Cache doesn't work when doing a signed push - normal?

[rlees85]

I just wanted to know if this is expected behaviour before raising a bug/issue.

If I have an image locally that I have built and then push it:

podman push my.registry/repo/image:tag

It uploads all the layers as expected.

If I immediately do the same:

podman push my.registry/repo/image:tag

Nothing uploads as "layer already exists", again as expected.

But if I do a push with --sign-by-sigstore-private-key /my/key.pem it will upload all the layers again from scratch. Subsequent pushes with signing always do the same thing, cache is never used.

Feels like a bug but just checking?

[rlees85]

The only difference in logging is when doing it with signing and debug logs enabled this gets printed a lot:

DEBU[0000] Trying to reuse blob with cached digest sha256:22e88c7d6da9b73fbb515ed6a8f6d133c680527a799e3069ca7ce346d90649b2 in destination repo with no location match, checking current repo

[Luap99]

cc @mtrmac

[mtrmac]

This is intentional: https://github.com/podman-container-tools/container-libs/blob/67ec80dfe59d7a714c919611ebf1992d4f795d90/image/copy/single.go#L176-L184

As the comment says, it may be too conservative, but it does mitigate some risks.

Exact copies (unlike a podman push which almost always tries to compress the image) should still be reusing layers.

So, if the two pushes are signing with the same key, podman push --sign-… $dest1; skopeo copy docker://$dest1 docker://$dest2 should reuse data as expected; if the two pushes use different signing keys, podman push $staging; for in in 1 2; do skopeo copy --sign=…${i} docker://$staging docker://$dest$i; done.

[rlees85]

Thanks, that makes sense. Since I am working with large images and its cloud so bandwidth is metered I'll probably stick to using cosign on the pushed image. It would have been nice to do it all in one step with Podman but I totally understand the reason for the behaviour, thanks for that.