feat: Make cosign copy faster#2901
Conversation
Signed-off-by: Jon Johnson <[email protected]>
Codecov Report
@@ Coverage Diff @@
## main #2901 +/- ##
=======================================
Coverage 30.33% 30.33%
=======================================
Files 151 151
Lines 9439 9439
=======================================
Hits 2863 2863
Misses 6134 6134
Partials 442 442 Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
znewman01
left a comment
znewman01
left a comment
There was a problem hiding this comment.
\m/
Left some nitpicks, feel free to leave as TODOs or ignore entirely!
| } | ||
|
|
||
| func copyImage(src, dest name.Reference, overwrite bool, opts ...remote.Option) error { | ||
| func copyImage(ctx context.Context, pusher *remote.Pusher, src, dest name.Reference, overwrite bool, opts ...remote.Option) error { |
There was a problem hiding this comment.
Nit: seems like this copies more than "images." Should it have a new name?
There was a problem hiding this comment.
I propose remoteCopy :)
| // Copy SBOMs | ||
| if err := copyTagImage(ociremote.SBOMTag, srcDigest, dstRepoRef, force, remoteOpts...); err != nil { | ||
| return err | ||
| if i == 0 && sigOnly { |
There was a problem hiding this comment.
Nit: I don't love that this depends on the order in the tagMap.
My preference might be to have a small helper function like:
func whichTagsToCopyFromArgs(sigOnly bool) []tagMap {
if sigOnly {
return []tagMap{ociremote.SignatureTag}
}
return []tagMap{ociremote.SignatureTag, ociremote.AttestationTag, ociremote.SBOMTag}
}This is extremely forwards-compatible with #2002 and IMO properly separates parsing args from "what does this command do?"
There was a problem hiding this comment.
Not quite as simple as your helper (we avoid pushing the entity itself as well), but added something like that.
Signed-off-by: Jon Johnson <[email protected]>
2 participants
Summary
I noticed that
cosign copywas remarkably slow, so I bumped the go-containerregistry dependency to pick up some work I've been doing recently to simplify fixing that slowness.I tested this by running
cosign copytwice to copygcr.io/projectsigstore/cosign:v1.13.0to Artifact Registry in us-central1. The second push is slower because it doesn't actually have to copy anything.We're roughly 3x faster after this change.
There's more we can do, but this is an easy place to start.
Release Note
cosign copywas optimized to copy images faster.Documentation