Skopeo copy fails when image contains attestation manifest

[sjauld]

When images are built with buildx >= v0.10.0, an SLSA Provenance attestation is added. This causes skopeo copy to fail with the error

Error creating an updated image manifest: Error preparing updated manifest, layer \"sha256:<sha>\": unsupported MIME type for compression: application/vnd.in-toto+json

See https://github.com/docker/buildx/releases/tag/v0.10.0

[tyranron]

Have the same issue with my workflows: https://github.com/instrumentisto/rust-docker-image/actions/runs/3984656840/jobs/6831114769#step:6:50

[mtrmac]

Thanks for your report. What version of Skopeo is this? That’s not expected with ≥ 1.9.0 AFAICS.

If it happens with a recent version, please attach the complete output of skopeo --debug copy …

[sjauld]

Thanks @mtrmac. I was using the latest version in the Debian Bullseye repo, which is horrendously out of date. It works fine when I build the latest version myself.

@tyranron as another workaround I added --sbom=false --provenance=false to my docker build step - this enables me to still use Debain version of skopeo to copy the containers.

[tyranron]

@sjauld thanks for the workarounds!

[mtrmac]

@snowmanstark Please file a separate issue, include the specific version number of Skopeo, and the debug output per #1874 (comment) .

[stefan-cukl]

there's a new BUILDX_NO_DEFAULT_ATTESTATIONS env var which can now be used with buildx v0.10.4