Skip to content

Commit 78bdf1b

Browse files
authored
validate: skip non-layer layers (#2298)
Docker Official Images like busybox and ubuntu now include "layers" in image manifests that are not layers, but are instead in-toto attestations about the layers. This confuses 'crane validate', which expected layers to be gzipped tarballs. This change skips validation of layers that are not a layer media type. With this change: $ go run ./cmd/crane validate --remote=busybox PASS: busybox Signed-off-by: Jason Hall <imjasonh@gmail.com>
1 parent c29d91c commit 78bdf1b

1 file changed

Lines changed: 14 additions & 4 deletions

File tree

‎pkg/v1/validate/image.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,12 @@ func validateLayers(img v1.Image, opt ...Option) error {
119119
udiffids := []v1.Hash{}
120120
sizes := []int64{}
121121
for i, layer := range layers {
122+
if mt, err := layer.MediaType(); err != nil {
123+
return fmt.Errorf("getting mediaType[%d]: %w", i, err)
124+
} else if !mt.IsLayer() {
125+
continue
126+
}
127+
122128
cl, err := computeLayer(layer)
123129
if errors.Is(err, io.ErrUnexpectedEOF) {
124130
// Errored while reading tar content of layer because a header or
@@ -153,19 +159,23 @@ func validateLayers(img v1.Image, opt ...Option) error {
153159

154160
errs := []string{}
155161
for i, layer := range layers {
156-
digest, err := layer.Digest()
162+
mediaType, err := layer.MediaType()
157163
if err != nil {
158164
return err
159165
}
160-
diffid, err := layer.DiffID()
166+
if !mediaType.IsLayer() {
167+
continue
168+
}
169+
170+
digest, err := layer.Digest()
161171
if err != nil {
162172
return err
163173
}
164-
size, err := layer.Size()
174+
diffid, err := layer.DiffID()
165175
if err != nil {
166176
return err
167177
}
168-
mediaType, err := layer.MediaType()
178+
size, err := layer.Size()
169179
if err != nil {
170180
return err
171181
}

0 commit comments

Comments
 (0)