Incorrect content-type returned from /referrers

[ktarplee]

Expected behavior and actual behavior:
The /referrers handler does not set the content-type to application/vnd.oci.image.index.v1+json. The distribution spec says:

Upon success, the response MUST be a JSON body with an image index containing a list of descriptors. The Content-Type header MUST be set to application/vnd.oci.image.index.v1+json.

Steps to reproduce the problem:
oras discover harbor.example.com/repo:tag --debug

You will see that the response from the /referrers call has a content-type set to application/json which is incorrect.

Versions:
Please specify the versions of following systems.

• harbor version: 2.9.1

The next version of oras will have this fix which means that the referrers API will not be detected by oras unless Harbor is corrected.

oras-project/oras-go#633

You can compare the response from Harbor to the response from Zot. Zot has the correct behavior.

[ktarplee]

I wanted to point out that the OCI distribution conformance tests do catch this issue.

OCI Distribution Conformance Tests Content Discovery Test content discovery endpoints (listing references) [It] GET request to nonexistent blob should result in empty 200 response
/home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:288

  [FAILED] Expected
      <string>: application/json; charset=utf-8
  to equal
      <string>: application/vnd.oci.image.index.v1+json
  In [It] at: /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:295

There are other issues as well with Harbor such as

Summarizing 8 Failures:
  [FAIL] OCI Distribution Conformance Tests Push Blob Upload Chunked [It] Out-of-order blob upload should return 416
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/02_push_test.go:182
  [FAIL] OCI Distribution Conformance Tests Push Blob Upload Chunked [It] Retry previous blob chunk should return 416
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/02_push_test.go:215
  [FAIL] OCI Distribution Conformance Tests Push Blob Upload Chunked [It] Get on stale blob upload should return 204 with a range and location
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/02_push_test.go:223
  [FAIL] OCI Distribution Conformance Tests Content Discovery Setup [It] References setup
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:131
  [FAIL] OCI Distribution Conformance Tests Content Discovery Test content discovery endpoints (listing references) [It] GET request to nonexistent blob should result in empty 200 response
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:295
  [FAIL] OCI Distribution Conformance Tests Content Discovery Test content discovery endpoints (listing references) [It] GET request to existing blob should yield 200
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:310
  [FAIL] OCI Distribution Conformance Tests Content Discovery Test content discovery endpoints (listing references) [It] GET request to existing blob with filter should yield 200
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:331
  [FAIL] OCI Distribution Conformance Tests Content Discovery Teardown [It] Delete created manifest & associated tags
  /home/ktarplee/code/github.com/opencontainers/distribution-spec/conformance/03_discovery_test.go:375

Ran 74 of 79 Specs in 37.139 seconds
FAIL! -- 66 Passed | 8 Failed | 0 Pending | 5 Skipped

[MinerYang]

Hi @ktarplee , thanks for the report.

This content-type conformance issue has been fixed in harbor v2.10 by #19212
And we also keep tracking and monitoring others across 2.10 and 2.11 until OCI spec 1.1 GA.

• [EPIC] Distribution spec v1.1 phase3(v2.10) #19173
• [EPIC] Distribution spec v1.1 phase4(v2.11) #19731

Will close this issue for now, if there's any further question, please reopen it. Appreciate!

Best,
Miner