Bug 1779353 - Verify outgoing manifests when uploading or creating new manifests
Summary: Verify outgoing manifests when uploading or creating new manifests
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 4.3.z
Assignee: Clayton Coleman
QA Contact: zhou ying
URL:
Whiteboard:
Depends On: 1779351
Blocks: 1779355
TreeView+ depends on / blocked
 
Reported: 2019-12-03 19:52 UTC by Clayton Coleman
Modified: 2020-02-25 06:18 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1779351
: 1779355 (view as bug list)
Environment:
Last Closed: 2020-02-25 06:17:59 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift library-go pull 626 0 None closed Bug 1779353: Verify outbound manifests now that schema1 support is dropped 2020-08-03 00:07:17 UTC
Github openshift oc pull 211 0 None closed Bug 1779353: Verify outbound manifests now that schema1 support is dropped 2020-08-03 00:07:17 UTC
Red Hat Product Errata RHBA-2020:0528 0 None None None 2020-02-25 06:18:12 UTC

Description Clayton Coleman 2019-12-03 19:52:17 UTC
+++ This bug was initially created as a clone of Bug #1779351 +++

To better catch failures due to misbehaving or faulty registries, the verifying manifest service used by image and release tooling should verify outgoing manifests (as well as incoming manifests) by digest.

This is acceptable now that we require schema2 container image registry support for our release tooling, and helps close another possible failure point by verifying what we send matches what the server tells us it gets.

Comment 2 zhou ying 2019-12-23 05:53:41 UTC
Above library-go PR is not bumped into the latest oc client:
[root@dhcp-140-138 Doc]# oc version -o yaml 
clientVersion:
  buildDate: "2019-12-20T11:26:44Z"
  compiler: gc
  gitCommit: 6a937dfe56ff26255d09702c69b8406040c14505
  gitTreeState: clean
  gitVersion: v4.3.0
  goVersion: go1.12.12
  major: ""
  minor: ""
  platform: linux/amd64


[root@dhcp-140-138 oc]# git checkout -b 2019-12-20 6a937dfe56ff26255d09702c69b8406040c14505
Switched to a new branch '2019-12-20'
[root@dhcp-140-138 library-go]# cd pkg/image/registryclient/
[root@dhcp-140-138 registryclient]# vi client.go   ## check above library-go PR's diff files, the diff file not found in latest "6a937dfe56ff26255d09702c69b8406040c14505"

Comment 3 Eric Paris 2020-01-07 01:12:33 UTC
If we rebase oc before 4.3.0 that's fine, but we won't block the release on this. As such I'm targeting 4.3.z so we focus on getting out the door.

Comment 6 zhou ying 2020-02-13 05:24:11 UTC
RF https://bugzilla.redhat.com/show_bug.cgi?id=1779351#c3, will verify it.

Comment 8 errata-xmlrpc 2020-02-25 06:17:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0528


Note You need to log in before you can comment on or make changes to this bug.