exporter: filter out inline attestations for docker exporter#3380
exporter: filter out inline attestations for docker exporter#3380jedevc wants to merge 2 commits intomoby:masterfrom
Conversation
The docker exporter should filter out inline attestations, since it doesn't support them. Any remaining attestations should cause an error, since they have been requested but cannot actually be output. Signed-off-by: Justin Chadwell <me@jedevc.com>
jedevc
force-pushed
the
fix-docker-exporter-panic
branch
from
d2f58ee to
bc42af9
Compare
| result.AttestationInlineOnlyKey: []byte(strconv.FormatBool(true)), | ||
| }) | ||
| if len(atts) > 0 { | ||
| return nil, errors.Errorf("cannot export attestations without multi-platform enabled") |
There was a problem hiding this comment.
When does this error appear? Doesn't ForceIndex always make result multiplatform when attestations are present?
| return nil, err | ||
| } | ||
|
|
||
| if e.opt.Variant == VariantDocker { |
There was a problem hiding this comment.
I'm not sure if this is really correct. This is just mediatypes. Users can export with type=oci and export fine to Docker as well. But I don't have better ideas.
We may need to check in buildx that "docker is multi-platform capable" or "direct push to registry" and only then add "inline-only".
There was a problem hiding this comment.
Buildx is a possibility, agreed. Not sure though, I have the feeling that that could provide for really tricky results for if we support multiple exporters (#2760).
Could we take the approach from #3389 (comment) and never use inline attestations to change from exporting from a manifest to an index? Though, for simple cases, that means we wouldn't get the provenance.
…form case Signed-off-by: Justin Chadwell <me@jedevc.com>
|
Parts of this fix picked up by #3389, the rest of it dropped. |
2 participants
🍒 Cherry-pick from #3379 since it should be an easy merge.
The docker exporter should filter out inline attestations, since it doesn't support them. Any remaining attestations should cause an error, since they have been requested but cannot actually be output.
Signed-off-by: Justin Chadwell me@jedevc.com