FetchReferrers accepted FetchReferrersOpt but dropped them
when resolving OCI layout referrers. Forward the options and
apply ArtifactTypes filtering so callers can narrow results
consistently for both registry and local layout sources.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When pushing to an OCI layout where the top-level descriptor
blob already existed, pushOCILayout returned early without
updating index.json or writing pending referrers. Restructure
the control flow so the blob-exists case skips only the write
but still updates the index and flushes referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Handle OCI layout referrers via subject-annotated index entries and add
integration coverage for copying signed attestations through oci-layout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Enables fallback for DHI and Scout registries and
repo/scope specific credentials like supported for builds.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Persist attestation manifest and any manifest cosign-based
signatures when creating new images.
When creating index from single-arch manifests where attestation
manifest is not inlined, it can be loaded from referrers API.
Note that for this to work the attestation manifest needs to be
in artifact type when image was built.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit aab8171f824d13d703e869107e1720ad71d24bff)
Allows specifying platforms that should be included
in the new image, making it possible to reduce platforms
of existing multi-arch image. Previously the individual
image manifests needed to be used as sources, but that
dropped their related attestation manifests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This is not supported by the Authorizer from containerd and
needs to be added manually. Build authentication happens through
BuildKit session that already supports this.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Ensure only the final manifest is pushed by tag and intermediate
blobs are only pushed by digest to avoid tag temorarily pointing to
wrong image.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This package has moved to a separate module. Also added linting
rules to prevent accidental reintroduction.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This extracts the same logic for parsing annotations from the imagetools
create command, and allows the same flags to be attached to the build
command.
These annotations are then merged into all provided exporters.
Signed-off-by: Justin Chadwell <me@jedevc.com>
When using imagetools create and combining multiple sources
we should check the media type of each manifest and set
the right media type for the manifest list.
If there is a mismatch we set OCI index as best effort.
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
To give us the option later down the road of producing recommended OCI
names in BuildKit (using com instead of vnd, woops), we need to update
Buildx to be able to process both.
Ideally, if a Buildx/BuildKit release hadn't been made we could just
switch over, but since we have, we'd need to support both (at least for
a while, eventually we could consider deprecating+removing the vnd
variant).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Delay loading the attestation data immediately, and only compute it upon
request. We do this using a deferred function which allows to define the
computation in the same place as before, but perform the computation
later.
With this patch, we ensure that the attestation data is only pulled from
the remote if it is actually referenced in the format string -
otherwise, we can skip it, for improved performance.
Signed-off-by: Justin Chadwell <me@jedevc.com>
This refactor ensures that the attestations are not output in the JSON
output for "{{ json . }}", and additionally allows future refactors to
dynamically load the attestation contents, ensuring faster performance
when attestations are not used in the output.
Signed-off-by: Justin Chadwell <me@jedevc.com>
Tonis Tiigi