remove support for docker-typed manifests

internal/cli/publish_test.go

@@ -91,7 +91,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the image.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	want := "sha256:f09e60c2dabb44047225149ccc4a6cdffac23aabf50352931ddd618705e82f2d"
+	want := "sha256:80fafe63b2c370069deaabffd2d4505ffe7ef0b3a47032686c31dbcab5be25fd"
 	require.Equal(t, want, digest.String())
 
 	sdst := fmt.Sprintf("%s:%s.sbom", dst, strings.ReplaceAll(want, ":", "-"))
@@ -109,7 +109,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the SBOM.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	swant := "sha256:194bbad4bd7a37e206126b24d63fd0146434b1abbad9afa567fab364c0d5e608"
+	swant := "sha256:6d7ae8bf9f5f7a34553cda2dccb8a270db21770de545e87d14c27c992daf9b02"
 	require.Equal(t, swant, got)
 
 	im, err := idx.IndexManifest()

internal/cli/testdata/golden/index.json

@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:a87baa16c787394589606e2519134a8e23d9323f475cc3e1a6f63731e8579675","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:f5e87ab7f4eba7d7a649cd3fcb969b4fcb9c72784c9cbe7ed3f0f60e84933972","platform":{"architecture":"arm64","os":"linux"}}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:a87baa16c787394589606e2519134a8e23d9323f475cc3e1a6f63731e8579675","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:f5e87ab7f4eba7d7a649cd3fcb969b4fcb9c72784c9cbe7ed3f0f60e84933972","platform":{"architecture":"arm64","os":"linux"}}],"annotations":{"created":"1970-01-01T00:00:00Z"}}

internal/cli/testdata/golden/sboms/sbom-index.spdx.json

@@ -1,6 +1,6 @@
 {
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "sbom-sha256:d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
+  "name": "sbom-sha256:8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
   "spdxVersion": "SPDX-2.3",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
@@ -13,13 +13,13 @@
   "dataLicense": "CC0-1.0",
   "documentNamespace": "https://spdx.org/spdxdocs/apko/",
   "documentDescribes": [
-    "SPDXRef-Package-sha256-d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227"
+    "SPDXRef-Package-sha256-8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39"
   ],
   "packages": [
     {
-      "SPDXID": "SPDXRef-Package-sha256-d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
-      "name": "sha256:d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
-      "versionInfo": "sha256:d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
+      "SPDXID": "SPDXRef-Package-sha256-8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
+      "name": "sha256:8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
+      "versionInfo": "sha256:8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
       "filesAnalyzed": false,
       "description": "Multi-arch image index",
       "downloadLocation": "NOASSERTION",
@@ -29,13 +29,13 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227"
+          "checksumValue": "8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3Ad558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227?mediaType=application%2Fvnd.oci.image.index.v1%2Bjson",
+          "referenceLocator": "pkg:oci/golden@sha256%3A8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39?mediaType=application%2Fvnd.oci.image.index.v1%2Bjson",
           "referenceType": "purl"
         }
       ]
@@ -87,12 +87,12 @@
   ],
   "relationships": [
     {
-      "spdxElementId": "SPDXRef-Package-sha256-d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
+      "spdxElementId": "SPDXRef-Package-sha256-8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
       "relationshipType": "VARIANT_OF",
       "relatedSpdxElement": "SPDXRef-Package-sha256-a87baa16c787394589606e2519134a8e23d9323f475cc3e1a6f63731e8579675"
     },
     {
-      "spdxElementId": "SPDXRef-Package-sha256-d558b9114f2eaf11b1a3d9720cdcff3b12f087e741377d04f93bd5dc53f36227",
+      "spdxElementId": "SPDXRef-Package-sha256-8ee3652bfeecfcf3548eac1f0f1bfdf04ba0849e37979f83ffd5edc87d83ca39",
       "relationshipType": "VARIANT_OF",
       "relatedSpdxElement": "SPDXRef-Package-sha256-f5e87ab7f4eba7d7a649cd3fcb969b4fcb9c72784c9cbe7ed3f0f60e84933972"
     }

pkg/baseimg/base_image.go

@@ -24,7 +24,6 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/layout"
-	ocitypes "github.com/google/go-containerregistry/pkg/v1/types"
 
 	"chainguard.dev/apko/pkg/apk/apk"
 	"chainguard.dev/apko/pkg/build/types"
@@ -50,9 +49,7 @@ func getUnnestedImageIndex(imgPath string) (v1.ImageIndex, error) {
 		return nil, err
 	}
 	for _, m := range indexManifest.Manifests {
-		if m.MediaType == ocitypes.OCIImageIndex {
-			return index.ImageIndex(m.Digest)
-		}
+		return index.ImageIndex(m.Digest)
 	}
 	return index, nil
 }

pkg/build/oci/image.go

@@ -48,11 +48,6 @@ func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer
 		return nil, err
 	}
 
-	mediaType, err := layer.MediaType()
-	if err != nil {
-		return nil, fmt.Errorf("accessing layer MediaType: %w", err)
-	}
-	imageType := humanReadableImageType(mediaType)
 	log.Debug("building image from layer")
 
 	digest, err := layer.Digest()
@@ -65,8 +60,8 @@ func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer
 		return nil, fmt.Errorf("could not calculate layer diff id: %w", err)
 	}
 
-	log.Infof("%s layer digest: %v", imageType, digest)
-	log.Infof("%s layer diffID: %v", imageType, diffid)
+	log.Infof("layer digest: %v", digest)
+	log.Infof("layer diffID: %v", diffid)
 
 	adds := make([]mutate.Addendum, 0, 1)
 	adds = append(adds, mutate.Addendum{
@@ -79,14 +74,12 @@ func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer
 		},
 	})
 
-	if mediaType == ggcrtypes.OCILayer {
-		// If building an OCI layer, then we should assume OCI manifest and config too
-		baseImage = mutate.MediaType(baseImage, ggcrtypes.OCIManifestSchema1)
-		baseImage = mutate.ConfigMediaType(baseImage, ggcrtypes.OCIConfigJSON)
-	}
+	// If building an OCI layer, then we should assume OCI manifest and config too
+	baseImage = mutate.MediaType(baseImage, ggcrtypes.OCIManifestSchema1)
+	baseImage = mutate.ConfigMediaType(baseImage, ggcrtypes.OCIConfigJSON)
 	v1Image, err := mutate.Append(baseImage, adds...)
 	if err != nil {
-		return nil, fmt.Errorf("unable to append %s layer to empty image: %w", imageType, err)
+		return nil, fmt.Errorf("unable to append layer to empty image: %w", err)
 	}
 
 	annotations := ic.Annotations
@@ -101,13 +94,11 @@ func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer
 	}
 	annotations["org.opencontainers.image.created"] = created.Format(time.RFC3339)
 
-	if mediaType != ggcrtypes.DockerLayer && len(annotations) > 0 {
-		v1Image = mutate.Annotations(v1Image, annotations).(v1.Image)
-	}
+	v1Image = mutate.Annotations(v1Image, annotations).(v1.Image)
 
 	cfg, err := v1Image.ConfigFile()
 	if err != nil {
-		return nil, fmt.Errorf("unable to get %s config file: %w", imageType, err)
+		return nil, fmt.Errorf("unable to get config file: %w", err)
 	}
 
 	cfg = cfg.DeepCopy()
@@ -181,7 +172,7 @@ func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer
 
 	v1Image, err = mutate.ConfigFile(v1Image, cfg)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update %s config file: %w", imageType, err)
+		return nil, fmt.Errorf("unable to update config file: %w", err)
 	}
 
 	si := signed.Image(v1Image)

pkg/build/oci/index.go

@@ -46,39 +46,21 @@ func GenerateIndex(ctx context.Context, ic types.ImageConfiguration, imgs map[ty
 	_, span := otel.Tracer("apko").Start(ctx, "GenerateIndex")
 	defer span.End()
 
-	return generateIndexWithMediaType(ggcrtypes.OCIImageIndex, ic, imgs, created)
-}
-
-// GenerateDockerIndex generates a docker multi-arch manifest from the given imgs. The index type
-// will be "application/vnd.docker.distribution.manifest.list.v2+json".
-// The index is stored in memory.
-func GenerateDockerIndex(ctx context.Context, ic types.ImageConfiguration, imgs map[types.Architecture]oci.SignedImage, created time.Time) (name.Digest, oci.SignedImageIndex, error) {
-	return generateIndexWithMediaType(ggcrtypes.DockerManifestList, ic, imgs, created)
-}
-
-// generateIndexWithMediaType generates an index or docker manifest list from the given imgs. The index type
-// is provided by the `mediaType` parameter.
-func generateIndexWithMediaType(mediaType ggcrtypes.MediaType, ic types.ImageConfiguration, imgs map[types.Architecture]oci.SignedImage, created time.Time) (name.Digest, oci.SignedImageIndex, error) {
 	// If annotations are set and we're using the OCI mediaType, set annotations on the index.
-	annotations := map[string]string{}
-	if mediaType == ggcrtypes.OCIImageIndex {
-		annotations = ic.Annotations
-		if annotations == nil {
-			annotations = map[string]string{}
-		}
-		if ic.VCSUrl != "" {
-			if url, hash, ok := strings.Cut(ic.VCSUrl, "@"); ok {
-				annotations["org.opencontainers.image.source"] = url
-				annotations["org.opencontainers.image.revision"] = hash
-			}
+	annotations := map[string]string{
+		"created": created.Format(time.RFC3339),
+	}
+	if ic.VCSUrl != "" {
+		if url, hash, ok := strings.Cut(ic.VCSUrl, "@"); ok {
+			annotations["org.opencontainers.image.source"] = url
+			annotations["org.opencontainers.image.revision"] = hash
 		}
 	}
-	annotations["org.opencontainers.image.created"] = created.Format(time.RFC3339)
 
 	idx := signed.ImageIndex(
 		mutate.IndexMediaType(
 			mutate.Annotations(empty.Index, annotations).(v1.ImageIndex),
-			mediaType),
+			ggcrtypes.OCIImageIndex),
 	)
 	archs := make([]types.Architecture, 0, len(imgs))
 	for arch := range imgs {

pkg/build/sbom.go

@@ -28,7 +28,6 @@ import (
 	osr "github.com/dominodatalab/os-release"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
-	ggcrtypes "github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/sigstore/cosign/v2/pkg/oci"
 	"go.opentelemetry.io/otel"
 	khash "sigs.k8s.io/release-utils/hash"
@@ -63,7 +62,6 @@ func newSBOM(ctx context.Context, fsys apkfs.FullFS, o options.Options, ic types
 	sopt.ImageInfo.SourceDateEpoch = bde
 	sopt.Formats = o.SBOMFormats
 	sopt.ImageInfo.VCSUrl = ic.VCSUrl
-	sopt.ImageInfo.ImageMediaType = ggcrtypes.OCIManifestSchema1
 
 	sopt.OutputDir = o.TempDir()
 	if o.SBOMPath != "" {
@@ -194,8 +192,6 @@ func GenerateIndexSBOM(ctx context.Context, o options.Options, ic types.ImageCon
 	}
 	s.ImageInfo.IndexDigest = h
 
-	s.ImageInfo.IndexMediaType = ggcrtypes.OCIImageIndex
-
 	// Make sure we have a determinstic for iterating over imgs.
 	archs := make([]types.Architecture, 0, len(imgs))
 	for arch := range imgs {

pkg/sbom/generator/spdx/testdata/expected_image_sboms/custom-license.spdx.json

@@ -27,7 +27,7 @@
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/image?mediaType=\u0026os=linux",
+          "referenceLocator": "pkg:oci/image?mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
           "referenceType": "purl"
         }
       ]

pkg/sbom/generator/spdx/testdata/expected_image_sboms/no-supplier.spdx.json

@@ -27,7 +27,7 @@
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/image?mediaType=\u0026os=linux",
+          "referenceLocator": "pkg:oci/image?mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
           "referenceType": "purl"
         }
       ]

pkg/sbom/generator/spdx/testdata/expected_image_sboms/package-deduplicating.spdx.json

@@ -27,7 +27,7 @@
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/image?mediaType=\u0026os=linux",
+          "referenceLocator": "pkg:oci/image?mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
           "referenceType": "purl"
         }
       ]