diff mbox series

[v3,1/2] container_fetcher: Fix missing checksum warning

Message ID 20250627065336.2910069-1-clara.kowalsky@siemens.com
State Under Review
Headers show
Series [v3,1/2] container_fetcher: Fix missing checksum warning | expand

Commit Message

Clara Kowalsky June 27, 2025, 6:53 a.m. UTC 
In case only a tag is specified for a container image in the SRC_URI and
no digest, a warning should be issued with the recommendation to add the
digest of the container image.
So far, we were presenting in the warning the digest of the
architecture-specific image that happened to be fetched first. However,
we actually want to show the multi-arch manifest digest rather than the
architecture-specific one.
In addition, reading the manifest.json does not work at this point
anyway, as skopeo has already packed it into a Docker archive.

Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 meta/lib/container_fetcher.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/meta/lib/container_fetcher.py b/meta/lib/container_fetcher.py
index 0d659154..16467abb 100644
--- a/meta/lib/container_fetcher.py
+++ b/meta/lib/container_fetcher.py
@@ -6,6 +6,7 @@ 
 import oe.path
 import os
 import tempfile
+import json
 from   bb.fetch2 import FetchMethod
 from   bb.fetch2 import logger
 from   bb.fetch2 import MissingChecksumEvent
@@ -60,16 +61,17 @@  class Container(FetchMethod):
         if ud.digest:
             return
 
-        checksum = bb.utils.sha256_file(ud.localpath + "/manifest.json")
-        checksum_line = f"SRC_URI = \"{ud.url};digest=sha256:{checksum}\""
+        inspect_output = runfetchcmd(f"skopeo inspect docker://{ud.container_name}:{ud.tag}", d, True)
+        digest = json.loads(inspect_output)["Digest"]
 
+        checksum_line = f'SRC_URI = "{ud.url};digest={digest}"'
         strict = d.getVar("BB_STRICT_CHECKSUM") or "0"
 
         # If strict checking enabled and neither sum defined, raise error
         if strict == "1":
             raise NoChecksumError(checksum_line)
 
-        checksum_event = {"sha256sum": checksum}
+        checksum_event = {"sha256sum": digest}
         bb.event.fire(MissingChecksumEvent(ud.url, **checksum_event), d)
 
         if strict == "ignore":
@@ -77,7 +79,7 @@  class Container(FetchMethod):
 
         # Log missing digest so user can more easily add it
         logger.warning(
-            f"Missing checksum for '{ud.localpath}', consider using this " \
+            f"Missing checksum for '{ud.url}', consider using this " \
             f"SRC_URI in the recipe:\n{checksum_line}")
 
     def unpack(self, ud, rootdir, d):