-
Notifications
You must be signed in to change notification settings - Fork 43
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Store the whole Bundle.json and generate a Relocation map #58
Comments
cc @jcsirot @radu-matei @glyn @caervs @chris-crone WDYT? |
@silvin-lubecki neat! To be clear, the annotations that we have today would continue to exist, correct? Maybe this is a separate conversation for us @chris-crone and @simonferquel (and maybe I need to re-read the spec), but I'd like to better understand the motivation for referencing images in external repos in the |
@caervs absolutely, we don't change that part at all. The pushed OCI index is still the same with this proposal, only the config object changes. |
I've been thinking about this and I'm not sure how the original image name would be obtained when pulling from or relocating from a bundle stored in a repository unless it is captured when pushing the bundle to the repository (and stored in the repository). This issue crops up in the example above: where did |
@glyn I think we have everything we need in the OCI index, we have an annotation with the component name, so we can link it to the original component in the Does that make sense? Am I missing something? |
@silvin-lubecki Thanks. I understand now. I incorrectly assumed you were treating the original |
@caervs - the usage of annotations is still required, since an OCI index does not currently support a As to the second part of your question, it has to do the following workflow:
Constructing an image map that is used by runtimes (with the restriction that all images referenced in the image map must have the same digest with the original images) allows us to move bundles across registries (OCI compliant registries, that generate the same image digest for the same image) without invalidating the trust data generated when first building the bundle. Does that make sense? @silvin-lubecki, @glyn, @chris-crone - LGTM, I'm happy to pair sometime this / next week and go through the requirements and workflows one more time. |
@radu-matei happy to pair with you on this, let's schedule that on slack 👍 |
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
When a relocation map is generated from `cnab-to-oci` save it within the same directory as the `bundle.json` file. More information about reloaction map can be found in corresponding `cnab-to-oci` issue: cnabio/cnab-to-oci#58 The `bundle.Bundle` struct is now wrapped in a `relocated.Bundle` that will also contain the relocation map. Methods to fetch `bundle.json` and `relocation-map.json` as well as en entire bundle with the relocation map at once are moved to a `fetch` package to avoid dependency cycle. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
Context
During CNAB discussions about storing bundles into registry, some comments were raised about
cnab-to-oci
not storing the wholebundle.json
in the registry but only a subset, reconstructing it during apull
.Current behavior
When pushing a CNAB Bundle to a registry,
cnab-to-oci
produces the following:bundle.json
(see the type here (with mostly parameters, actions and credentials) and retrieve its digestEx:
bundle.json
likemetadata
(as annotations), or invocation/service imagesDuring the pull, we can reconstruct the
bundle.json
from the config object, the annotations and the images:This reconstruction was designed to tackle 2 things:
bundle.json
image references, and then to re-sign it, so moving would remove any guarantee seal. With this design moving an OCI index does not change anything, we can safely keep the signature.Proposal
Since this design was implemented, the Image Relocation has been added to the CNAB specifications.
We propose to leverage this new feature in the Bundle Runtime so:
cnab-to-oci
can then pull the originalbundle.json
.Ex of Relocation map:
This new design does not avoid annotation/metadata replication, but we think it is a minor issue, regarding the concern of storing a subset of the
bundle.json
.The text was updated successfully, but these errors were encountered: