Re: [PATCH 1/2] container_fetcher: Fix missing checksum warning

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 25.06.25 15:54, Clara Kowalsky wrote:
> In case only a tag is specified for a container image in the SRC_URI and
> no digest, a warning should be issued with the recommendation to add the
> digest of the container image.
> So far, the number specified in the warning would be the checksum of the
> manifest.json, which is a metadata file. However, we want to show the
> registry digest, which is calculated over the complete image content.

Actually, we were presenting the digest of the architecture-specific
image that happened to be fetched first, not that of the manifest
describing images for all supported archs of this tag. I would recommend
to update that.

But the conclusion remains correct: We need the latter, not the former.

Jan

> In addition, reading the manifest.json does not work at this point
> anyway, as skopeo has already packed it into a Docker archive.
> 
> Signed-off-by: Clara Kowalsky <clara.kowalsky@siemens.com>
> ---
>  meta/lib/container_fetcher.py | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/meta/lib/container_fetcher.py b/meta/lib/container_fetcher.py
> index 0d659154..16467abb 100644
> --- a/meta/lib/container_fetcher.py
> +++ b/meta/lib/container_fetcher.py
> @@ -6,6 +6,7 @@
>  import oe.path
>  import os
>  import tempfile
> +import json
>  from   bb.fetch2 import FetchMethod
>  from   bb.fetch2 import logger
>  from   bb.fetch2 import MissingChecksumEvent
> @@ -60,16 +61,17 @@ class Container(FetchMethod):
>          if ud.digest:
>              return
>  
> -        checksum = bb.utils.sha256_file(ud.localpath + "/manifest.json")
> -        checksum_line = f"SRC_URI = \"{ud.url};digest=sha256:{checksum}\""
> +        inspect_output = runfetchcmd(f"skopeo inspect docker://{ud.container_name}:{ud.tag}", d, True)
> +        digest = json.loads(inspect_output)["Digest"]
>  
> +        checksum_line = f'SRC_URI = "{ud.url};digest={digest}"'
>          strict = d.getVar("BB_STRICT_CHECKSUM") or "0"
>  
>          # If strict checking enabled and neither sum defined, raise error
>          if strict == "1":
>              raise NoChecksumError(checksum_line)
>  
> -        checksum_event = {"sha256sum": checksum}
> +        checksum_event = {"sha256sum": digest}
>          bb.event.fire(MissingChecksumEvent(ud.url, **checksum_event), d)
>  
>          if strict == "ignore":
> @@ -77,7 +79,7 @@ class Container(FetchMethod):
>  
>          # Log missing digest so user can more easily add it
>          logger.warning(
> -            f"Missing checksum for '{ud.localpath}', consider using this " \
> +            f"Missing checksum for '{ud.url}', consider using this " \
>              f"SRC_URI in the recipe:\n{checksum_line}")
>  
>      def unpack(self, ud, rootdir, d):


-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/e859f8f5-33ad-417f-a7d5-23a057a7c5dd%40siemens.com.