Miloslav Trmač

Improve enforcement of destination digest references on copy

1

`skopeo copy --all docker://$src@$digest docker://$dest@$digest` does not set `canModifyManifestList` to `false`, so the copy will try to send a modified manifest to the registry. This is easiest to reproduce by...

Decide on a `dir:` compatibility guarantee, if any, and a format transition plan, if any

10

`dir:` started as a debugging / scripting tool, and has, per https://github.com/containers/image/blob/main/docs/containers-transports.5.md#dirpath , basically no guarantees. Meanwhile, we are recommending `dir:` as a transport format (second best after using a...

In fact, `dirImageSource` doesn’t access `ref.versionPath` at all. This means we wouldn’t reject future incompatible versions — OTOH enforcing a version number could plausibly break existing scripts that manually generate...

Sigstore technical debt

2

Captured from PRs - [x] Writes to quay.io currently (Oct 13 2022) fail with HTTP status 500 - [ ] Unit tests for #1595 , at least the config file...

See the `FIXME FIXME` comment in tests added by https://github.com/containers/image/pull/1776 . - GPGME_DEBUG=9 shows that a `gpgme_op_verify` hangs permanently polling on an already closed file descriptor - That polling never...

i.e. it can’t process images with currently-unknown format IDs at all. We should add some kind of `internal/signature.Unknown` implementation that preserves the blob without interpreting it, to allow copying and...

Writing a signed image to docker:// makes it temporarily visible unsigned

1

The expected sequence of operations for an `ImageDestination` is `PutManifest` first, then `PutSignatures{,WithFormat}`, and `docker://` has the straightforward implementation. That means that when pushing to a tag, the tag points...

When copying, create all progress bars in advance

1

Per https://github.com/containers/image/pull/1530#pullrequestreview-954602860 : > Something I would love to see in the UX is to draw all progress bars before pulling. Currently, a bar is drawn the moment we start...

pkg/docker/config.GetAllCredentials should add more context to errors

3

Per https://github.com/containers/podman/issues/11636 , any errors reading specific credentials should be accompanied with an identification of that credential. (Also check if we need to do that for _any_ credential helper errors;...

Implement a registry:// alias for docker://

3

Concerns: - Need to ensure the configuration in `policy.json` is not ambiguous; that ambiguity check currently exists at transport-level, this requires some kind of merging. - The `//` are ugly...