-
Notifications
You must be signed in to change notification settings - Fork 528
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Verify size in verify.ReadCloser #1044
Conversation
I'm tempted to have these be separate things because in some cases we don't know the size but we do know the digest (e.g. diffids and schema 1). |
That's reasonable. It doesn't look like we use |
Might still be useful to use the |
Codecov Report
@@ Coverage Diff @@
## main #1044 +/- ##
==========================================
+ Coverage 75.03% 75.13% +0.09%
==========================================
Files 107 107
Lines 5079 5083 +4
==========================================
+ Hits 3811 3819 +8
+ Misses 725 719 -6
- Partials 543 545 +2
Continue to review full report at Codecov.
|
I decided to verify using |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we want to validate config blob size as well?
go-containerregistry/pkg/v1/remote/image.go
Line 103 in 4c244d6
body, err := r.fetchBlob(r.context, m.Config.Digest) |
That'll be validated against the Content-Length at least. I'm not sure what to do if the descriptor size disagrees with the content-length header. Nothing would catch that with this version, but nothing would have caught it before either AFAIK. |
This prevents cases where a descriptor says it describes a 100-byte blob, but then serves 1TB blob, which could lead to resource exhaustion. Instead, we'll only read as many bytes as the descriptor claims there should be, and fail if the digest doesn't match after reading that many. This also verifies the content isn't shorter than described.
This adds a HEAD request to
remote.Layer
to fetch the size of the blob before reading and verifying it. If that's not acceptable we could work around it.