-
Notifications
You must be signed in to change notification settings - Fork 157
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Package create breaks when a cosign signature image exists in the package and in the cache #2591
Comments
I can say with relative confidence that crane is compressing the layer of the signature file that looks like below. Not sure what the logic is that determines which files should or should not be compressed. I believe the easiest solution is to skip putting layers in the cache if they are not from a container image. A few ideas
We are already planning to check if the config.mediaType == "application/vnd.oci.image.config.v1+json" in #1974 before putting an image in the cache for helm charts as OCI images, though that would do anything in the case of cosign signatures as they have the same config.mediaTypes as images. {
"critical": {
"identity": {
"docker-reference": "ghcr.io/stefanprodan/podinfo"
},
"image": {
"docker-manifest-digest": "sha256:57a654ace69ec02ba8973093b6a786faa15640575fbf0dbb603db55aca2ccec8"
},
"type": "cosign container image signature"
},
"optional": null
} |
This is the function to reproduce. First we write the image and populate the cache, then we delete the image so that on the next write crane will attempt to write again and pull from the cache. We will get the error
|
Fixes #2591 ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [ ] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md#developer-workflow) followed
Fixes #2591 ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [ ] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md#developer-workflow) followed Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
Environment
Device and OS: Ubuntu Linux (but pretty sure will happen with any OS)
App version: v0.34.0
Steps to reproduce
This will occur with any package that uses a cosign image such as
ghcr.io/stefanprodan/podinfo:sha256-57a654ace69ec02ba8973093b6a786faa15640575fbf0dbb603db55aca2ccec8.sig
Expected result
The package build will work fine
Actual Result
The package build fails with the following error
![image](https://private-user-images.githubusercontent.com/37223396/337325161-c2a39c18-8ff2-4b12-8bf0-354bba16d747.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0NTM4MzAsIm5iZiI6MTcyNDQ1MzUzMCwicGF0aCI6Ii8zNzIyMzM5Ni8zMzczMjUxNjEtYzJhMzljMTgtOGZmMi00YjEyLThiZjAtMzU0YmJhMTZkNzQ3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIzVDIyNTIxMFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNhMDk5ZTExOTdkZDU3ZmJlNmU4MWIxMGEyNDMwMzIzNGFlYzVjZDFmY2I4YTM1ZTdlM2JmOGM4ZDljYzE2MzMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.PT-oCEtC3c-bt-KPTx1PAaGz7NvwnQVx6GbMoaX6SAc)
Severity/Priority
Medium, while we have not yet heard of someone running into this we should fix this before the next release
By running
zarf tools clear-cache
this resolve the error (until the next run)The text was updated successfully, but these errors were encountered: