chore: detect deprecated manifest v2 schema 1 (closes #2)

README.md

@@ -183,6 +183,12 @@ First, Prometheus and Grafana need to be installed in your cluster.
 
 Then it's easy to [create alerts](grafana#creating-alerts) using the provided [Grafana dashboard](grafana)
 
+### Why my image cannot be signed? (manifest v2 schema 1)
+
+The image manifest v2 schema 1 format is [deprecated](https://docs.docker.com/engine/deprecated/#pushing-and-pulling-with-image-manifest-v2-schema-1) in favor of the v2 schema 2 format.
+
+Please, move to v2 schema 2 as soon as possible. Usually, you can fix that simply by pushing your image again on the registry.
+
 ### Cannot create resource "clusterrolebindings"
 
 Recent versions of Kubernetes employ a [role-based access control](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) (or RBAC) system to drive authorization decisions. It might be possible that your account does not have enough privileges to create the `ClusterRole` needed to get cluster-wide access.

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/btcsuite/btcd v0.0.0-20190629003639-c26ffa870fd8 // indirect
 	github.com/ethereum/go-ethereum v1.8.27 // indirect
 	github.com/golang/snappy v0.0.1 // indirect
-	github.com/google/go-containerregistry v0.0.0-20190531175139-2687bd5ba651
+	github.com/google/go-containerregistry v0.0.0-20190828024420-cba75e9e5208
 	github.com/google/uuid v1.1.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.9.3 // indirect
 	github.com/karalabe/hid v1.0.0 // indirect

go.sum

@@ -125,8 +125,8 @@ github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-containerregistry v0.0.0-20190531175139-2687bd5ba651 h1:hYhlBjVCLlkgDMRa1wE1JB3ObGUj9OZjQu4b9xtythQ=
-github.com/google/go-containerregistry v0.0.0-20190531175139-2687bd5ba651/go.mod h1:yZAFP63pRshzrEYLXLGPmUt0Ay+2zdjmMN1loCnRLUk=
+github.com/google/go-containerregistry v0.0.0-20190828024420-cba75e9e5208 h1:zV89afNTuJnTLCRgAoID/cMykimhGLJu3y8G+1zexPw=
+github.com/google/go-containerregistry v0.0.0-20190828024420-cba75e9e5208/go.mod h1:yZAFP63pRshzrEYLXLGPmUt0Ay+2zdjmMN1loCnRLUk=
 github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf h1:+RRA9JqSOZFfKrOeqr2z77+8R2RKyh8PG66dcu1V0ck=

pkg/image/resolve.go

@@ -38,6 +38,9 @@ func image(imageRef string, keychain authn.Keychain) (containerregistry.Image, e
 func configDigest(imageRef string, keychain authn.Keychain) (string, error) {
 	img, err := image(imageRef, keychain)
 	if err != nil {
+		if _, ok := err.(*remote.ErrSchema1); ok {
+			return "", fmt.Errorf("image manifest v2 schema 1 is deprecated: %s", imageRef)
+		}
 		return "", fmt.Errorf("reading image %s: %v", imageRef, err)
 	}
 
@@ -69,7 +72,8 @@ func configDigest(imageRef string, keychain authn.Keychain) (string, error) {
 //
 // Note:
 //  - only sha256 digests are supported
-//  - Docker Manifest v1 is not yet supported, see:
+//  - Docker Manifest v2 Schema 1 is deprecated and not supported anymore, see:
+//  - https://docs.docker.com/engine/deprecated/#pushing-and-pulling-with-image-manifest-v2-schema-1
 //    https://github.com/google/go-containerregistry/blob/master/pkg/v1/remote/descriptor.go#L111
 //    https://github.com/google/go-containerregistry/issues/377
 func Resolve(imageID string, keychain authn.Keychain) (string, error) {