Comments (3)
This issue might help other people to reduce time spent on investigation.
yeah, i was even considering at some point just blocking use of quay.io without explicit ImageOverrides. not sure if thats too much.
As a side note, I think it worth keeping dependencies somewhat up-to-date at least for security reasons.
i typically keep an eye on them and update if security related issues come up.
ill close this issue for now.
from kbld.
After looking through the code I found out that
kbld
uses outdated dependency for digest resolution. The wrong digest is calculated by taking sha256 from image's manifest, whereas the correct digest is being sent in headers by registry.
It was fixed in google/go-containerregistry.
Note the comment in the code in that change:
// If we can parse the digest from the header, and it's a signed schema 1
// manifest, let's use that for the digest to appease older registries.
quay.io has been "problematic" for various images. given that it seems that this is a quay.io implementation quirk and not part of the OCI registry spec, i am not too hot about changing kbld code that follows the spec. i hope it's not a huge problem for you.
from kbld.
Yes, I saw the comment.
It's not a problem for me, because of the workaround and we tend to store images in our own registries anyways, I used that image from quay.io only for testing purposes.
This issue might help other people to reduce time spent on investigation.
As a side note, I think it worth keeping dependencies somewhat up-to-date at least for security reasons.
Please, feel free to close the issue if you think so.
from kbld.
Related Issues (20)
- Ability to use specific platform when generating ImagesLock HOT 2
- Document how to use `kbld` with `kind`? HOT 4
- kbld appends duplicate preresolved origin HOT 3
- How to efficiently cache docker layer in CI with kbld? HOT 6
- kbld does not work with git error messages set to a different language HOT 3
- `kbld` resolve as a Go library
- Environment variable is passed with single quotes to pack and is not used HOT 2
- Is it possible to package images by themselves? HOT 5
- Ability to produce multi-arch images with Docker (image indexes/manifest lists) HOT 1
- simple-app-build-local example builds the same image twice HOT 2
- Add apko as a Builder HOT 4
- add railwayapp/nixpacks as a builder HOT 3
- [Guides] Building images with `KO` and `kbld` HOT 2
- Support jib for builds HOT 2
- kbld should be smart enough to see a Carvel tagSelection without additional work HOT 1
- release v0.36.0 HOT 1
- Keep original tag and only append sha256 digest HOT 7
- Containerd mess with kbld HOT 2
- keymatcher ignores path if name is set HOT 1
- kbld fails on `image:` field in Kyverno CRD HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kbld.