Skip to content

exporter: force enabling inline attestations for image export #3466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tonistiigi merged 2 commits into from
Jan 6, 2023
Merged

exporter: force enabling inline attestations for image export #3466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e55f8b6
exporter: force enabling inline attestations for image export
jedevc Jan 6, 2023
3eaf157
exporter: allow configuring inline attestations for image exporters
jedevc Jan 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion exporter/containerimage/export.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,8 @@ func (e *imageExporter) Resolve(ctx context.Context, opt map[string]string) (exp
RefCfg: cacheconfig.RefConfig{
Compression: compression.New(compression.Default),
},
BuildInfo: true,
BuildInfo: true,
ForceInlineAttestations: true,
},
store: true,
}
Expand Down
19 changes: 12 additions & 7 deletions exporter/containerimage/opts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,14 @@ import (
)

const (
keyImageName = "name"
keyLayerCompression = "compression"
keyCompressionLevel = "compression-level"
keyForceCompression = "force-compression"
keyOCITypes = "oci-mediatypes"
keyBuildInfo = "buildinfo"
keyBuildInfoAttrs = "buildinfo-attrs"
keyImageName = "name"
keyLayerCompression = "compression"
keyCompressionLevel = "compression-level"
keyForceCompression = "force-compression"
keyOCITypes = "oci-mediatypes"
keyBuildInfo = "buildinfo"
keyBuildInfoAttrs = "buildinfo-attrs"
keyForceInlineAttestations = "attestation-inline"

// preferNondistLayersKey is an exporter option which can be used to mark a layer as non-distributable if the layer reference was
// already found to use a non-distributable media type.
Expand All @@ -34,6 +35,8 @@ type ImageCommitOpts struct {
BuildInfoAttrs bool
Annotations AnnotationsGroup
Epoch *time.Time

ForceInlineAttestations bool // force inline attestations to be attached
}

func (c *ImageCommitOpts) Load(opt map[string]string) (map[string]string, error) {
Expand Down Expand Up @@ -73,6 +76,8 @@ func (c *ImageCommitOpts) Load(opt map[string]string) (map[string]string, error)
err = parseBoolWithDefault(&c.BuildInfo, k, v, true)
case keyBuildInfoAttrs:
err = parseBoolWithDefault(&c.BuildInfoAttrs, k, v, false)
case keyForceInlineAttestations:
err = parseBool(&c.ForceInlineAttestations, k, v)
case keyPreferNondistLayers:
err = parseBool(&c.RefCfg.PreferNonDistributable, k, v)
default:
Expand Down
31 changes: 15 additions & 16 deletions exporter/containerimage/writer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,22 +69,24 @@ func (ic *ImageWriter) Commit(ctx context.Context, inp *exporter.Source, session
return nil, err
}

requiredAttestations := false
for _, p := range ps.Platforms {
if atts, ok := inp.Attestations[p.ID]; ok {
atts = attestation.Filter(atts, nil, map[string][]byte{
result.AttestationInlineOnlyKey: []byte(strconv.FormatBool(true)),
})
if len(atts) > 0 {
requiredAttestations = true
break
if !isMap {
// enable index if we need to include attestations
for _, p := range ps.Platforms {
if atts, ok := inp.Attestations[p.ID]; ok {
if !opts.ForceInlineAttestations {
// if we don't need force inline attestations (for oci
// exporter), filter them out
atts = attestation.Filter(atts, nil, map[string][]byte{
result.AttestationInlineOnlyKey: []byte(strconv.FormatBool(true)),
})
}
if len(atts) > 0 {
isMap = true
break
}
}
}
}
if requiredAttestations {
isMap = true
}

if opts.Epoch == nil {
if tm, ok, err := epoch.ParseSource(inp); err != nil {
return nil, err
Expand All @@ -108,9 +110,6 @@ func (ic *ImageWriter) Commit(ctx context.Context, inp *exporter.Source, session
if len(ps.Platforms) > 1 {
return nil, errors.Errorf("cannot export multiple platforms without multi-platform enabled")
}
if requiredAttestations {
return nil, errors.Errorf("cannot export attestations without multi-platform enabled")
}

var ref cache.ImmutableRef
var p exptypes.Platform
Expand Down