crane: AWS ECR SHA mismatch when pushing image tar vs direct copy

[adityavenneti]

Describe the bug

When using crane copy <dst> <src> the SHA of the image between source and destination in ECR matches. But when saving the image as a tar and pushing it to ECR the SHAs don't match. Why is this?

To Reproduce

go build ./cmd/crane/main.go

Follow this guide to pull the credentials: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html

// For this the SHA of the image between source and destination will match. Note that the regions are different.

./main copy <registryId>.dkr.ecr.us-west-1.amazonaws.com/<repo>:<image> <registryId>.dkr.ecr.us-east-2.amazonaws.com/<repo>:<imagetag>

// The SHA will not match. Note the regions are different.
./main pull <registryId>.dkr.ecr.us-west-1.amazonaws.com/<repo>:<image> <image>.tar
./main push ./<image>.tar <registryId>.dkr.ecr.us-east-2.amazonaws.com/<repo>:<image>

The underlying contents of the images don't change. I have verified this by examining the image layers using:

aws ecr batch-get-image --registry-id <registryId> --repository-name <repositoryName> --image-ids imageTag=<imagetag> --region <us-west-1|us-east-2>

Expected behavior

The SHA must match when puling the image as a tar file from repo 1 and then pushing it to destination repo 2.

Additional context

Add any other context about the problem here.

• Output of crane version : Tested using the latest code in main branch.
• Registry used ECR

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.