From 3fde7fd88844646161b4a5fbf94bc43181af27b5 Mon Sep 17 00:00:00 2001
From: Ralf Grubenmann <ralf.grubenmann@sdsc.ethz.ch>
Date: Thu, 26 Mar 2026 13:29:15 +0100
Subject: [PATCH] fix docker image validation on macos

---
 coman/src/cscs/handlers.rs | 18 +++++++++++++-----
 coman/src/util/types.rs    | 24 +++++++++++++++++++++---
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/coman/src/cscs/handlers.rs b/coman/src/cscs/handlers.rs
index a9d4244..2c3912a 100644
--- a/coman/src/cscs/handlers.rs
+++ b/coman/src/cscs/handlers.rs
@@ -859,12 +859,20 @@ pub async fn cscs_job_start(
                 None
             };
             let image_meta = if let Some(docker_image) = docker_image {
-                match docker_image.inspect().await {
-                    Ok(meta) => Some(meta),
-                    Err(e) => {
-                        println!("couldn't get image information: {e:?}");
-                        None
+                if let Some(system_info) = config.values.cscs.systems.get(current_system) {
+                    let mut meta = None;
+                    for arch in system_info.architecture.iter() {
+                        if let Ok(img_meta) = docker_image.inspect(arch).await {
+                            meta = Some(img_meta);
+                            break;
+                        }
                     }
+                    if meta.is_none() {
+                        println!("couldn't get image information, skipping checks");
+                    }
+                    meta
+                } else {
+                    None
                 }
             } else {
                 None
diff --git a/coman/src/util/types.rs b/coman/src/util/types.rs
index ede336f..a29fef5 100644
--- a/coman/src/util/types.rs
+++ b/coman/src/util/types.rs
@@ -16,10 +16,10 @@ use oci_client::{
     Client, Reference,
     client::{ClientConfig, ClientProtocol},
     config::ConfigFile,
-    manifest::OciManifest,
+    manifest::{ImageIndexEntry, OciManifest},
     secrets::RegistryAuth,
 };
-use oci_spec::image::Arch;
+use oci_spec::image::{Arch, Os};
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Hash, strum::Display)]
 pub enum OciPlatform {
@@ -79,9 +79,27 @@ impl DockerImageUrl {
         )
     }
 
-    pub async fn inspect(&self) -> Result<DockerImageMeta> {
+    pub async fn inspect(&self, arch: &str) -> Result<DockerImageMeta> {
+        let arch = match arch {
+            "arm64" => Arch::ARM64,
+            "amd64" => Arch::Amd64,
+            _ => {
+                return Err(eyre!("unsupported architecture {}", arch));
+            }
+        };
         let client = Client::new(ClientConfig {
             protocol: ClientProtocol::Https,
+            platform_resolver: Some(Box::new(move |manifests: &[ImageIndexEntry]| {
+                manifests
+                    .iter()
+                    .find(|entry| {
+                        entry
+                            .platform
+                            .as_ref()
+                            .is_some_and(|platform| platform.os == Os::Linux && platform.architecture == arch)
+                    })
+                    .map(|entry| entry.digest.clone())
+            })),
             ..Default::default()
         });
         let reference = self.to_string().parse()?;