Without a lease, the manifest may get be deleted by GC
before the SetGCLabels() gets called, causing "not found" error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Currently attestation chains were always loaded directly from
registry on each pull.
This adds cache capability to resolver so all the pulled manifests
are first pulled to content store and kept there with GC labels
references from the root manifest.
If blob or referrers request already exists in the content store
then local response is used without registry requests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Image manifest content is not needed for signature verification as
the verification is against the top index root. Still report
image manifest digest for more info about the reported attestation
subject but clients need to re-resolve it from the root manifest
for signature verification.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
ResolveImageConfig was changed to ResolveSourceMetadata long time
ago for cross-source implementation but the worker implementation
was still using old method name with conversions.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This allows images to be pulled by tag and then
checked against the digest. If digest is added directly
to the image reference, then tag is ignored.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This allows platforms following the new `platforms.FormatAll` function,
which allows for setting the `OSVersion` field of the platform with
`<os>(<ver>)/<arch>`.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Without this, a single ResolveImageConfig may emit many
"remotes.docker.resolver.HTTPRequest" spans. These can be difficult to
track and organize, especially if a single client performs multiple of
them.
To make traces a bit easier to navigate, these are now grouped under one
top-level span, instead of cluttering up the top-level.
Signed-off-by: Justin Chadwell <me@jedevc.com>
Switch to use github.com/containerd/platforms module, because containerd's
platforms package has moved to a separate module. This allows updating the
platforms parsing independent of the containerd module itself.
The package in containerd is deprecated, but kept as an alias to provide
compatibility between codebases.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is more versatile function that works for any source,
not just images.
It can be used together with a policy that switches
between input and output source as well as for adding
additional metadata for other sources in the future.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Trivially created by looking for every reference to .Variant and adding
OSVersion and OSFeatures, except the ones related to the string
representation of a Platform instance.
I then went through and ensured every assignment of OSFeatures that
might leak out, i.e., not local-only or for marhsalling purposes, uses
the append-to-nil idiom to avoid sharing the slice storage and allowing
accidental mutation after-the-fact.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
Sources are a pretty neat extension point, except there are a few code
paths that hard-code against each type. This moves code around and
adjusts interfaces so that Source implementations are self-contained and
merely need to be registered with the source.Manager.
Signed-off-by: Alex Suraci <suraci.alex@gmail.com>
