[registry api incompatibility] wrong digests for some images on quay.io (old registry) about kbld HOT 3 CLOSED

This issue might help other people to reduce time spent on investigation.

yeah, i was even considering at some point just blocking use of quay.io without explicit ImageOverrides. not sure if thats too much.

As a side note, I think it worth keeping dependencies somewhat up-to-date at least for security reasons.

i typically keep an eye on them and update if security related issues come up.

ill close this issue for now.

from kbld.

After looking through the code I found out that kbld uses outdated dependency for digest resolution. The wrong digest is calculated by taking sha256 from image's manifest, whereas the correct digest is being sent in headers by registry.
It was fixed in google/go-containerregistry.

Note the comment in the code in that change:

		// If we can parse the digest from the header, and it's a signed schema 1
		// manifest, let's use that for the digest to appease older registries.

quay.io has been "problematic" for various images. given that it seems that this is a quay.io implementation quirk and not part of the OCI registry spec, i am not too hot about changing kbld code that follows the spec. i hope it's not a huge problem for you.

from kbld.

Yes, I saw the comment.
It's not a problem for me, because of the workaround and we tend to store images in our own registries anyways, I used that image from quay.io only for testing purposes.

This issue might help other people to reduce time spent on investigation.

As a side note, I think it worth keeping dependencies somewhat up-to-date at least for security reasons.

Please, feel free to close the issue if you think so.

from kbld.