Bug 1779353

Summary: Verify outgoing manifests when uploading or creating new manifests
Product: OpenShift Container Platform Reporter: Clayton Coleman <ccoleman>
Component: ocAssignee: Clayton Coleman <ccoleman>
Status: CLOSED ERRATA QA Contact: zhou ying <yinzhou>
Severity: high Docs Contact:
Priority: unspecified    
Version: 4.3.0CC: aos-bugs, eparis, jokerman, mfojtik, yinzhou
Target Milestone: ---   
Target Release: 4.3.z   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1779351
: 1779355 (view as bug list) Environment:
Last Closed: 2020-02-25 06:17:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1779351    
Bug Blocks: 1779355    

Description Clayton Coleman 2019-12-03 19:52:17 UTC
+++ This bug was initially created as a clone of Bug #1779351 +++

To better catch failures due to misbehaving or faulty registries, the verifying manifest service used by image and release tooling should verify outgoing manifests (as well as incoming manifests) by digest.

This is acceptable now that we require schema2 container image registry support for our release tooling, and helps close another possible failure point by verifying what we send matches what the server tells us it gets.

Comment 2 zhou ying 2019-12-23 05:53:41 UTC
Above library-go PR is not bumped into the latest oc client:
[root@dhcp-140-138 Doc]# oc version -o yaml 
  buildDate: "2019-12-20T11:26:44Z"
  compiler: gc
  gitCommit: 6a937dfe56ff26255d09702c69b8406040c14505
  gitTreeState: clean
  gitVersion: v4.3.0
  goVersion: go1.12.12
  major: ""
  minor: ""
  platform: linux/amd64

[root@dhcp-140-138 oc]# git checkout -b 2019-12-20 6a937dfe56ff26255d09702c69b8406040c14505
Switched to a new branch '2019-12-20'
[root@dhcp-140-138 library-go]# cd pkg/image/registryclient/
[root@dhcp-140-138 registryclient]# vi client.go   ## check above library-go PR's diff files, the diff file not found in latest "6a937dfe56ff26255d09702c69b8406040c14505"

Comment 3 Eric Paris 2020-01-07 01:12:33 UTC
If we rebase oc before 4.3.0 that's fine, but we won't block the release on this. As such I'm targeting 4.3.z so we focus on getting out the door.

Comment 6 zhou ying 2020-02-13 05:24:11 UTC
RF https://bugzilla.redhat.com/show_bug.cgi?id=1779351#c3, will verify it.

Comment 8 errata-xmlrpc 2020-02-25 06:17:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.