static void dkr_pull_job_on_finished_v2(PullJob *j) {
-        DkrPull *i;
-        int r;
-
-        assert(j);
-        assert(j->userdata);
-
-        i = j->userdata;
-        if (j->error != 0) {
-                if (j == i->images_job)
-                        log_error_errno(j->error, "Failed to retrieve images list. (Wrong index URL?)");
-                else if (j == i->ancestry_job)
-                        log_error_errno(j->error, "Failed to retrieve manifest.");
-                else if (j == i->json_job)
-                        log_error_errno(j->error, "Failed to retrieve json data.");
-                else
-                        log_error_errno(j->error, "Failed to retrieve layer data.");
-
-                r = j->error;
-                goto finish;
-        }
-
-        if (i->images_job == j) {
-                const char *url;
-
-                assert(!i->tags_job);
-                assert(!i->ancestry_job);
-                assert(!i->json_job);
-                assert(!i->layer_job);
-
-                if (strv_isempty(i->response_registries)) {
-                        r = -EBADMSG;
-                        log_error("Didn't get registry information.");
-                        goto finish;
-                }
-
-                log_info("Index lookup succeeded, directed to registry %s.", i->response_registries[0]);
-                dkr_pull_report_progress(i, DKR_RESOLVING);
-
-                url = strjoina(i->index_protocol, "auth.", i->index_address, "/v2/token/?scope=repository:",
-                               i->name, ":pull&service=registry.", i->index_address);
-                r = pull_job_new(&i->tags_job, url, i->glue, i);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to allocate tags job: %m");
-                        goto finish;
-                }
-
-                i->tags_job->on_finished = dkr_pull_job_on_finished_v2;
-                i->tags_job->on_progress = dkr_pull_job_on_progress;
-
-                r = pull_job_begin(i->tags_job);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to start tags job: %m");
-                        goto finish;
-                }
-
-        } else if (i->tags_job == j) {
-                const char *url;
-                _cleanup_free_ char *buf;
-                _cleanup_json_variant_unref_ JsonVariant *doc = NULL;
-                JsonVariant *e = NULL;
-
-                assert(!i->ancestry_job);
-                assert(!i->json_job);
-                assert(!i->layer_job);
-
-                buf = strndup((const char *)j->payload, j->payload_size);
-                if (!buf) {
-                        r = -ENOMEM;
-                        log_oom();
-                        goto finish;
-                }
-
-                r = json_parse(buf, &doc);
-                if (r < 0) {
-                        log_error("Unable to parse bearer token\n%s", j->payload);
-                        goto finish;
-                }
-
-                e = json_variant_value(doc, "token");
-                if (!e || e->type != JSON_VARIANT_STRING) {
-                        r = -EBADMSG;
-                        log_error("Invalid JSON format for Bearer token");
-                        goto finish;
-                }
-
-                r = free_and_strdup(&i->response_token, json_variant_string(e));
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-
-                url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v2/", i->name, "/manifests/", i->reference);
-                r = pull_job_new(&i->ancestry_job, url, i->glue, i);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to allocate ancestry job: %m");
-                        goto finish;
-                }
-
-                r = dkr_pull_add_bearer_token(i, i->ancestry_job);
-                if (r < 0)
-                        goto finish;
-
-                i->ancestry_job->on_finished = dkr_pull_job_on_finished_v2;
-                i->ancestry_job->on_progress = dkr_pull_job_on_progress;
-                i->ancestry_job->on_header = dkr_pull_job_on_header;
-
-
-                r = pull_job_begin(i->ancestry_job);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to start ancestry job: %m");
-                        goto finish;
-                }
-
-        } else if (i->ancestry_job == j) {
-
-                _cleanup_json_variant_unref_ JsonVariant *doc = NULL, *compat = NULL;
-                JsonVariant *e = NULL;
-                _cleanup_strv_free_ char **ancestry = NULL;
-                size_t allocated = 0, size = 0;
-                char *path = NULL, **k = NULL;
-
-                r = json_parse((const char *)j->payload, &doc);
-                if (r < 0) {
-                        log_error("Invalid JSON Manifest");
-                        goto finish;
-                }
-
-                e = json_variant_value(doc, "fsLayers");
-                if (!e || e->type != JSON_VARIANT_ARRAY || e->size == 0) {
-                        r = -EBADMSG;
-                        goto finish;
-                }
-
-                log_info("JSON manifest with schema v%"PRIi64" for %s parsed!",
-                                json_variant_integer(json_variant_value(doc, "schemaVersion")),
-                                json_variant_string(json_variant_value(doc, "name")));
-
-                for (unsigned z = 0; z < e->size; z++) {
-                        JsonVariant *f = json_variant_element(e, z), *g = NULL;
-                        const char *layer;
-                        if (f->type != JSON_VARIANT_OBJECT) {
-                                r = -EBADMSG;
-                                goto finish;
-                        }
-
-                        g = json_variant_value(f, "blobSum");
-
-                        layer = json_variant_string(g);
-                        if (!dkr_digest_is_valid(layer)) {
-                                r = -EBADMSG;
-                                goto finish;
-                        }
-
-                        if (!GREEDY_REALLOC(ancestry, allocated, size + 2)) {
-                                r = -ENOMEM;
-                                log_oom();
-                                goto finish;
-                        }
-
-                        ancestry[size] = strdup(layer);
-                        if (!ancestry[size]) {
-                                r = -ENOMEM;
-                                log_oom();
-                                goto finish;
-                        }
-
-                        ancestry[size+1] = NULL;
-                        size += 1;
-                }
-
-                e = json_variant_value(doc, "history");
-                if (!e || e->type != JSON_VARIANT_ARRAY) {
-                        r = -EBADMSG;
-                        goto finish;
-                }
-
-                e = json_variant_element(e, 0);
-                e = json_variant_value(e, "v1Compatibility");
-                r = json_parse(json_variant_string(e), &compat);
-                if (r < 0) {
-                        log_error("Invalid v1Compatibility JSON");
-                        goto finish;
-                }
-
-                e = json_variant_value(compat, "id");
-
-                strv_free(i->ancestry);
-                i->ancestry = strv_reverse(strv_uniq(ancestry));
-                i->n_ancestry = strv_length(i->ancestry);
-                i->current_ancestry = 0;
-                i->id = strdup(i->ancestry[i->n_ancestry - 1]);
-                if (!i->id) {
-                        r = -ENOMEM;
-                        log_oom();
-                        goto finish;
-                }
-                path = strjoin(i->image_root, "/.dkr-", json_variant_string(e), NULL);
-                if (!path) {
-                        r = -ENOMEM;
-                        log_oom();
-                        goto finish;
-                }
-                free(i->image_root);
-                i->image_root = path;
-                ancestry = NULL;
-
-                log_info("Required layers:\n");
-                STRV_FOREACH(k, i->ancestry)
-                        log_info("\t%s", *k);
-                log_info("\nProvenance:\n\tImageID: %s\n\tDigest:  %s", json_variant_string(e), i->response_digest);
-
-                dkr_pull_report_progress(i, DKR_DOWNLOADING);
-
-                r = dkr_pull_pull_layer_v2(i);
-                if (r < 0)
-                        goto finish;
-
-        } else if (i->layer_job == j) {
-                assert(i->temp_path);
-                assert(i->final_path);
-
-                j->disk_fd = safe_close(j->disk_fd);
-
-                if (i->tar_pid > 0) {
-                        r = wait_for_terminate_and_warn("tar", i->tar_pid, true);
-                        i->tar_pid = 0;
-                        if (r < 0)
-                                goto finish;
-                }
-
-                r = aufs_resolve(i->temp_path);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to resolve aufs whiteouts: %m");
-                        goto finish;
-                }
-
-                r = btrfs_subvol_set_read_only(i->temp_path, true);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to mark snapshot read-only: %m");
-                        goto finish;
-                }
-
-                if (rename(i->temp_path, i->final_path) < 0) {
-                        log_error_errno(errno, "Failed to rename snaphsot: %m");
-                        goto finish;
-                }
-
-                log_info("Completed writing to layer %s.", i->final_path);
-
-                i->layer_job = pull_job_unref(i->layer_job);
-                free(i->temp_path);
-                i->temp_path = NULL;
-                free(i->final_path);
-                i->final_path = NULL;
-
-                i->current_ancestry ++;
-                r = dkr_pull_pull_layer_v2(i);
-                if (r < 0)
-                        goto finish;
-
-        } else if (i->json_job != j)
-                assert_not_reached("Got finished event for unknown curl object");
-
-        if (!dkr_pull_is_done(i))
-                return;
-
-        dkr_pull_report_progress(i, DKR_COPYING);
-
-        r = dkr_pull_make_local_copy(i, DKR_PULL_V2);
-        if (r < 0)
-                goto finish;
-
-        r = 0;
-
-finish:
-        if (i->on_finished)
-                i->on_finished(i, r, i->userdata);
-        else
-                sd_event_exit(i->event, r);
-
-}
-
-static void dkr_pull_job_on_finished(PullJob *j) {
-        DkrPull *i;
-        int r;
-
-        assert(j);
-        assert(j->userdata);
-
-        i = j->userdata;
-        if (j->error != 0) {
-                if (j == i->images_job)
-                        log_error_errno(j->error, "Failed to retrieve images list. (Wrong index URL?)");
-                else if (j == i->tags_job)
-                        log_error_errno(j->error, "Failed to retrieve tags list.");
-                else if (j == i->ancestry_job)
-                        log_error_errno(j->error, "Failed to retrieve ancestry list.");
-                else if (j == i->json_job)
-                        log_error_errno(j->error, "Failed to retrieve json data.");
-                else
-                        log_error_errno(j->error, "Failed to retrieve layer data.");
-
-                r = j->error;
-                goto finish;
-        }
-
-        if (i->images_job == j) {
-                const char *url;
-
-                assert(!i->tags_job);
-                assert(!i->ancestry_job);
-                assert(!i->json_job);
-                assert(!i->layer_job);
-
-                if (strv_isempty(i->response_registries)) {
-                        r = -EBADMSG;
-                        log_error("Didn't get registry information.");
-                        goto finish;
-                }
-
-                log_info("Index lookup succeeded, directed to registry %s.", i->response_registries[0]);
-                dkr_pull_report_progress(i, DKR_RESOLVING);
-
-                url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v1/repositories/", i->name, "/tags/", i->reference);
-                r = pull_job_new(&i->tags_job, url, i->glue, i);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to allocate tags job: %m");
-                        goto finish;
-                }
-
-                r = dkr_pull_add_token(i, i->tags_job);
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-
-                i->tags_job->on_finished = dkr_pull_job_on_finished;
-                i->tags_job->on_progress = dkr_pull_job_on_progress;
-
-                r = pull_job_begin(i->tags_job);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to start tags job: %m");
-                        goto finish;
-                }
-
-        } else if (i->tags_job == j) {
-                const char *url;
-                char *id = NULL;
-
-                assert(!i->ancestry_job);
-                assert(!i->json_job);
-                assert(!i->layer_job);
-
-                r = parse_id(j->payload, j->payload_size, &id);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to parse JSON id.");
-                        goto finish;
-                }
-
-                free(i->id);
-                i->id = id;
-
-                log_info("Tag lookup succeeded, resolved to layer %s.", i->id);
-                dkr_pull_report_progress(i, DKR_METADATA);
-
-                url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v1/images/", i->id, "/ancestry");
-                r = pull_job_new(&i->ancestry_job, url, i->glue, i);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to allocate ancestry job: %m");
-                        goto finish;
-                }
-
-                r = dkr_pull_add_token(i, i->ancestry_job);
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-
-                i->ancestry_job->on_finished = dkr_pull_job_on_finished;
-                i->ancestry_job->on_progress = dkr_pull_job_on_progress;
-
-                url = strjoina(PROTOCOL_PREFIX, i->response_registries[0], "/v1/images/", i->id, "/json");
-                r = pull_job_new(&i->json_job, url, i->glue, i);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to allocate json job: %m");
-                        goto finish;
-                }
-
-                r = dkr_pull_add_token(i, i->json_job);
-                if (r < 0) {
-                        log_oom();
-                        goto finish;
-                }
-
-                i->json_job->on_finished = dkr_pull_job_on_finished;
-                i->json_job->on_progress = dkr_pull_job_on_progress;
-
-                r = pull_job_begin(i->ancestry_job);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to start ancestry job: %m");
-                        goto finish;
-                }
-
-                r = pull_job_begin(i->json_job);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to start json job: %m");
-                        goto finish;
-                }
-
-        } else if (i->ancestry_job == j) {
-                char **ancestry = NULL, **k;
-                unsigned n;
-
-                assert(!i->layer_job);
-
-                r = parse_ancestry(j->payload, j->payload_size, &ancestry);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to parse JSON id.");
-                        goto finish;
-                }
-
-                n = strv_length(ancestry);
-                if (n <= 0 || !streq(ancestry[n-1], i->id)) {
-                        log_error("Ancestry doesn't end in main layer.");
-                        strv_free(ancestry);
-                        r = -EBADMSG;
-                        goto finish;
-                }
-
-                log_info("Ancestor lookup succeeded, requires layers:\n");
-                STRV_FOREACH(k, ancestry)
-                        log_info("\t%s", *k);
-
-                strv_free(i->ancestry);
-                i->ancestry = ancestry;
-                i->n_ancestry = n;
-                i->current_ancestry = 0;
-
-                dkr_pull_report_progress(i, DKR_DOWNLOADING);
-
-                r = dkr_pull_pull_layer(i);
-                if (r < 0)
-                        goto finish;
-
-        } else if (i->layer_job == j) {
-                assert(i->temp_path);
-                assert(i->final_path);
-
-                j->disk_fd = safe_close(j->disk_fd);
-
-                if (i->tar_pid > 0) {
-                        r = wait_for_terminate_and_warn("tar", i->tar_pid, true);
-                        i->tar_pid = 0;
-                        if (r < 0)
-                                goto finish;
-                }
-
-                r = aufs_resolve(i->temp_path);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to resolve aufs whiteouts: %m");
-                        goto finish;
-                }
-
-                r = btrfs_subvol_set_read_only(i->temp_path, true);
-                if (r < 0) {
-                        log_error_errno(r, "Failed to mark snapshot read-only: %m");
-                        goto finish;
-                }
-
-                if (rename(i->temp_path, i->final_path) < 0) {
-                        log_error_errno(errno, "Failed to rename snaphsot: %m");
-                        goto finish;
-                }
-
-                log_info("Completed writing to layer %s.", i->final_path);
-
-                i->layer_job = pull_job_unref(i->layer_job);
-                i->temp_path = mfree(i->temp_path);
-                i->final_path = mfree(i->final_path);
-
-                i->current_ancestry ++;
-                r = dkr_pull_pull_layer(i);
-                if (r < 0)
-                        goto finish;
-
-        } else if (i->json_job != j)
-                assert_not_reached("Got finished event for unknown curl object");
-
-        if (!dkr_pull_is_done(i))
-                return;
-
-        dkr_pull_report_progress(i, DKR_COPYING);
-
-        r = dkr_pull_make_local_copy(i, DKR_PULL_V1);
-        if (r < 0)
-                goto finish;
-
-        r = 0;
-finish:
-        if (i->on_finished)
-                i->on_finished(i, r, i->userdata);
-        else
-                sd_event_exit(i->event, r);
-}
-
-static int get_protocol_address(char **protocol, char **address, const char *url) {
-        const char *sep, *dot;
-        _cleanup_free_ char *a = NULL, *p = NULL;
-
-        sep = strstr(url, "://");
-        if (!sep)
-                return -EINVAL;
-
-        dot = strrchr(url, '.');
-        if (!dot)
-                return -EINVAL;
-        dot--;
-
-        p = strndup(url, (sep - url) + 3);
-        if (!p)
-                return log_oom();
-
-        while (dot > (sep + 3) && *dot != '.')
-                dot--;
-
-        a = strdup(dot + 1);
-        if (!a)
-                return log_oom();
-
-        *address = a;
-        *protocol = p;
-        a = p = NULL;
-
-        return 0;
-}
-
-int dkr_pull_start(DkrPull *i, const char *name, const char *reference, const char *local, bool force_local, DkrPullVersion version) {
-        const char *url;
-        int r;
-
-        assert(i);
-
-        if (!dkr_name_is_valid(name))
-                return -EINVAL;
-
-        if (reference && !dkr_ref_is_valid(reference))
-                return -EINVAL;
-
-        if (local && !machine_name_is_valid(local))
-                return -EINVAL;
-
-        if (i->images_job)
-                return -EBUSY;
-
-        if (!reference)
-                reference = "latest";
-
-        free(i->index_protocol);
-        free(i->index_address);
-        r = get_protocol_address(&i->index_protocol, &i->index_address, i->index_url);
-        if (r < 0)
-                return r;
-
-        r = free_and_strdup(&i->local, local);
-        if (r < 0)
-                return r;
-        i->force_local = force_local;
-
-        r = free_and_strdup(&i->name, name);
-        if (r < 0)
-                return r;
-        r = free_and_strdup(&i->reference, reference);
-        if (r < 0)
-                return r;
-
-        url = strjoina(i->index_url, "/v1/repositories/", name, "/images");
-
-        r = pull_job_new(&i->images_job, url, i->glue, i);
-        if (r < 0)
-                return r;
-
-        r = dkr_pull_add_token(i, i->images_job);
-        if (r < 0)
-                return r;
-
-        if (version == DKR_PULL_V1)
-                i->images_job->on_finished = dkr_pull_job_on_finished;
-        else
-                i->images_job->on_finished = dkr_pull_job_on_finished_v2;
-
-        i->images_job->on_header = dkr_pull_job_on_header;
-        i->images_job->on_progress = dkr_pull_job_on_progress;
-
-        return pull_job_begin(i->images_job);
-}
diff --git a/src/import/pull-dkr.h b/src/import/pull-dkr.h
deleted file mode 100644
index a95d91205b..0000000000
--- a/src/import/pull-dkr.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
-
-/***
-  This file is part of systemd.
-
-  Copyright 2014 Lennart Poettering
-
-  systemd is free software; you can redistribute it and/or modify it
-  under the terms of the GNU Lesser General Public License as published by
-  the Free Software Foundation; either version 2.1 of the License, or
-  (at your option) any later version.
-
-  systemd is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  Lesser General Public License for more details.
-
-  You should have received a copy of the GNU Lesser General Public License
-  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-#pragma once
-
-#include "sd-event.h"
-
-#include "util.h"
-
-typedef enum { DKR_PULL_V1, DKR_PULL_V2 } DkrPullVersion;
-typedef struct DkrPull DkrPull;
-
-typedef void (*DkrPullFinished)(DkrPull *pull, int error, void *userdata);
-
-int dkr_pull_new(DkrPull **pull, sd_event *event, const char *index_url, const char *image_root, DkrPullFinished on_finished, void *userdata);
-DkrPull* dkr_pull_unref(DkrPull *pull);
-
-DEFINE_TRIVIAL_CLEANUP_FUNC(DkrPull*, dkr_pull_unref);
-
-int dkr_pull_start(DkrPull *pull, const char *name, const char *tag, const char *local, bool force_local, DkrPullVersion version);
diff --git a/src/import/pull.c b/src/import/pull.c
index fc93228a0b..e0631bdeaf 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -28,7 +28,6 @@
 #include "import-util.h"
 #include "machine-image.h"
 #include "parse-util.h"
-#include "pull-dkr.h"
 #include "pull-raw.h"
 #include "pull-tar.h"
 #include "signal-util.h"
@@ -39,7 +38,6 @@
 static bool arg_force = false;
 static const char *arg_image_root = "/var/lib/machines";
 static ImportVerify arg_verify = IMPORT_VERIFY_SIGNATURE;
-static const char* arg_dkr_index_url = DEFAULT_DKR_INDEX_URL;
 static bool arg_settings = true;
 
 static int interrupt_signal_handler(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
@@ -220,114 +218,6 @@ static int pull_raw(int argc, char *argv[], void *userdata) {
         return -r;
 }
 
-static void on_dkr_finished(DkrPull *pull, int error, void *userdata) {
-        sd_event *event = userdata;
-        assert(pull);
-
-        if (error == 0)
-                log_info("Operation completed successfully.");
-
-        sd_event_exit(event, abs(error));
-}
-
-static int pull_dkr(int argc, char *argv[], void *userdata) {
-        _cleanup_(dkr_pull_unrefp) DkrPull *pull = NULL;
-        _cleanup_(sd_event_unrefp) sd_event *event = NULL;
-        const char *name, *reference, *local, *digest;
-        int r;
-
-        if (!arg_dkr_index_url) {
-                log_error("Please specify an index URL with --dkr-index-url=");
-                return -EINVAL;
-        }
-
-        if (arg_verify != IMPORT_VERIFY_NO) {
-                log_error("Pulls from dkr do not support image verification, please pass --verify=no.");
-                return -EINVAL;
-        }
-
-        digest = strchr(argv[1], '@');
-        if (digest) {
-                reference = digest + 1;
-                name = strndupa(argv[1], digest - argv[1]);
-        } else {
-                reference = strchr(argv[1], ':');
-                if (reference) {
-                        name = strndupa(argv[1], reference - argv[1]);
-                        reference++;
-                } else {
-                        name = argv[1];
-                        reference = "latest";
-                }
-        }
-
-        if (!dkr_name_is_valid(name)) {
-                log_error("Remote name '%s' is not valid.", name);
-                return -EINVAL;
-        }
-
-        if (!dkr_ref_is_valid(reference)) {
-                log_error("Tag name '%s' is not valid.", reference);
-                return -EINVAL;
-        }
-
-        if (argc >= 3)
-                local = argv[2];
-        else {
-                local = strchr(name, '/');
-                if (local)
-                        local++;
-                else
-                        local = name;
-        }
-
-        if (isempty(local) || streq(local, "-"))
-                local = NULL;
-
-        if (local) {
-                if (!machine_name_is_valid(local)) {
-                        log_error("Local image name '%s' is not valid.", local);
-                        return -EINVAL;
-                }
-
-                if (!arg_force) {
-                        r = image_find(local, NULL);
-                        if (r < 0)
-                                return log_error_errno(r, "Failed to check whether image '%s' exists: %m", local);
-                        else if (r > 0) {
-                                log_error_errno(EEXIST, "Image '%s' already exists.", local);
-                                return -EEXIST;
-                        }
-                }
-
-                log_info("Pulling '%s' with reference '%s', saving as '%s'.", name, reference, local);
-        } else
-                log_info("Pulling '%s' with reference '%s'.", name, reference);
-
-        r = sd_event_default(&event);
-        if (r < 0)
-                return log_error_errno(r, "Failed to allocate event loop: %m");
-
-        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
-        (void) sd_event_add_signal(event, NULL, SIGTERM, interrupt_signal_handler,  NULL);
-        (void) sd_event_add_signal(event, NULL, SIGINT, interrupt_signal_handler, NULL);
-
-        r = dkr_pull_new(&pull, event, arg_dkr_index_url, arg_image_root, on_dkr_finished, event);
-        if (r < 0)
-                return log_error_errno(r, "Failed to allocate puller: %m");
-
-        r = dkr_pull_start(pull, name, reference, local, arg_force, DKR_PULL_V2);
-        if (r < 0)
-                return log_error_errno(r, "Failed to pull image: %m");
-
-        r = sd_event_loop(event);
-        if (r < 0)
-                return log_error_errno(r, "Failed to run event loop: %m");
-
-        log_info("Exiting.");
-        return -r;
-}
-
 static int help(int argc, char *argv[], void *userdata) {
 
         printf("%s [OPTIONS...] {COMMAND} ...\n\n"
@@ -338,12 +228,10 @@ static int help(int argc, char *argv[], void *userdata) {
                "     --verify=MODE            Verify downloaded image, one of: 'no',\n"
                "                              'checksum', 'signature'\n"
                "     --settings=BOOL          Download settings file with image\n"
-               "     --image-root=PATH        Image root directory\n"
-               "     --dkr-index-url=URL      Specify index URL to use for downloads\n\n"
+               "     --image-root=PATH        Image root directory\n\n"
                "Commands:\n"
                "  tar URL [NAME]              Download a TAR image\n"
-               "  raw URL [NAME]              Download a RAW image\n"
-               "  dkr REMOTE [NAME]           Download a DKR image\n",
+               "  raw URL [NAME]              Download a RAW image\n",
                program_invocation_short_name);
 
         return 0;
@@ -354,7 +242,6 @@ static int parse_argv(int argc, char *argv[]) {
         enum {
                 ARG_VERSION = 0x100,
                 ARG_FORCE,
-                ARG_DKR_INDEX_URL,
                 ARG_IMAGE_ROOT,
                 ARG_VERIFY,
                 ARG_SETTINGS,
@@ -364,7 +251,6 @@ static int parse_argv(int argc, char *argv[]) {
                 { "help",            no_argument,       NULL, 'h'                 },
                 { "version",         no_argument,       NULL, ARG_VERSION         },
                 { "force",           no_argument,       NULL, ARG_FORCE           },
-                { "dkr-index-url",   required_argument, NULL, ARG_DKR_INDEX_URL   },
                 { "image-root",      required_argument, NULL, ARG_IMAGE_ROOT      },
                 { "verify",          required_argument, NULL, ARG_VERIFY          },
                 { "settings",        required_argument, NULL, ARG_SETTINGS        },
@@ -390,15 +276,6 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_force = true;
                         break;
 
-                case ARG_DKR_INDEX_URL:
-                        if (!http_url_is_valid(optarg)) {
-                                log_error("Index URL is not valid: %s", optarg);
-                                return -EINVAL;
-                        }
-
-                        arg_dkr_index_url = optarg;
-                        break;
-
                 case ARG_IMAGE_ROOT:
                         arg_image_root = optarg;
                         break;
@@ -436,7 +313,6 @@ static int pull_main(int argc, char *argv[]) {
                 { "help", VERB_ANY, VERB_ANY, 0, help     },
                 { "tar",  2,        3,        0, pull_tar },
                 { "raw",  2,        3,        0, pull_raw },
-                { "dkr",  2,        3,        0, pull_dkr },
                 {}
         };
 
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index 0a01bd3e20..685bbafdf1 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -78,7 +78,6 @@ static unsigned arg_lines = 10;
 static OutputMode arg_output = OUTPUT_SHORT;
 static bool arg_force = false;
 static ImportVerify arg_verify = IMPORT_VERIFY_SIGNATURE;
-static const char* arg_dkr_index_url = NULL;
 static const char* arg_format = NULL;
 static const char *arg_uid = NULL;
 static char **arg_setenv = NULL;
@@ -2166,78 +2165,6 @@ static int pull_raw(int argc, char *argv[], void *userdata) {
         return transfer_image_common(bus, m);
 }
 
-static int pull_dkr(int argc, char *argv[], void *userdata) {
-        _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
-        const char *local, *remote, *tag;
-        sd_bus *bus = userdata;
-        int r;
-
-        if (arg_verify != IMPORT_VERIFY_NO) {
-                log_error("Imports from DKR do not support image verification, please pass --verify=no.");
-                return -EINVAL;
-        }
-
-        remote = argv[1];
-        tag = strchr(remote, ':');
-        if (tag) {
-                remote = strndupa(remote, tag - remote);
-                tag++;
-        }
-
-        if (!dkr_name_is_valid(remote)) {
-                log_error("DKR name '%s' is invalid.", remote);
-                return -EINVAL;
-        }
-        if (tag && !dkr_tag_is_valid(tag)) {
-                log_error("DKR tag '%s' is invalid.", remote);
-                return -EINVAL;
-        }
-
-        if (argc >= 3)
-                local = argv[2];
-        else {
-                local = strchr(remote, '/');
-                if (local)
-                        local++;
-                else
-                        local = remote;
-        }
-
-        if (isempty(local) || streq(local, "-"))
-                local = NULL;
-
-        if (local) {
-                if (!machine_name_is_valid(local)) {
-                        log_error("Local name %s is not a suitable machine name.", local);
-                        return -EINVAL;
-                }
-        }
-
-        r = sd_bus_message_new_method_call(
-                        bus,
-                        &m,
-                        "org.freedesktop.import1",
-                        "/org/freedesktop/import1",
-                        "org.freedesktop.import1.Manager",
-                        "PullDkr");
-        if (r < 0)
-                return bus_log_create_error(r);
-
-        r = sd_bus_message_append(
-                        m,
-                        "sssssb",
-                        arg_dkr_index_url,
-                        remote,
-                        tag,
-                        local,
-                        import_verify_to_string(arg_verify),
-                        arg_force);
-        if (r < 0)
-                return bus_log_create_error(r);
-
-        return transfer_image_common(bus, m);
-}
-
 typedef struct TransferInfo {
         uint32_t id;
         const char *type;
@@ -2452,9 +2379,7 @@ static int help(int argc, char *argv[], void *userdata) {
                "                              json-pretty, json-sse, cat)\n"
                "      --verify=MODE           Verification mode for downloaded images (no,\n"
                "                              checksum, signature)\n"
-               "      --force                 Download image even if already exists\n"
-               "      --dkr-index-url=URL     Specify the index URL to use for DKR image\n"
-               "                              downloads\n\n"
+               "      --force                 Download image even if already exists\n\n"
                "Machine Commands:\n"
                "  list                        List running VMs and containers\n"
                "  status NAME...              Show VM/container details\n"
@@ -2486,7 +2411,6 @@ static int help(int argc, char *argv[], void *userdata) {
                "Image Transfer Commands:\n"
                "  pull-tar URL [NAME]         Download a TAR container image\n"
                "  pull-raw URL [NAME]         Download a RAW container or VM image\n"
-               "  pull-dkr REMOTE [NAME]      Download a DKR container image\n"
                "  import-tar FILE [NAME]      Import a local TAR container image\n"
                "  import-raw FILE [NAME]      Import a local RAW container or VM image\n"
                "  export-tar NAME [FILE]      Export a TAR container image locally\n"
@@ -2510,7 +2434,6 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_NO_ASK_PASSWORD,
                 ARG_VERIFY,
                 ARG_FORCE,
-                ARG_DKR_INDEX_URL,
                 ARG_FORMAT,
                 ARG_UID,
                 ARG_SETENV,
@@ -2536,7 +2459,6 @@ static int parse_argv(int argc, char *argv[]) {
                 { "no-ask-password", no_argument,       NULL, ARG_NO_ASK_PASSWORD },
                 { "verify",          required_argument, NULL, ARG_VERIFY          },
                 { "force",           no_argument,       NULL, ARG_FORCE           },
-                { "dkr-index-url",   required_argument, NULL, ARG_DKR_INDEX_URL   },
                 { "format",          required_argument, NULL, ARG_FORMAT          },
                 { "uid",             required_argument, NULL, ARG_UID             },
                 { "setenv",          required_argument, NULL, ARG_SETENV          },
@@ -2650,15 +2572,6 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_force = true;
                         break;
 
-                case ARG_DKR_INDEX_URL:
-                        if (!http_url_is_valid(optarg)) {
-                                log_error("Index URL is invalid: %s", optarg);
-                                return -EINVAL;
-                        }
-
-                        arg_dkr_index_url = optarg;
-                        break;
-
                 case ARG_FORMAT:
                         if (!STR_IN_SET(optarg, "uncompressed", "xz", "gzip", "bzip2")) {
                                 log_error("Unknown format: %s", optarg);
@@ -2725,7 +2638,6 @@ static int machinectl_main(int argc, char *argv[], sd_bus *bus) {
                 { "export-raw",      2,        3,        0,            export_raw        },
                 { "pull-tar",        2,        3,        0,            pull_tar          },
                 { "pull-raw",        2,        3,        0,            pull_raw          },
-                { "pull-dkr",        2,        3,        0,            pull_dkr          },
                 { "list-transfers",  VERB_ANY, 1,        0,            list_transfers    },
                 { "cancel-transfer", 2,        VERB_ANY, 0,            cancel_transfer   },
                 { "set-limit",       2,        3,        0,            set_limit         },
diff --git a/src/shared/import-util.c b/src/shared/import-util.c
index 29ce732b56..ad400e8693 100644
--- a/src/shared/import-util.c
+++ b/src/shared/import-util.c
@@ -160,58 +160,6 @@ int raw_strip_suffixes(const char *p, char **ret) {
         return 0;
 }
 
-bool dkr_digest_is_valid(const char *digest) {
-        /* 7 chars for prefix, 64 chars for the digest itself */
-        if (strlen(digest) != 71)
-                return false;
-
-        return startswith(digest, "sha256:") && in_charset(digest + 7, "0123456789abcdef");
-}
-
-bool dkr_ref_is_valid(const char *ref) {
-        const char *colon;
-
-        if (isempty(ref))
-                return false;
-
-        colon = strchr(ref, ':');
-        if (!colon)
-                return filename_is_valid(ref);
-
-        return dkr_digest_is_valid(ref);
-}
-
-bool dkr_name_is_valid(const char *name) {
-        const char *slash, *p;
-
-        if (isempty(name))
-                return false;
-
-        slash = strchr(name, '/');
-        if (!slash)
-                return false;
-
-        if (!filename_is_valid(slash + 1))
-                return false;
-
-        p = strndupa(name, slash - name);
-        if (!filename_is_valid(p))
-                return false;
-
-        return true;
-}
-
-bool dkr_id_is_valid(const char *id) {
-
-        if (!filename_is_valid(id))
-                return false;
-
-        if (!in_charset(id, "0123456789abcdef"))
-                return false;
-
-        return true;
-}
-
 int import_assign_pool_quota_and_warn(const char *path) {
         int r;
 
diff --git a/src/shared/import-util.h b/src/shared/import-util.h
index 9120a5119f..4bfa2d9aae 100644
--- a/src/shared/import-util.h
+++ b/src/shared/import-util.h
@@ -42,10 +42,4 @@ ImportVerify import_verify_from_string(const char *s) _pure_;
 int tar_strip_suffixes(const char *name, char **ret);
 int raw_strip_suffixes(const char *name, char **ret);
 
-bool dkr_name_is_valid(const char *name);
-bool dkr_id_is_valid(const char *id);
-bool dkr_ref_is_valid(const char *ref);
-bool dkr_digest_is_valid(const char *digest);
-#define dkr_tag_is_valid(tag) filename_is_valid(tag)
-
 int import_assign_pool_quota_and_warn(const char *path);