Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hotfix: Iterate on all available tags to check if tag exist #54

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

toninis
Copy link

@toninis toninis commented Jun 20, 2023

Summary

When images are built without provenance=false spinwick cannot validate the manifest.
The library we are using does not support all OCI manifests so we are switching to simple tag checking which works every time.

Ticket Link

https://mattermost.atlassian.net/browse/CLD-5172

Related Issues

docker/buildx#1533
fraunhoferfokus/deckschrubber#43

Release Note


@toninis toninis requested review from spirosoik, gabrieljackson and a team June 20, 2023 20:44
@mm-cloud-bot mm-cloud-bot added the kind/bug Categorizes issue or PR as related to a bug. label Jun 20, 2023
@mm-cloud-bot
Copy link

@toninis: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

I understand the commands that are listed here

Copy link
Member

@mvitale1989 mvitale1989 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Antonis! LGTM as a hotfix, although the tags number will only ever grow as of now (mattermostdevelopment/mm-ee-test currently has ~1825 tags pushed over the course of ~3 months, so a ~600 tags/month increase), so perhaps it would still be more sustainable to eventually switch to a modern library, and directly retrieve the image manifest again.

@toninis
Copy link
Author

toninis commented Jun 21, 2023

Thanks Antonis! LGTM as a hotfix, although the tags number will only ever grow as of now (mattermostdevelopment/mm-ee-test currently has ~1825 tags pushed over the course of ~3 months, so a ~600 tags/month increase), so perhaps it would still be more sustainable to eventually switch to a modern library, and directly retrieve the image manifest again.

Agreed . The api is really fast in any case . Should we establish a garbage collection policy ?

@toninis
Copy link
Author

toninis commented Jun 21, 2023

/release-note-none

@mm-cloud-bot mm-cloud-bot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed labels Jun 21, 2023
@mvitale1989
Copy link
Member

Agreed . The api is really fast in any case . Should we establish a garbage collection policy ?

No urgent need for this PR's purpose I think. But I would open a ticket in our backlog to have a discussion about this topic in general.

Copy link
Member

@spirosoik spirosoik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for fixing this

@@ -48,14 +48,16 @@ func (b *Builds) waitForImage(ctx context.Context, s *Server, reg *registry.Regi
case <-ctx.Done():
return pr, errors.New("timed out waiting for image to publish")
case <-time.After(30 * time.Second):
_, err := reg.ManifestDigest(imageToCheck, desiredTag)
availableTags, err := reg.Tags(imageToCheck)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering if there is a test. if it's not it's ok.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug. release-note-none Denotes a PR that doesn't merit a release note.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants