[sha512] image/manifest: Add DigestWithAlgorithm function
#499
Conversation
lsm5
force-pushed
the
digest-redux-manifest
branch
from
e1149c9 to
bdbac34
Compare
lsm5
changed the title
DigestWithAlgorithm functionDigestWithAlgorithm function
|
Packit jobs failed. @containers/packit-build please check. |
|
✅ A new PR has been created in buildah to vendor these changes: containers/buildah#6541 |
Add a new `manifest.DigestWithAlgorithm` function that allows computing the digest of a manifest using a specified algorithm (e.g., SHA256, SHA512) while properly handling v2s1 signed manifest signature stripping. This addresses the need for skopeo's `--manifest-digest` flag to support different digest algorithms while correctly handling all manifest types, particularly Docker v2s1 signed manifests that require signature stripping before digest computation. Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
lsm5
force-pushed
the
digest-redux-manifest
branch
from
bdbac34 to
d346c06
Compare
|
@containers/container-libs-maintainers could someone rerun the failing test please? |
|
also, is it possible to allow PR authors to rerun failing tests? I'm guessing they could do this by force-pushing anyway, so re-run access to authors shouldn't be a problem imho. |
Hmm, looks like if you have sufficient privileges in Cirrus, you can hit the rerun button from there even if you don't see it here. Do we need any consistency between github and cirrus access? |
That is just how it works. The github UI won't allow re-runs unless you have write permissions in github. While cirrus UI allows re-runs if you have write perms or are the author. So yeah as author you have to log in the cirrus UI to rerun. Personally unless people know what they are doing I would not want contributors to re-run tests by default. |
|
@mtrmac good for another look. Thanks! |
lsm5
changed the title
DigestWithAlgorithm functionDigestWithAlgorithm function
mtrmac
left a comment
mtrmac
left a comment
There was a problem hiding this comment.
Thanks! LGTM, just a nit to save future readers a bit of time.
| func Digest(manifest []byte) (digest.Digest, error) { | ||
| // stripManifestSignature strips v1s1 signatures from a manifest if present. | ||
| // Returns the manifest bytes (either the original or the unsigned payload). | ||
| func stripManifestSignature(manifest []byte) ([]byte, error) { |
There was a problem hiding this comment.
Please inline this back into the (only) caller again.
4 participants
Add a new
manifest.DigestWithAlgorithmfunction thatallows computing the digest of a manifest using a specified algorithm
(e.g., SHA256, SHA512) while properly handling v2s1 signed manifest
signature stripping.
This addresses the need for skopeo's
--manifest-digestflag to supportdifferent digest algorithms while correctly handling all manifest types,
particularly Docker v2s1 signed manifests that require signature
stripping before digest computation.
Note: Currently rebased on #475 .