Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SHA-Bundle-Digest enchansement contains innacurate content #127

Open
ipanova opened this issue Feb 28, 2024 · 0 comments
Open

SHA-Bundle-Digest enchansement contains innacurate content #127

ipanova opened this issue Feb 28, 2024 · 0 comments

Comments

@ipanova
Copy link

ipanova commented Feb 28, 2024

I came across this PR operator-framework/operator-sdk#5567 and among its' motivation it mentions this EP https://github.com/operator-framework/enhancements/blob/master/enhancements/sha-bundle-digest.md
The content of which is not entirely accurate and should whether be corrected or completely removed to not misguide people.
If there are other places in documentation that refer to this content they also should be updated.

https://github.com/operator-framework/enhancements/blob/master/enhancements/sha-bundle-digest.md#appendix-a
This example does not reference an image manifest. It is an output of skopeo inspect command that behind the scenes parses actual manifest and extracts information from it. An image manifest looks like this https://github.com/opencontainers/image-spec/blob/main/manifest.md. It is a misconception that image manifest includes name and repo tags. It does NOT . It does not have image name included in its payload, nor repo tags and as consequence its' digest will not change with repo tag change either.

https://github.com/operator-framework/enhancements/blob/master/enhancements/sha-bundle-digest.md#motivation The motivation part needs to be re-worded. It still stands around the content security and reproducibility but not because with the name change changes digest ( which is not true because name is not part of manifest..) but because its tags nature. Tags are mutable and volatile and one cannot guarantee to pull same content twice because tag can point to some other image manifest in time , hence the user can receive completely other image.

I understand that this EP is 2y old, however things ought to be correct or better removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant