Description

I'm unable to import a busybox image that contains attestations.

Steps to reproduce the issue

1. docker image save docker.io/library/busybox:latest > busybox-latest.img
2. make -C ../../containerd/containerd bin/ctr # (after having checked out v2.0.2 there)
3. sudo ../../containerd/containerd/bin/ctr --namespace=k8s.io images import --all-platforms --digests - < busybox-latest.img

Describe the results you received and expected

Expected: success.
Actual output:

ctr: rpc error: code = NotFound desc = content digest sha256:4c6b3915ceab750f69555510444e80541e4c72e23130c748c6ce3315f603015e: not found

What version of containerd are you using?

v2.0.2

Any other relevant information

What I've been able to figure out using skopeo inspect --raw docker://docker.io/library/busybox:latest|jq . and docker image save docker.io/library/busybox:latest is that:

• the digest that ctr complains about is claimed to be an attestation-manifest for the linux/amd64 manifest
• the busybox' docker image mentions it in the index image, but the blob itself is nowhere to be found

So it seems like from the PoV of ctr the image is incomplete since it's lacking the attestation blob.

This problem also was present in ctr pre-v2.
Related issue where this was found: kubernetes-sigs/kind#3795

Show configuration if it is related to CRI plugin.

No response