When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Persist attestation manifest and any manifest cosign-based
signatures when creating new images.
When creating index from single-arch manifests where attestation
manifest is not inlined, it can be loaded from referrers API.
Note that for this to work the attestation manifest needs to be
in artifact type when image was built.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit aab8171f824d13d703e869107e1720ad71d24bff)
Allows specifying platforms that should be included
in the new image, making it possible to reduce platforms
of existing multi-arch image. Previously the individual
image manifests needed to be used as sources, but that
dropped their related attestation manifests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Ensure only the final manifest is pushed by tag and intermediate
blobs are only pushed by digest to avoid tag temorarily pointing to
wrong image.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This package has moved to a separate module. Also added linting
rules to prevent accidental reintroduction.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This extracts the same logic for parsing annotations from the imagetools
create command, and allows the same flags to be attached to the build
command.
These annotations are then merged into all provided exporters.
Signed-off-by: Justin Chadwell <me@jedevc.com>
When using imagetools create and combining multiple sources
we should check the media type of each manifest and set
the right media type for the manifest list.
If there is a mismatch we set OCI index as best effort.
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
This patch modifies the existing combining code in imagetools create to
provide better support for multiple repositories down the road.
Specifically, the code should no longer rely on a single repository
being used for all sources and tags, and should resolve descriptors in
their relevant repositories.
Signed-off-by: Justin Chadwell <me@jedevc.com>
containerd pusher can’t handle this case atm so we
need to make sure we always create a new resolver
for each name.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi