`oci pull` doesn't work with quay, ghcr

[allisonkarlitskaya]

cfsctl pull works on all manner of local repositories plus docker:// repos on docker.io but not with quay or ghcr.

For quay it complains about missing blobs. Normal skopeo copy works fine here.

For ghcr it complains about not having the bearer token. skopeo copy is also broken here, but podman pull works fine.

[allisonkarlitskaya]

After spending all morning playing with mitmproxy it's clear that (in some cases) the sha256 of the config that appears in the manifest is completely made up by some part of skopeo/containers-image-proxy. The registry sent this hash to us at absolutely no point whatsoever, so of course it's not available at the registry to fetch as a blob...

Using .fetch_config() seems to avoid the issue.

[cgwalters]

One thing the proxy does is convert legacy docker "v2s2" manifests to OCI automatically which we should probably support turning off. Are you pushing images in v2s2 or OCI? i.e. what does skopeo inspect --raw docker://quay.io/yourimage look like?

I actually had the inverse problem when I was looking at this in my repo. Are you using the raw API ?

See also https://github.com/cgwalters/composefs-oci-experimental/blob/08a0d864223021ecf56477584f45419c846e0c80/src/repo.rs#L1134

[allisonkarlitskaya]

Ya, I copied the code from your repo at first, which meant I was using get_descriptor() for the config. That worked with eg. docker.io/fedora, but broke with quay.io/lis/box and ghcr.io/cockpit-project/tasks.

Now I use the config API:

            let raw_config = self.proxy.fetch_config_raw(&self.img).await?;
            let config = ImageConfiguration::from_reader(raw_config.as_slice())?;

and that works with ghcr.io/cockpit-project/tasks and quay.io/lis/box but not with docker.io/fedora.

It would be lovely if there was one way that worked for both...

[cgwalters]

skopeo inspect --raw -n docker://quay.io/lis/box
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",

It's v2s2 not OCI, so basically what the proxy is doing here is not helpful and we need to have an "open as OCI or error" mode.