fix(imagepin): 带 digest 的镜像引用也向 registry 确认仍存在 (05e8c64e) · Commits · FelisMC / Felis · GitLab

internal/api/images.go

+3 −0

Changes for internal/api/images.go: 3 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -270,6 +270,9 @@ func (a *API) pinImage(ctx context.Context, ref string) (string, error) {
		}
		pinned, err := a.Images.Pin(ctx, ref)
		switch {
		case errors.Is(err, imagepin.ErrNotFound) && imagepin.Pinned(ref):
		return "", newError(http.StatusBadRequest, "image_not_in_registry",
		"the registry no longer holds build %q (nothing referenced it, so it was pruned); pick a current tag", ref)
		case errors.Is(err, imagepin.ErrNotFound):
		return "", newError(http.StatusBadRequest, "image_not_in_registry",
		"image %q is whitelisted but the registry does not hold it; build or push it first", ref)

internal/imagepin/imagepin.go

+16 −3

Changes for internal/imagepin/imagepin.go: 16 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -73,10 +73,23 @@ func (r Resolver) Covers(ref string) bool {
		return r.Registry != "" && strings.HasPrefix(ref, r.Registry+"/")
		}

		// Pin returns ref with the digest its tag names now appended. A ref that already
		// carries a digest, or lives outside the registry, comes back unchanged.
		// Pin returns ref with the digest its tag names now appended. A ref outside the
		// registry comes back unchanged. A ref that already carries a digest comes back
		// unchanged once the registry confirms it still holds that manifest: the registry
		// pruner deletes builds nothing references, and a server set back to one of them
		// would otherwise sit in ImagePullBackOff.
		func (r Resolver) Pin(ctx context.Context, ref string) (string, error) {
		if Pinned(ref) \|\| !r.Covers(ref) {
		if !r.Covers(ref) {
		return ref, nil
		}
		if name, pinned, ok := strings.Cut(ref, "@"); ok {
		repo, _ := splitTag(strings.TrimPrefix(name, r.Registry+"/"))
		if repo == "" \|\| !digestRE.MatchString(pinned) {
		return "", fmt.Errorf("imagepin: %q is not a valid pinned reference", ref)
		}
		if _, err := r.digest(ctx, repo, pinned); err != nil {
		return "", fmt.Errorf("imagepin: resolve %s: %w", ref, err)
		}
		return ref, nil
		}
		repo, tag := splitTag(strings.TrimPrefix(ref, r.Registry+"/"))

internal/imagepin/imagepin_test.go

+28 −3

Changes for internal/imagepin/imagepin_test.go: 28 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -13,7 +13,8 @@ import (

		const testDigest = "sha256:d2fcc09d2caa108678c540c99703db96d63038a5fc9e366402d7ef1712ec4d95"

		// fakeRegistry serves /v2/felis/paper/manifests/demo and 404s everything else.
		// fakeRegistry serves /v2/felis/paper/manifests/demo (and the same manifest by
		// its digest) and 404s everything else.
		func fakeRegistry(t testing.T, header bool) (httptest.Server, *[]string) {
		t.Helper()
		var seen []string
		@@ -22,7 +23,7 @@ func fakeRegistry(t testing.T, header bool) (httptest.Server, *[]string) {
		if !strings.Contains(r.Header.Get("Accept"), "application/vnd.oci.image.index.v1+json") {
		t.Errorf("request without an OCI index Accept: %q", r.Header.Get("Accept"))
		}
		if r.URL.Path != "/v2/felis/paper/manifests/demo" {
		if r.URL.Path != "/v2/felis/paper/manifests/demo" && r.URL.Path != "/v2/felis/paper/manifests/"+testDigest {
		http.NotFound(w, r)
		return
		}
		@@ -78,8 +79,8 @@ func TestPinLeavesOtherRefsAlone(t *testing.T) {
		srv, seen := fakeRegistry(t, true)
		r := resolverFor(srv)
		for _, ref := range []string{
		"registry.felis.svc:5000/felis/paper:demo@" + testDigest, // already pinned
		"docker.io/itzg/minecraft-server:java21", // external
		"docker.io/itzg/minecraft-server:java21@" + testDigest, // external, pinned
		"registry.felis.svc:50000/felis/paper:demo", // a different port is a different registry
		} {
		got, err := r.Pin(context.Background(), ref)
		@@ -92,6 +93,30 @@ func TestPinLeavesOtherRefsAlone(t *testing.T) {
		}
		}

		// A pinned ref stays as it is, but only while the registry still holds that
		// manifest: the pruner deletes builds nothing references, and setting a server
		// back to one of them must fail here, not in ImagePullBackOff.
		func TestPinChecksAPinnedRefStillExists(t *testing.T) {
		srv, seen := fakeRegistry(t, true)
		r := resolverFor(srv)
		ref := "registry.felis.svc:5000/felis/paper:demo@" + testDigest
		got, err := r.Pin(context.Background(), ref)
		if err != nil \|\| got != ref {
		t.Fatalf("Pin(%q) = %q, %v; want it unchanged", ref, got, err)
		}
		if want := "HEAD /v2/felis/paper/manifests/" + testDigest; len(seen) != 1 \|\| (seen)[0] != want {
		t.Errorf("requests = %v, want [%s]", *seen, want)
		}

		pruned := "registry.felis.svc:5000/felis/paper:demo@sha256:" + strings.Repeat("0", 64)
		if _, err := r.Pin(context.Background(), pruned); !errors.Is(err, ErrNotFound) {
		t.Errorf("pruned digest: err = %v, want ErrNotFound", err)
		}
		if _, err := r.Pin(context.Background(), "registry.felis.svc:5000/felis/paper:demo@sha256:nothex"); err == nil {
		t.Error("malformed pinned ref accepted")
		}
		}

		func TestPinImpliedLatest(t *testing.T) {
		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/v2/felis/paper/manifests/latest" {