| Message ID | 20250626140731.2732545-1-clara.kowalsky@siemens.com |
|---|---|
| State | Superseded, archived |
| Headers | show |
| Series | [v2,1/2] container_fetcher: Fix missing checksum warning | expand |
On 26.06.25 16:07, Clara Kowalsky wrote: > In case only a tag is specified for a container image in the SRC_URI and > no digest, a warning should be issued with the recommendation to add the > digest of the container image. > So far, we were presenting in the warning the digest of the > architecture-specific image that happened to be fetched first. However, > we actually want to show the multi-arch manifest digest rather than the > architecture-specific one. > In addition, reading the manifest.json does not work at this point > anyway, as skopeo has already packed it into a Docker archive. > > Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com> > --- > meta/lib/container_fetcher.py | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/meta/lib/container_fetcher.py b/meta/lib/container_fetcher.py > index 0d659154..16467abb 100644 > --- a/meta/lib/container_fetcher.py > +++ b/meta/lib/container_fetcher.py > @@ -6,6 +6,7 @@ > import oe.path > import os > import tempfile > +import json > from bb.fetch2 import FetchMethod > from bb.fetch2 import logger > from bb.fetch2 import MissingChecksumEvent > @@ -60,16 +61,17 @@ class Container(FetchMethod): > if ud.digest: > return > > - checksum = bb.utils.sha256_file(ud.localpath + "/manifest.json") > - checksum_line = f"SRC_URI = \"{ud.url};digest=sha256:{checksum}\"" > + inspect_output = runfetchcmd(f"skopeo inspect docker://{ud.container_name}:{ud.tag}", d, True) > + digest = json.loads(inspect_output)["Digest"] > > + checksum_line = f'SRC_URI = "{ud.url};digest={digest}"' > strict = d.getVar("BB_STRICT_CHECKSUM") or "0" > > # If strict checking enabled and neither sum defined, raise error > if strict == "1": > raise NoChecksumError(checksum_line) > > - checksum_event = {"sha256sum": checksum} > + checksum_event = {"sha256sum": digest} > bb.event.fire(MissingChecksumEvent(ud.url, **checksum_event), d) > > if strict == "ignore": > @@ -77,7 +79,7 @@ class Container(FetchMethod): > > # Log missing digest so user can more easily add it > logger.warning( > - f"Missing checksum for '{ud.localpath}', consider using this " \ > + f"Missing checksum for '{ud.url}', consider using this " \ > f"SRC_URI in the recipe:\n{checksum_line}") > > def unpack(self, ud, rootdir, d): Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Thanks, Jan
diff --git a/meta/lib/container_fetcher.py b/meta/lib/container_fetcher.py index 0d659154..16467abb 100644 --- a/meta/lib/container_fetcher.py +++ b/meta/lib/container_fetcher.py @@ -6,6 +6,7 @@ import oe.path import os import tempfile +import json from bb.fetch2 import FetchMethod from bb.fetch2 import logger from bb.fetch2 import MissingChecksumEvent @@ -60,16 +61,17 @@ class Container(FetchMethod): if ud.digest: return - checksum = bb.utils.sha256_file(ud.localpath + "/manifest.json") - checksum_line = f"SRC_URI = \"{ud.url};digest=sha256:{checksum}\"" + inspect_output = runfetchcmd(f"skopeo inspect docker://{ud.container_name}:{ud.tag}", d, True) + digest = json.loads(inspect_output)["Digest"] + checksum_line = f'SRC_URI = "{ud.url};digest={digest}"' strict = d.getVar("BB_STRICT_CHECKSUM") or "0" # If strict checking enabled and neither sum defined, raise error if strict == "1": raise NoChecksumError(checksum_line) - checksum_event = {"sha256sum": checksum} + checksum_event = {"sha256sum": digest} bb.event.fire(MissingChecksumEvent(ud.url, **checksum_event), d) if strict == "ignore": @@ -77,7 +79,7 @@ class Container(FetchMethod): # Log missing digest so user can more easily add it logger.warning( - f"Missing checksum for '{ud.localpath}', consider using this " \ + f"Missing checksum for '{ud.url}', consider using this " \ f"SRC_URI in the recipe:\n{checksum_line}") def unpack(self, ud, rootdir, d):
In case only a tag is specified for a container image in the SRC_URI and no digest, a warning should be issued with the recommendation to add the digest of the container image. So far, we were presenting in the warning the digest of the architecture-specific image that happened to be fetched first. However, we actually want to show the multi-arch manifest digest rather than the architecture-specific one. In addition, reading the manifest.json does not work at this point anyway, as skopeo has already packed it into a Docker archive. Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com> --- meta/lib/container_fetcher.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)