google / go-containerregistry

Go library and CLIs for working with container registries
Apache License 2.0
3.13k stars 542 forks source link

crane: incorrectly uses compressed layer of a cosign .sig file to write OCI image from cache #1955

Closed AustinAbro321 closed 1 month ago

AustinAbro321 commented 5 months ago

Describe the bug

If crane.WriteImage uses an already populated cache when writing a cached cosign OCI image it will try to write image layer compressed. Since the image layer is plaintext and shouldn't be compressed the write image will fail with the error error writing layer: expected blob size 244, but only wrote 205. 205 is the file size received if the layer from the image ghcr.io/stefanprodan/podinfo:sha256-57a654ace69ec02ba8973093b6a786faa15640575fbf0dbb603db55aca2ccec8.sig is run through the internal crane function ReadCloserLevel

To Reproduce

First we write the image and populate the cache, then we delete the image so that on the next write crane will attempt to write again and pull from the cache

func run() error {
    cwd, err := os.Getwd()
    if err != nil {
        return err
    }

    craneDirectory := filepath.Join(cwd, "crane")

    cranePath, err := layout.Write(craneDirectory, empty.Index)
    if err != nil {
        return err
    }
    ref := "ghcr.io/stefanprodan/podinfo:sha256-57a654ace69ec02ba8973093b6a786faa15640575fbf0dbb603db55aca2ccec8.sig"
    img, err := crane.Pull(ref, []crane.Option{}...)
    if err != nil {
        return err
    }
    img = cache.Image(img, cache.NewFilesystemCache(filepath.Join(cwd, "cache")))
    err = cranePath.WriteImage(img)
    if err != nil {
        return err
    }

    _ = os.RemoveAll(craneDirectory)

    err = cranePath.WriteImage(img)
    if err != nil {
        return err
    }
    return nil
}

func main() {
    err := run()
    if err != nil {
        fmt.Println(err)
        return
    }
}
github-actions[bot] commented 2 months ago

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Keep fresh with the 'lifecycle/frozen' label.