Reuse a single ingester per target repository when imagetools create
copies multiple manifests in parallel.
This lets the pushing ingester serialize same-digest pushes and avoids
racing duplicate blob uploads against registries to work around bug in
Registry v3.0.0 (and possibly others).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This refines the check for determining whether exec will succeed to work
when an error occurs. This check previously relied on the `Ref` being
populated in the result context but this would only happen if we were
paused from a breakpoint or by stepping. An error would not fill in this
field.
The check is now refined to use the new gateway filesystem exec API so
we can create the container and then check even if we don't have a
returned gateway reference. The logic to determine which mount to check
has also been moved.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
FetchReferrers accepted FetchReferrersOpt but dropped them
when resolving OCI layout referrers. Forward the options and
apply ArtifactTypes filtering so callers can narrow results
consistently for both registry and local layout sources.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When pushing to an OCI layout where the top-level descriptor
blob already existed, pushOCILayout returned early without
updating index.json or writing pending referrers. Restructure
the control flow so the blob-exists case skips only the write
but still updates the index and flushes referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Handle OCI layout referrers via subject-annotated index entries and add
integration coverage for copying signed attestations through oci-layout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify imagetools copies signatures only for attestation manifests and
does not copy image-manifest signatures or unsupported referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This workflow doesn't provide much value. It mostly fails on temporary
errors regarding vagrant and doesn't provide a very useful signal that
the build is broken.
We perform cross-compilation and ensure `buildx` still compiles on
different bsd variants. That should be enough to make sure we don't
inadvertently break something.
Closes#3711.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
We erroneously skipped a breakpoint when that breakpoint was the same as
the entrypoint and we did not use stop on entry. This is because we only
started evaluating breakpoints after the first step on the entrypoint
instead of at the entrypoint.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Add integration coverage for imagetools create --file and verify a
descriptor read from disk resolves to the expected copied manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --append and verify the
target is rewritten as a two-platform manifest list.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --platform on an attested
multi-platform image and verify only the matching attestation remains.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify copied index content keeps the same digest and descriptor metadata.
Add function comments to clarify each imagetools integration test case.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Skip the load build context step when it doesn't have an associated
source line. This caused an extra branch to be created in an otherwise
pretty straightforward dockerfile where stepping in on a copy
instruction that used the context would stay on the same line because it
"stepped into" the context loading rather than being treated the same as
step next.
This resulted in some bad and confusing ergonomics with the cursor
position that were a bit confusing and unexpected.
There might be more areas to try and prune but the most common one, a
single branch instruction that doesn't have a location, now gets skipped
which is the exact thing that was generated for loading the context.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
The context used for serving the dap server was being canceled too early
because it used defer which would initiate at the end of the function
while every other cleanup function used `t.Cleanup` which executes in
its own goroutine.
One possible solution was to move the cancel to the cleanup, but the
context being passed to serve and start doesn't make sense because if it
ever does get canceled, it'll likely cause a similar race condition with
`Stop`.
This removes the context from the methods that were causing this issue
in favor of just relying on the caller calling `Stop` when they are done
with the adapter and server.
This seems to have only affected tests and I don't believe it affected
the actual dap command.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Properly map the source paths from the metadata in the solve to the
client side paths. The source path returns is relative to the context
that gets uploaded which is usually a subdirectory. The original code
noticed this when mapping the paths but made the invalid assumption that
the dockerfile would always be in the context path so it combined the
dockerfile name with the context path.
It is possible for the dockerfile to be in a subdirectory of the
context. In which case, we computed the paths incorrectly.
This modifies DAP to instead use the `DockerfileMappingDst` and
`DockerfileMappingSrc` which are special included variables to the
inputs that get filled in during the build for the purpose of mapping
the source path to the client side path.
Tests have also been added for this functionality to ensure it doesn't
break again. This should work with both absolute and relative paths
although absolute paths should probably be preferred for usage just
because they're less likely to result in weird things happening.
The sources are also normalized to always convert the source filenames
to absolute paths and DAP itself will accept relative paths but will
only ever communicate in absolute paths. When you set a breakpoint, it
will convert it to an absolute path and reference it in that way rather
than a relative path.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
