CrazyMax 5cf302ff6e source: avoid unverified image config cache key ...

Stop using RootFS DiffIDs from the image config as an alternate image source
cache key. Those DiffIDs are verified only when the layer is applied, so a
failed malicious image pull must not poison cache lookup for another image
source.

This intentionally removes source-cache compatibility that depended on the
RootFS or ChainID fallback. Images that resolve to the same manifest-scoped
key remain compatible, but classic Moby local or manifest-less images and
images with different manifests can no longer match external BuildKit cache
solely because their root filesystems advertise the same DiffIDs.

Moby can verify a local ChainID through its classic layer store, but an
external BuildKit cannot verify remote-config DiffIDs before source cache
lookup. Using one key for both trust levels would reopen cache poisoning,
and the classic store may not retain a common manifest identity.

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit 101c4813fd4590506c571f466c55368275096432)
(cherry picked from commit a2dbb47c1534fa23b698c74329e1c22d731d75c2)

2026-09-30 15:12:23 +02:00

..

identifier_test.go

sourcepolicy: normalize parsed source identifiers

2026-07-22 11:36:47 +02:00

identifier.go

sourcepolicy: normalize parsed source identifiers

2026-07-22 11:36:47 +02:00

ocilayout.go

golangci-lint: v2 upgrade

2025-05-02 12:19:17 -07:00

pull.go

source: avoid unverified image config cache key

2026-09-30 15:12:23 +02:00

source.go

containerimage: preserve local fallback for default image resolution

2026-05-29 17:17:04 +02:00