Enforce manifest and blob digests in (skopeo inspect) and (skopeo layers) #2527
Conversation
== the HTTP response body. Signed-off-by: Miloslav Trmač <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>
mtrmac
force-pushed
the
enforce-digests
branch
from
ac014a3 to
0300612
Compare
| if err := retry.IfNecessary(ctx, func() error { | ||
| rawManifest, _, err = src.GetManifest(ctx, nil) |
There was a problem hiding this comment.
I have a dim memory we talked about this before but is there a reason why GetManifest does not verify by default? We're just talking about some small JSON so the overhead of sha256 on it has to be pretty small.
There was a problem hiding this comment.
There are ~11 implementations in c/image + several outside, added over time; trusting that all of them are going to do the right thing is hard to enforce.
The idea originally was that the transports only deal with “I/O” and centralized code in c/image, primarily c/image/copy, provides a single location where the enforcement provably happens.
That doesn’t really work with the various external ImageSource users… compare containers/image#2742 .
We might provide some other interface, but we can’t prevent direct calls to GetManifest without breaking the stable API.
Nobody should be using
skopeo layers.For
skopeo inspect, I could see an argument that it should return the data even if it does not match the digest, so that users can diagnose that. On balance, I think matching the expectation that digests are enforced is more valuable.