When the debug thread was updated to always solve inputs from the
operation that it was tied to it became a bit overeager to evaluate
them. The intention of the steps is to have a single direct parent and
then potentially multiple "function calls" that can be evaluated with
step into and step out to leave.
With the change, that logic stayed in, but the inputs were always being
evaluated before they were stepped into or over. Now, when we construct
the steps, we also attach a list of inputs that we should defer
evaluation on to ensure we don't execute inputs that haven't been
executed yet.
It will then wrap the reference with a version that causes `Evaluate` to
do nothing. This prevents the overeager evaluation but allows the
reference to be evaluated if we need to read the filesystem.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Reuse a single ingester per target repository when imagetools create
copies multiple manifests in parallel.
This lets the pushing ingester serialize same-digest pushes and avoids
racing duplicate blob uploads against registries to work around bug in
Registry v3.0.0 (and possibly others).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This refines the check for determining whether exec will succeed to work
when an error occurs. This check previously relied on the `Ref` being
populated in the result context but this would only happen if we were
paused from a breakpoint or by stepping. An error would not fill in this
field.
The check is now refined to use the new gateway filesystem exec API so
we can create the container and then check even if we don't have a
returned gateway reference. The logic to determine which mount to check
has also been moved.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
FetchReferrers accepted FetchReferrersOpt but dropped them
when resolving OCI layout referrers. Forward the options and
apply ArtifactTypes filtering so callers can narrow results
consistently for both registry and local layout sources.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When pushing to an OCI layout where the top-level descriptor
blob already existed, pushOCILayout returned early without
updating index.json or writing pending referrers. Restructure
the control flow so the blob-exists case skips only the write
but still updates the index and flushes referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Handle OCI layout referrers via subject-annotated index entries and add
integration coverage for copying signed attestations through oci-layout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify imagetools copies signatures only for attestation manifests and
does not copy image-manifest signatures or unsupported referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This workflow doesn't provide much value. It mostly fails on temporary
errors regarding vagrant and doesn't provide a very useful signal that
the build is broken.
We perform cross-compilation and ensure `buildx` still compiles on
different bsd variants. That should be enough to make sure we don't
inadvertently break something.
Closes#3711.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
We erroneously skipped a breakpoint when that breakpoint was the same as
the entrypoint and we did not use stop on entry. This is because we only
started evaluating breakpoints after the first step on the entrypoint
instead of at the entrypoint.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Add integration coverage for imagetools create --file and verify a
descriptor read from disk resolves to the expected copied manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --append and verify the
target is rewritten as a two-platform manifest list.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --platform on an attested
multi-platform image and verify only the matching attestation remains.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify copied index content keeps the same digest and descriptor metadata.
Add function comments to clarify each imagetools integration test case.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
