Address PR review comments:

- Fix _build_platform_image docstring (timestamp applies to all commits)
- Remove unused arch param from _publish_single_arch
- Skip publish recap when combined image already exists
- Fix copy() docstring: refs don't include docker:// prefix
- Fix blob lookup order: try verbatim digest first
- Forward registry auth env vars into release container
- Update README: replace crane references with buildah/skopeo

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Author: jacobweinstock

README.md

@@ -111,7 +111,7 @@ Each artifact file is pushed as its own OCI layer. Deterministic tar creation (z
 All three images are multi-arch OCI indexes with `linux/amd64` and `linux/arm64` platform entries pointing to the same content, so any platform can pull them. Images are compatible with:
 
 - **containerd** — valid `rootfs.diff_ids` in the config; Kubernetes image-volume mounts work
-- **crane export** — extracts individual artifact files for release workflows
+- **skopeo** — extracts individual artifact files for release workflows
 
 ### GitHub Release
 
@@ -184,7 +184,8 @@ Each stage can be executed in one of three modes:
 │   ├── tools.py                # Binary tool downloader
 │   ├── artifacts.py            # Artifact collection & checksums
 │   ├── oci.py                  # OCI artifact publish/pull/tag
-│   ├── crane.py                # crane CLI wrapper
+│   ├── buildah.py              # buildah CLI wrapper (image construction)
+│   ├── skopeo.py               # skopeo CLI wrapper (inspect/copy/export)
 │   ├── iso.py                  # ISO image assembly
 │   ├── qemu.py                 # QEMU boot testing
 │   ├── log.py                  # Colored logging

captain/docker.py

@@ -119,6 +119,13 @@ def run_in_release(cfg: Config, *extra_args: str) -> None:
         "-e",
         "BUILDAH_ISOLATION=chroot",
     ]
+    # Forward host registry credentials so buildah/skopeo can authenticate.
+    # The caller sets these env vars on the host (e.g. via docker login or
+    # CI secrets); they are passed through to the container as-is.
+    for var in ("REGISTRY_AUTH_FILE", "REGISTRY_USERNAME", "REGISTRY_PASSWORD"):
+        val = os.environ.get(var)
+        if val:
+            docker_args += ["-e", f"{var}={val}"]
     docker_args.extend(extra_args)
     run(docker_args)
 

captain/oci.py

@@ -161,8 +161,9 @@ def _build_platform_image(
 ) -> str:
     """Build an OCI image locally for *platform*.
 
-    Each tar becomes its own OCI layer (add → commit cycle).  Only the
-    final commit carries the image metadata and timestamp.
+    Each tar becomes its own OCI layer (add → commit cycle).  All commits
+    use the same fixed timestamp; only the final commit carries the image
+    metadata.
 
     *base* is the starting image — ``"scratch"`` for a new image, or a
     ``docker://`` ref to extend an existing registry image.  When a
@@ -207,7 +208,6 @@ def _build_platform_image(
 
 def _publish_single_arch(
     *,
-    arch: str,
     layer_tars: list[Path],
     ref: str,
     tag: str,
@@ -220,7 +220,7 @@ def _publish_single_arch(
     """Build a per-arch multi-arch index and push it.
 
     Both platform entries (linux/amd64 and linux/arm64) carry the same
-    4 layers — only the artifacts for *arch*.
+    4 layers.
     """
     image_ids: list[str] = []
     for platform_arch in _ARCHES:
@@ -253,7 +253,7 @@ def _publish_combined(
     created: str,
     force: bool = False,
     logger: StageLogger,
-) -> None:
+) -> bool:
     """Build and push the combined multi-arch image.
 
     Each platform manifest has the native arch's layers first, then the
@@ -272,7 +272,7 @@ def _publish_combined(
     # Skip if the combined image already exists.
     if not force and skopeo.image_exists(combined_ref, logger=logger):
         logger.log(f"{combined_ref} already exists — skipping (use --force to overwrite)")
-        return
+        return False
 
     # Ensure per-arch images exist in the registry.
     for arch in _ARCHES:
@@ -285,7 +285,6 @@ def _publish_combined(
                 f"{per_arch_ref} not found in registry — building and pushing before combined image"
             )
             _publish_single_arch(
-                arch=arch,
                 layer_tars=arch_layer_tars[arch],
                 ref=per_arch_ref,
                 tag=per_arch_tag,
@@ -319,6 +318,7 @@ def _publish_combined(
     for image_id in image_ids:
         buildah.manifest_add(manifest_id, image_id, logger=logger)
     buildah.manifest_push(manifest_id, combined_ref, logger=logger)
+    return True
 
 
 def publish(
@@ -375,9 +375,10 @@ def publish(
     for arch, files in arch_files.items():
         arch_layer_tars[arch] = [_deterministic_tar(f, out) for f in files]
 
+    pushed = True
     try:
         if target == "combined":
-            _publish_combined(
+            pushed = _publish_combined(
                 arch_layer_tars=arch_layer_tars,
                 registry=registry,
                 repository=repository,
@@ -390,7 +391,6 @@ def publish(
             )
         else:
             _publish_single_arch(
-                arch=target,
                 layer_tars=arch_layer_tars[target],
                 ref=final_ref,
                 tag=full_tag,
@@ -405,6 +405,9 @@ def publish(
             for t in tars:
                 t.unlink(missing_ok=True)
 
+    if not pushed:
+        return
+
     # Recap
     artifact_names: list[str] = []
     for arch in arches:

captain/skopeo.py

@@ -60,10 +60,12 @@ def copy(
     *,
     logger: StageLogger | None = None,
 ) -> None:
-    """Copy an image from *src* to *dest* (both ``docker://`` refs).
+    """Copy an image from *src* to *dest*.
 
-    Typically used for retagging: the source and destination differ only
-    in the tag component.
+    *src* and *dest* are plain image references (e.g.
+    ``ghcr.io/org/repo:tag``); the ``docker://`` transport prefix is
+    added automatically.  Typically used for retagging: the source and
+    destination differ only in the tag component.
     """
     _log = logger or _default_log
     _log.log(f"skopeo copy {src} → {dest}")
@@ -126,8 +128,10 @@ def export_image(
 
         for layer in layers:
             digest_str = layer["digest"]  # e.g. "sha256:abc123..."
-            blob_file = tmp_dir / digest_str.replace(":", "-")
-            # Fallback: some skopeo versions use just the hash
+            # skopeo stores blobs under several possible filenames.
+            blob_file = tmp_dir / digest_str
+            if not blob_file.exists():
+                blob_file = tmp_dir / digest_str.replace(":", "-")
             if not blob_file.exists():
                 blob_file = tmp_dir / digest_str.split(":")[-1]
             if not blob_file.exists():