core/images: Ignore attestations when traversing children

vvoland · dmcgowan · commit 2c670e79bf19 · 2025-03-13T17:56:25.000-07:00
Before this patch, calling `image.Children` on an image built with BuildKit would produce unnecessary `encountered unknown type application/vnd.in-toto+json; children may not be fetched` debug logs, because the media type is neither a known layer or config type. Make the `image.Children` aware of the attestation layers and don't attempt to traverse them. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> (cherry picked from commit e751b6b) Signed-off-by: Derek McGowan <derek@mcg.dev>
diff --git a/images/image.go b/images/image.go
@@ -378,7 +378,7 @@ func Children(ctx context.Context, provider content.Provider, desc ocispec.Descr
 
 		descs = append(descs, index.Manifests...)
 	default:
-		if IsLayerType(desc.MediaType) || IsKnownConfig(desc.MediaType) {
+		if IsLayerType(desc.MediaType) || IsKnownConfig(desc.MediaType) || IsAttestationType(desc.MediaType) {
 			// childless data types.
 			return nil, nil
 		}
diff --git a/images/mediatypes.go b/images/mediatypes.go
@@ -57,6 +57,9 @@ const (
 
 	MediaTypeImageLayerEncrypted     = ocispec.MediaTypeImageLayer + "+encrypted"
 	MediaTypeImageLayerGzipEncrypted = ocispec.MediaTypeImageLayerGzip + "+encrypted"
+
+	// In-toto attestation
+	MediaTypeInToto = "application/vnd.in-toto+json"
 )
 
 // DiffCompression returns the compression as defined by the layer diff media
@@ -186,6 +189,16 @@ func IsKnownConfig(mt string) bool {
 	return false
 }
 
+// IsAttestationType returns true if the media type is an attestation type
+func IsAttestationType(mt string) bool {
+	switch mt {
+	case MediaTypeInToto:
+		return true
+	default:
+		return false
+	}
+}
+
 // ChildGCLabels returns the label for a given descriptor to reference it
 func ChildGCLabels(desc ocispec.Descriptor) []string {
 	mt := desc.MediaType

Original file line number	Diff line number	Diff line change
`@@ -378,7 +378,7 @@ func Children(ctx context.Context, provider content.Provider, desc ocispec.Descr`
`378`	`378`
`379`	`379`	`descs = append(descs, index.Manifests...)`
`380`	`380`	`default:`
`381`		`- if IsLayerType(desc.MediaType) \|\| IsKnownConfig(desc.MediaType) {`
	`381`	`+ if IsLayerType(desc.MediaType) \|\| IsKnownConfig(desc.MediaType) \|\| IsAttestationType(desc.MediaType) {`
`382`	`382`	`// childless data types.`
`383`	`383`	`return nil, nil`
`384`	`384`	`}`