Bug 1779353

Summary:	Verify outgoing manifests when uploading or creating new manifests
Product:	OpenShift Container Platform	Reporter:	Clayton Coleman <ccoleman>
Component:	oc	Assignee:	Clayton Coleman <ccoleman>
Status:	CLOSED ERRATA	QA Contact:	zhou ying <yinzhou>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	4.3.0	CC:	aos-bugs, eparis, jokerman, mfojtik, yinzhou
Target Milestone:	---
Target Release:	4.3.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1779351
Clones:	1779355 (view as bug list)		Environment:
Last Closed:	2020-02-25 06:17:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1779351
Bug Blocks:	1779355

Description Clayton Coleman 2019-12-03 19:52:17 UTC

+++ This bug was initially created as a clone of Bug #1779351 +++

To better catch failures due to misbehaving or faulty registries, the verifying manifest service used by image and release tooling should verify outgoing manifests (as well as incoming manifests) by digest.

This is acceptable now that we require schema2 container image registry support for our release tooling, and helps close another possible failure point by verifying what we send matches what the server tells us it gets.

Comment 2 zhou ying 2019-12-23 05:53:41 UTC

Above library-go PR is not bumped into the latest oc client:
[root@dhcp-140-138 Doc]# oc version -o yaml 
clientVersion:
  buildDate: "2019-12-20T11:26:44Z"
  compiler: gc
  gitCommit: 6a937dfe56ff26255d09702c69b8406040c14505
  gitTreeState: clean
  gitVersion: v4.3.0
  goVersion: go1.12.12
  major: ""
  minor: ""
  platform: linux/amd64


[root@dhcp-140-138 oc]# git checkout -b 2019-12-20 6a937dfe56ff26255d09702c69b8406040c14505
Switched to a new branch '2019-12-20'
[root@dhcp-140-138 library-go]# cd pkg/image/registryclient/
[root@dhcp-140-138 registryclient]# vi client.go   ## check above library-go PR's diff files, the diff file not found in latest "6a937dfe56ff26255d09702c69b8406040c14505"

Comment 3 Eric Paris 2020-01-07 01:12:33 UTC

If we rebase oc before 4.3.0 that's fine, but we won't block the release on this. As such I'm targeting 4.3.z so we focus on getting out the door.

Comment 6 zhou ying 2020-02-13 05:24:11 UTC

RF https://bugzilla.redhat.com/show_bug.cgi?id=1779351#c3, will verify it.

Comment 8 errata-xmlrpc 2020-02-25 06:17:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0528