Skip to content

fix(handlers): serve OCI index payloads with no media type field

João Pereira requested to merge fix-list-no-type into master

Fixes Pulling an image index without a media type att... (#559 - closed).

How to test locally (you'll need a registry instance configured with HTTPS, as cosign doesn't want to talk with insecure registries):

echo 'a' > a
echo 'b' > b
tar -czvf a.tar.gz a
tar -czvf b.tar.gz b
# cosign will generate an index with no mediaType attribute
❯ cosign upload blob -f a.tar.gz:linux/amd64 -f b.tar.gz:darwin/arm64 registry.test:5000/jdrpereira/registry-test:latest
Uploading file from [a.tar.gz] to [registry.test:5000/jdrpereira/registry-test:latest] with media type [application/x-gzip]
File [a.tar.gz] is available directly at [registry.test:5000/v2/jdrpereira/registry-test/blobs/sha256:a4ad3d8e85222744d8bd010b2d25f614204db55a34d16b9d49eb3bb395172694]
Uploading file from [b.tar.gz] to [registry.test:5000/jdrpereira/registry-test:latest] with media type [application/x-gzip]
File [b.tar.gz] is available directly at [registry.test:5000/v2/jdrpereira/registry-test/blobs/sha256:e0eb384871db0a3af6899b483b18ec65a87b422796b779f6779dc82a4bbf3f4a]
Uploading multi-platform index to registry.test:5000/jdrpereira/registry-test@sha256:c4cb9b0539ff64787c78486acaaead06ca0d3681b79de29fef103f8eca012436
# this would fail without the fix
❯ crane manifest registry.test:5000/jdrpereira/registry-test:latest | jq
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 376,
      "digest": "sha256:d7ef8f7682c58e33735c4181d3442c1ce1951b32e359da3906b6a3ebdae331ac",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 376,
      "digest": "sha256:b71d74966e2bc31d4f40ba4e7dbace1db648009e95484071f9162aa522673dd1",
      "platform": {
        "architecture": "arm64",
        "os": "darwin"
      }
    }
  ]
}
Edited by João Pereira

Merge request reports