-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[registry api incompatibility] wrong digests for some images on quay.io (old registry) #19
Comments
Note the comment in the code in that change:
quay.io has been "problematic" for various images. given that it seems that this is a quay.io implementation quirk and not part of the OCI registry spec, i am not too hot about changing kbld code that follows the spec. i hope it's not a huge problem for you. |
Yes, I saw the comment. This issue might help other people to reduce time spent on investigation. As a side note, I think it worth keeping dependencies somewhat up-to-date at least for security reasons. Please, feel free to close the issue if you think so. |
yeah, i was even considering at some point just blocking use of quay.io without explicit ImageOverrides. not sure if thats too much.
i typically keep an eye on them and update if security related issues come up. ill close this issue for now. |
I bumped into the issue with quay.io/thanos/thanos:v0.8.1 (on the tags page, use filter by tag to find exactly that one).
kbld
resolves wrong digest for that image. I tested another one from quay.io (prometheus/node-exporter) and its digest was resolved correctly.Along with the tagged image I put another one with correct digest in the example below.
test.yaml:
After looking through the code I found out that
kbld
uses outdated dependency for digest resolution. The wrong digest is calculated by taking sha256 from image's manifest, whereas the correct digest is being sent in headers by registry.It was fixed in google/go-containerregistry.
Just updating dependency is not enough — API is changed and with the new version
kbld
can't be built anymore. Unfortunately, I have a little understanding of this project and can't rapidly fix the API usage.As a workaround I just use the correct digest instead of tag.
The text was updated successfully, but these errors were encountered: