imagetools: avoid trying to load attestations inline references

tonistiigi · tonistiigi · commit 631e822886c4 · 2026-01-22T15:46:15.000-08:00
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.

Signed-off-by: Tonis Tiigi &lt;tonistiigi@gmail.com&gt;
diff --git a/util/imagetools/create.go b/util/imagetools/create.go
@@ -429,6 +429,9 @@ func (r *Resolver) filterPlatforms(ctx context.Context, dt []byte, desc ocispecs
 	// try to pull in attestation manifest via referrer if one exists
 	addedRef := false
 	for d := range matchedManifests {
+		if _, ok := references[d]; ok { // manifest itself is already attestation
+			continue
+		}
 		hasRef := false
 		for _, subject := range references {
 			if subject.Digest == d {
