pull gives an obscure error when fetching non-OCI (i.e. legacy Docker v2s2) images

[allisonkarlitskaya]

⬢ [lis@toolbx main]$ cr oci pull docker://quay.io/lis/box
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.05s
     Running `target/debug/cfsctl oci pull 'docker://quay.io/lis/box'`
Fetching config 6f1e027462a513e3a6174957d1392a819ec7cd4295ad66af0982996f659fca0a                          Error: Unable to pull container image docker://quay.io/lis/box

Caused by:
    0: Failed to pull config Descriptor { media_type: ImageConfig, digest: Digest { algorithm: Sha256, value: "sha256:6f1e027462a513e3a6174957d1392a819ec7cd4295ad66af0982996f659fca0a", split: 6 }, size: 1078, urls: None, annotations: None, platform: None, artifact_type: None, data: None }
    1: failed to invoke method GetBlob: failed to invoke method GetBlob: fetching blob: blob unknown to registry

[allisonkarlitskaya]

@jeckersb wanna take a look at this one too? This is a regression since #98...

[cgwalters]

That image is docker (not OCI) format

> skopeo inspect --raw -n docker://quay.io/lis/box | from json | get mediaType
application/vnd.docker.distribution.manifest.v2+json

Which goes back to the proxy autoconversion, which would make sense to support turning off.

[jeckersb]

@jeckersb wanna take a look at this one too? This is a regression since #98...

Yeah I'll take it.

On that note... can someone do repo magic to add me here so I can assign things to myself? 😄

[jeckersb]

I think this related to my comment on the original issue. If I'm reading the containers/image code correctly, I think we do need to call ConfigBlob because when we convert from docker -> OCI we generate the OCI version of the config, but now it only exists within the cache? And since #98 now we try to fetch the rewritten/cached from the registry, which obviously doesn't have it.

I'm not confident at all on this though. Will need some experimenting.

[cgwalters]

My take is we should only support OCI in this repo. As we think about image signing and sealing, I don't think we want to need to consider the legacy formats.

I would actually like to deprecate non-OCI in bootc as well, it's just harder there.

So I'm proposing that we change the error here from (currently) "blob unknown to registry" to a failure to deserialize. If we wanted to give a nicer error we could try parsing it as the legacy docker type, but...eh.

[cgwalters]

That said though one thing I don't understand is why we pass the config object through splitstream? There's nothing to be split. But maybe this is rehashing #14 a bit

[allisonkarlitskaya]

That said though one thing I don't understand is why we pass the config object through splitstream? There's nothing to be split. But maybe this is rehashing #14 a bit

Splitstream can also store intra-file references and we use it for that. It's also currently the only way to store data in the repository...

[allisonkarlitskaya]

My take is we should only support OCI in this repo. As we think about image signing and sealing, I don't think we want to need to consider the legacy formats.

It's worth mentioning that this container image was built on quay.io builders... it might be the case that other people also have plans to do that...

[cgwalters]

Ah, yeah. I think the quay.io build infrastructure is a bit under-maintained. Bigger picture, most people who want to build containers also want to test them, and if you have infrastructure to test containers (which is not quay.io) you also generally have a place to build them; the major zero-dollar git forges tend to have default associated zero-dollar builders that can do both.