Consider change of digests in tgt ref for image filtering

gardener · Nov 27, 2024 · 8121b73 · 8121b73
1 parent 8594916
commit 8121b73
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 3 deletions.
diff --git a/container/util.py b/container/util.py
@@ -113,8 +113,18 @@ def filter_image(
         manifest.manifests = patched_manifests
         manifest_dict = manifest.as_dict()
         manifest_raw = json.dumps(manifest_dict).encode('utf-8')
+
+        if target_ref.has_digest_tag:
+            # we need to recalculate digest since it may have changed due to filtering
+            manifest_digest = hashlib.sha256(manifest_raw).hexdigest()
+
+            if target_ref.has_mixed_tag:
+                target_ref = f'{target_ref.with_symbolical_tag}@sha256:{manifest_digest}'
+            else:
+                target_ref = f'{target_ref.ref_without_tag}@sha256:{manifest_digest}'
+
         res = oci_client.put_manifest(
-            image_reference=str(target_ref),
+            image_reference=target_ref,
             manifest=manifest_raw,
         )
 
@@ -157,6 +167,15 @@ def filter_image(
             manifest_list.as_dict(),
         ).encode('utf-8')
 
+        if target_ref.has_digest_tag:
+            # we need to recalculate digest since it may have changed due to filtering
+            manifest_digest = hashlib.sha256(manifest_list_bytes).hexdigest()
+
+            if target_ref.has_mixed_tag:
+                target_ref = f'{target_ref.with_symbolical_tag}@sha256:{manifest_digest}'
+            else:
+                target_ref = f'{target_ref.ref_without_tag}@sha256:{manifest_digest}'
+
         res = oci_client.put_manifest(
             image_reference=target_ref,
             manifest=manifest_list_bytes,

diff --git a/ctt/process_dependencies.py b/ctt/process_dependencies.py
@@ -403,7 +403,7 @@ def process_upload_request(
     logging.info(f'{oci_manifest_annotations=}')
 
     try:
-        _, _, raw_manifest = container.util.filter_image(
+        _, patched_tgt_ref, raw_manifest = container.util.filter_image(
             source_ref=src_ref,
             target_ref=tgt_ref,
             remove_files=upload_request.remove_files,
@@ -419,7 +419,10 @@ def process_upload_request(
         e.add_note(f'filter_image: {src_ref=} -> {tgt_ref=}')
         raise e
 
-    logger.info(f'finished processing {src_ref} -> {tgt_ref=}')
+    if tgt_ref != patched_tgt_ref:
+        logger.info(f'finished processing {src_ref} -> {patched_tgt_ref=} (initial {tgt_ref=})')
+    else:
+        logger.info(f'finished processing {src_ref} -> {tgt_ref=}')
 
     manifest_digest = hashlib.sha256(raw_manifest).hexdigest()
     uploaded_image_refs_to_digests[tgt_ref] = f'sha256:{manifest_digest}'