Skip to content

Feature/docker validate sha#1386

Merged
agrasth merged 3 commits intojfrog:devfrom
agrasth:feature/docker-validate-sha
May 27, 2025
Merged

Feature/docker validate sha#1386
agrasth merged 3 commits intojfrog:devfrom
agrasth:feature/docker-validate-sha

Conversation

@agrasth
Copy link
Contributor

@agrasth agrasth commented May 11, 2025

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

Add --validate-sha flag for Docker push command

Description

This PR adds core support for the new --validate-sha flag in the Docker push command. When enabled, the flag allows the CLI to use the image's SHA digest for validation instead of the tag name during Docker push operations. This is particularly useful when pushing to virtual repositories where the tag might exist with different content in higher priority repositories.

Changes

  • Modified artifactory/utils/container/remoteagent.go to handle manifest digest mismatches gracefully
  • Updated the manifest validation logic to log warnings instead of failing when using the --validate-sha flag
  • Added detailed logging to help users understand what's happening during SHA-based validation

Testing

  • Manually tested the flag with both old and new CLI syntax
  • Verified behavior when pushing to repositories with existing tags
  • Confirmed build info collection works correctly with the flag

Related PRs

  • jfrog-cli: here
  • jfrog-cli-artifactory: here

@agrasth agrasth force-pushed the feature/docker-validate-sha branch from 333c9f5 to 17a5ce9 Compare May 19, 2025 06:14
func setBuildProperties(buildName, buildNumber, project string, imageLayers []utils.ResultItem, serviceManager artifactory.ArtifactoryServicesManager) (err error) {
// Skip if no build info is provided
if buildName == "" || buildNumber == "" {
log.Debug("Skipping setting properties - no build name or build number provided")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
log.Debug("Skipping setting properties - no build name or build number provided")
log.Debug("Skipping setting properties - build name and build number are required")

updated debug log message

log.Warn("Manifest digest mismatch detected. Local image digest: " + rabib.manifestSha2 + ", Repository digest: " + manifestDigest)
log.Info("Proceeding with SHA-based validation to ensure correct image identification...")
// Return nil instead of error to allow the operation to continue
return nil
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is the error always nil, if it is has to be nil always remove return type as error in this function

@agrasth agrasth merged commit 60a3b4b into jfrog:dev May 27, 2025
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants