Skip to content

OCPNODE-3945: Adapt ociartifact to new interfaces of libartifact#9691

Merged
openshift-merge-bot[bot] merged 4 commits into
cri-o:mainfrom
bitoku:artifact
Feb 16, 2026
Merged

OCPNODE-3945: Adapt ociartifact to new interfaces of libartifact#9691
openshift-merge-bot[bot] merged 4 commits into
cri-o:mainfrom
bitoku:artifact

Conversation

@bitoku

@bitoku bitoku commented Jan 2, 2026

Copy link
Copy Markdown
Contributor

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This PR fixes cri-o code to adapt it to new interfaces of libartifact store.
podman-container-tools/container-libs@539435a

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

Summary by CodeRabbit

  • New Features
    • Added an OCI artifact data store with data-pulling capabilities, per-layer size limits, digest verification, and improved lookup by name or digest.
  • Refactor
    • Simplified artifact store integration and streamlined artifact handling and references across the codebase.
  • Chores
    • Upgraded numerous dependencies, including CRIU to v8, runc, SELinux, and various Go modules for improved compatibility and security.
  • Tests
    • Added new datastore tests; updated mocks to align with the refactored datastore and dependency changes; removed obsolete tests.

@bitoku bitoku requested a review from mrunalp as a code owner January 2, 2026 14:27
@openshift-ci openshift-ci Bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. labels Jan 2, 2026
@coderabbitai

coderabbitai Bot commented Jan 2, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Refactors OCI artifact handling by introducing a new datastore package, updating store interfaces and usage of libartifact, and migrating seccomp integration to the datastore types. Adds a new PullData flow with blob verification and size limits. Updates mocks and tests accordingly. Separately bumps dependencies, notably switching CRIU imports from v7 to v8.

Changes

Cohort / File(s) Summary
Build & Mock Targets
Makefile
Renames mock target to mock-ociartifact-datastore-types and updates mockgen package, output path, and interfaces.
Dependencies
go.mod
Broad dependency upgrades, adds/removes indirects; CRIU v8, runc 1.4.0, selinux updates, etc.
Seccomp OCI Artifact Integration
internal/config/seccomp/seccompociartifact/impl.go, internal/config/seccomp/seccompociartifact/seccompociartifact.go, internal/config/seccomp/seccompociartifact/seccompociartifact_test.go
Switches from ociartifact to datastore types; updates method signatures and tests to use datastore.PullOptions and datastore.ArtifactData.
CRIU v8 Migration
internal/lib/checkpoint.go, internal/lib/checkpoint_test.go, internal/lib/restore.go, internal/lib/restore_test.go, internal/oci/oci_test.go, internal/oci/runtime_oci.go, server/container_checkpoint_test.go, server/container_restore_test.go, test/checkcriu/checkcriu.go
Updates imports from go-criu/v7 to go-criu/v8 (utils/stats); no logic changes.
OCI Artifact Core Refactor
internal/ociartifact/artifact.go, internal/ociartifact/libartifact_store.go, internal/ociartifact/store.go
Introduces NewArtifact constructor, removes ArtifactData type and digest field, revises store to use explicit libartifactStore field and reference types; adds RootPath; updates Pull/List/Status/Remove.
New Datastore Feature
internal/ociartifact/datastore/store.go, internal/ociartifact/datastore/impl.go
Adds datastore Store with PullData, artifact data extraction, digest verification, size limits; trims Impl interface (removes DockerReference* methods).
Datastore Tests
internal/ociartifact/datastore/store_test.go, internal/ociartifact/datastore/store_test_inject.go, internal/ociartifact/datastore/suite_test.go
Adds tests for PullData failure paths; adds SetImpl for tests; Ginkgo suite bootstrap.
Removed Legacy Tests
internal/ociartifact/store_test.go
Deletes legacy store tests tied to old APIs.
Storage Integration
internal/storage/image.go
On image copy failure, uses artifactStore.Pull instead of PullManifest to get manifest digest.
Updated Mocks
test/mocks/ociartifact/ociartifact.go, test/mocks/ociartifact/datastore/datastore.go, test/mocks/seccompociartifact/seccompociartifact.go
Generates datastore Impl mocks; updates libartifact store mocks (add Inspect, change Pull/Remove signatures); adjusts seccomp mock to datastore types.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Caller as Caller
  participant DS as Datastore.Store
  participant OA as OCIArtifact.Store
  participant CI as containers/image
  participant Reg as Registry

  Caller->>DS: PullData(ref, PullOptions)
  DS->>DS: sanitizeOptions()
  DS->>OA: Pull(ref, CopyOptions)
  OA->>Reg: Fetch manifest/layers
  OA-->>DS: manifest digest
  DS->>CI: Parse & create ImageReference
  DS->>CI: NewImageSource(ref, SystemContext)
  activate CI
  loop for each layer
    DS->>CI: GetBlob(layer)
    CI-->>DS: Blob stream, size
    DS->>DS: Enforce size limit
    DS->>DS: ReadAll + verify digest
  end
  deactivate CI
  DS-->>Caller: []ArtifactData or error
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

Suggested reviewers

  • mrunalp
  • littlejawa
  • hasan4791

Poem

In burrows of code, I hop with delight,
New datastore trails gleam in the night.
Blobs weighed and checked, their hashes true,
CRIU hops to v8—swiftly we flew.
With tidy mocks and roots made clear,
I thump approval: ship it, dear! 🐇✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly and clearly describes the main change: adapting ociartifact to new libartifact interfaces, which is the core focus of this refactoring PR.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Important

Action Needed: IP Allowlist Update

If your organization protects your Git platform with IP whitelisting, please add the new CodeRabbit IP address to your allowlist:

  • 136.113.208.247/32 (new)
  • 34.170.211.100/32
  • 35.222.179.152/32

Failure to add the new IP will result in interrupted reviews.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from hasan4791 and littlejawa January 2, 2026 14:28
@bitoku bitoku force-pushed the artifact branch 3 times, most recently from 9ef5781 to 2d43e62 Compare January 2, 2026 15:30
@codecov

codecov Bot commented Jan 2, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 60.19417% with 82 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.45%. Comparing base (190b59e) to head (7587785).
⚠️ Report is 14 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #9691      +/-   ##
==========================================
- Coverage   67.47%   67.45%   -0.02%     
==========================================
  Files         210      210              
  Lines       29043    29046       +3     
==========================================
- Hits        19597    19594       -3     
- Misses       7763     7771       +8     
+ Partials     1683     1681       -2     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 6, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 13, 2026
@bitoku

bitoku commented Jan 13, 2026

Copy link
Copy Markdown
Contributor Author

I'll resume once podman-container-tools/container-libs#408 is fixed.

@bitoku bitoku changed the title [WIP] Adapt ociartifact to new interfaces of libartifact [WIP] OCPNODE-3945: Adapt ociartifact to new interfaces of libartifact Jan 15, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 15, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@bitoku: This pull request references OCPNODE-3945 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

This PR fixes cri-o code to adapt it to new interfaces of libartifact store.
podman-container-tools/container-libs@539435a

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

None

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@bitoku

bitoku commented Jan 15, 2026

Copy link
Copy Markdown
Contributor Author

/jira refresh

@openshift-ci-robot

Copy link
Copy Markdown

@bitoku: This pull request references OCPNODE-3945 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 25, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 27, 2026
@bitoku bitoku changed the title [WIP] OCPNODE-3945: Adapt ociartifact to new interfaces of libartifact OCPNODE-3945: Adapt ociartifact to new interfaces of libartifact Jan 27, 2026
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 27, 2026
@bitoku

bitoku commented Jan 28, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@cri-o/cri-o-maintainers PTAL

The change became big. may be better to look per commit

@bitoku

bitoku commented Feb 3, 2026

Copy link
Copy Markdown
Contributor Author

@cri-o/cri-o-maintainers PTAL

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 3, 2026
Signed-off-by: Ayato Tokubi <atokubi@redhat.com>

# Conflicts:
#	go.mod
#	go.sum
#	vendor/github.com/klauspost/compress/flate/huffman_bit_writer.go
#	vendor/modules.txt
…ct` and remove redundant `buildArtifact` logic.

Signed-off-by: Ayato Tokubi <atokubi@redhat.com>
… handling

Signed-off-by: Ayato Tokubi <atokubi@redhat.com>
Signed-off-by: Ayato Tokubi <atokubi@redhat.com>
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 3, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Fix all issues with AI agents
In `@internal/ociartifact/datastore/store.go`:
- Around line 171-174: The size check currently allows one extra byte because it
compares against int64(maxArtifactSize)+1; update the conditional in the code
that uses variables size and maxArtifactSize (the block that returns
fmt.Errorf("exceeded maximum allowed size...")) to compare directly against
int64(maxArtifactSize) (i.e., use size > int64(maxArtifactSize)) so blobs larger
than maxArtifactSize are rejected as intended; keep the special-case check for
size == -1 unchanged.

In `@internal/ociartifact/libartifact_store.go`:
- Around line 11-15: The mock implementation contains an orphaned
SystemContext() method that is not part of the LibartifactStore interface;
remove the SystemContext() method from the ociartifact mock so the mock only
implements the interface methods Remove, List, Pull, and Inspect, ensuring the
mock signature matches LibartifactStore exactly.

In `@internal/ociartifact/store.go`:
- Around line 54-60: The code calls ref.DockerReference().String() without
checking for a nil DockerReference, which can panic for non-Docker references;
update the function to call ref.DockerReference() into a local variable (e.g.,
dr := ref.DockerReference()), check if dr == nil and handle that case (return a
clear error or fall back to ref.String() if appropriate), then pass dr.String()
(or the fallback) into libart.NewArtifactReference; reference the symbols
DockerReference(), String(), libart.NewArtifactReference, and the strRef
variable when making the change.
🧹 Nitpick comments (6)
internal/ociartifact/datastore/impl.go (1)

16-17: Make the interface comment state the intent (DI/mocking)

Proposed comment update
-// Impl is the interface for the implementation.
+// Impl exists to allow dependency injection/mocking of image operations in tests.

As per coding guidelines: Add comments explaining 'why' not 'what' in Go code.

internal/ociartifact/datastore/suite_test.go (1)

12-16: Make the TestRun comment explain why it exists

Proposed comment update
-// TestRun runs the created specs.
+// TestRun wires Ginkgo into go test so the datastore suite runs under `go test`.

As per coding guidelines: Add comments explaining 'why' not 'what' in Go code.

internal/ociartifact/datastore/store_test.go (1)

44-83: Consider adding happy-path tests for PullData.

The current tests cover error scenarios well (ParseNormalizedNamed and DockerNewReference failures). Consider adding tests for the successful pull path and other failure scenarios (e.g., artifact size exceeding MaxSize, empty artifact data) to improve coverage.

internal/ociartifact/artifact.go (1)

32-51: Consider accepting context.Context for proper log propagation.

NewArtifact uses context.Background() for logging (line 42), which loses any tracing/logging context the caller might have. Per the coding guidelines, context.Context should be propagated through function calls.

♻️ Suggested change to accept context
-func NewArtifact(art *libartifact.Artifact) *Artifact {
+func NewArtifact(ctx context.Context, art *libartifact.Artifact) *Artifact {
 	artifact := &Artifact{
 		Artifact: art,
 		namedRef: unknownRef{},
 	}

 	if art.Name != "" {
 		namedRef, err := reference.ParseNormalizedNamed(art.Name)
 		if err != nil {
-			log.Warnf(context.Background(), "Failed to parse artifact name %s with the error %s", art.Name, err)
+			log.Warnf(ctx, "Failed to parse artifact name %q: %v", art.Name, err)

 			namedRef = unknownRef{}
 		}

 		artifact.namedRef = namedRef
 	}

 	return artifact
 }

As per coding guidelines: "Propagate context.Context through function calls in Go code".

internal/ociartifact/store.go (1)

102-111: Consider wrapping the error from Remove for consistent error handling.

Other methods in this file wrap errors with fmt.Errorf and %w, but Remove returns the error directly on line 108. This inconsistency may lose context in error chains.

♻️ Suggested fix for consistency
 func (s *Store) Remove(ctx context.Context, nameOrDigest string) error {
 	artRef, err := libart.NewArtifactStorageReference(nameOrDigest)
 	if err != nil {
 		return fmt.Errorf("invalid nameOrDigest: %w", err)
 	}

-	_, err = s.libartifactStore.Remove(ctx, artRef)
-
-	return err
+	if _, err = s.libartifactStore.Remove(ctx, artRef); err != nil {
+		return fmt.Errorf("remove artifact: %w", err)
+	}
+
+	return nil
 }

As per coding guidelines: "Use fmt.Errorf with %w for error wrapping in Go code".

internal/ociartifact/datastore/store.go (1)

228-231: Consider documenting the minimum digest prefix length.

The len(strRef) >= 3 check enforces a minimum prefix length for digest matching but lacks documentation explaining why 3 was chosen. Adding a brief comment would improve maintainability.

📝 Suggested comment
-	// if strRef is a just digest or short digest
+	// if strRef is a digest or short digest prefix (minimum 3 chars to avoid overly ambiguous matches)
 	if idx := slices.IndexFunc(artifacts, func(a *ociartifact.Artifact) bool { return strings.HasPrefix(a.Digest().Encoded(), strRef) }); len(strRef) >= 3 && idx != -1 {

As per coding guidelines: "Add comments explaining 'why' not 'what' in Go code".

Comment on lines +171 to +174

if size != -1 && size > int64(maxArtifactSize)+1 {
return nil, fmt.Errorf("exceeded maximum allowed size of %d bytes for a single layer", maxArtifactSize)
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Off-by-one in size comparison allows one extra byte.

The check size > int64(maxArtifactSize)+1 allows blobs up to maxArtifactSize + 1 bytes, not maxArtifactSize. This should likely be size > int64(maxArtifactSize) for consistency with the error message and intent.

🛡️ Proposed fix
-	if size != -1 && size > int64(maxArtifactSize)+1 {
+	if size != -1 && size > int64(maxArtifactSize) {
 		return nil, fmt.Errorf("exceeded maximum allowed size of %d bytes for a single layer", maxArtifactSize)
 	}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if size != -1 && size > int64(maxArtifactSize)+1 {
return nil, fmt.Errorf("exceeded maximum allowed size of %d bytes for a single layer", maxArtifactSize)
}
if size != -1 && size > int64(maxArtifactSize) {
return nil, fmt.Errorf("exceeded maximum allowed size of %d bytes for a single layer", maxArtifactSize)
}
🤖 Prompt for AI Agents
In `@internal/ociartifact/datastore/store.go` around lines 171 - 174, The size
check currently allows one extra byte because it compares against
int64(maxArtifactSize)+1; update the conditional in the code that uses variables
size and maxArtifactSize (the block that returns fmt.Errorf("exceeded maximum
allowed size...")) to compare directly against int64(maxArtifactSize) (i.e., use
size > int64(maxArtifactSize)) so blobs larger than maxArtifactSize are rejected
as intended; keep the special-case check for size == -1 unchanged.

Comment on lines 11 to +15
type LibartifactStore interface {
// Remove an artifact from the local artifact store.
Remove(ctx context.Context, name string) (*digest.Digest, error)

// List artifacts in the local store.
Remove(ctx context.Context, asr libartifact.ArtifactStoreReference) (*digest.Digest, error)
List(ctx context.Context) (libartifact.ArtifactList, error)

// Pull an artifact from an image registry to a local store.
Pull(ctx context.Context, name string, opts libimage.CopyOptions) (digest.Digest, error)

// SystemContext returns the internal system context
SystemContext() *types.SystemContext
}

type RealLibartifactStore struct {
*libartStore.ArtifactStore
}

func (r RealLibartifactStore) SystemContext() *types.SystemContext {
return r.ArtifactStore.SystemContext
Pull(ctx context.Context, ref libartifact.ArtifactReference, opts libimage.CopyOptions) (digest.Digest, error)
Inspect(ctx context.Context, asr libartifact.ArtifactStoreReference) (*libartifact.Artifact, error)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for old method signatures that should have been updated
echo "=== Searching for old Remove signature ==="
rg -n "Remove\(ctx context\.Context, name string" -g '*.go'

echo "=== Searching for old Pull signature ==="
rg -n "Pull\(ctx context\.Context, name string" -g '*.go'

echo "=== Searching for old SystemContext method ==="
rg -n "SystemContext\(\) \*types\.SystemContext" -g '*.go'

echo "=== Finding all LibartifactStore implementations ==="
rg -n "func.*Remove\(ctx context\.Context, asr" -g '*.go' -A 1

echo "=== Finding Pull implementations ==="
rg -n "func.*Pull\(ctx context\.Context, ref" -g '*.go' -A 1

echo "=== Finding Inspect implementations ==="
rg -n "func.*Inspect\(ctx context\.Context, asr" -g '*.go' -A 1

Repository: cri-o/cri-o

Length of output: 2794


🏁 Script executed:

#!/bin/bash
# Check the LibartifactStore interface definition
echo "=== LibartifactStore interface definition ==="
cat -n internal/ociartifact/libartifact_store.go | head -20

echo ""
echo "=== Mock implementation around SystemContext ==="
sed -n '260,275p' test/mocks/ociartifact/ociartifact.go

Repository: cri-o/cri-o

Length of output: 1330


Remove stale SystemContext() method from mock implementation

The mock in test/mocks/ociartifact/ociartifact.go still has a SystemContext() method (line 269) that is not defined in the LibartifactStore interface. All other method implementations (Remove, List, Pull, Inspect) are correctly updated; this orphaned mock method should be removed.

🤖 Prompt for AI Agents
In `@internal/ociartifact/libartifact_store.go` around lines 11 - 15, The mock
implementation contains an orphaned SystemContext() method that is not part of
the LibartifactStore interface; remove the SystemContext() method from the
ociartifact mock so the mock only implements the interface methods Remove, List,
Pull, and Inspect, ensuring the mock signature matches LibartifactStore exactly.

Comment on lines 54 to +60
) (manifestDigest *digest.Digest, err error) {
strRef := s.impl.DockerReferenceString(ref)
strRef := ref.DockerReference().String()

dgst, err := s.Pull(ctx, strRef, *opts)
artRef, err := libart.NewArtifactReference(strRef)
if err != nil {
return nil, fmt.Errorf("invalid reference: %w", err)
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Potential nil pointer dereference if DockerReference() returns nil.

ref.DockerReference() can return nil for non-Docker references. Calling .String() on a nil reference would panic.

🛡️ Proposed fix with nil check
 func (s *Store) Pull(
 	ctx context.Context,
 	ref types.ImageReference,
 	opts *libimage.CopyOptions,
 ) (manifestDigest *digest.Digest, err error) {
-	strRef := ref.DockerReference().String()
+	dockerRef := ref.DockerReference()
+	if dockerRef == nil {
+		return nil, fmt.Errorf("reference is not a Docker reference")
+	}
+	strRef := dockerRef.String()

 	artRef, err := libart.NewArtifactReference(strRef)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
) (manifestDigest *digest.Digest, err error) {
strRef := s.impl.DockerReferenceString(ref)
strRef := ref.DockerReference().String()
dgst, err := s.Pull(ctx, strRef, *opts)
artRef, err := libart.NewArtifactReference(strRef)
if err != nil {
return nil, fmt.Errorf("invalid reference: %w", err)
}
) (manifestDigest *digest.Digest, err error) {
dockerRef := ref.DockerReference()
if dockerRef == nil {
return nil, fmt.Errorf("reference is not a Docker reference")
}
strRef := dockerRef.String()
artRef, err := libart.NewArtifactReference(strRef)
if err != nil {
return nil, fmt.Errorf("invalid reference: %w", err)
}
🤖 Prompt for AI Agents
In `@internal/ociartifact/store.go` around lines 54 - 60, The code calls
ref.DockerReference().String() without checking for a nil DockerReference, which
can panic for non-Docker references; update the function to call
ref.DockerReference() into a local variable (e.g., dr := ref.DockerReference()),
check if dr == nil and handle that case (return a clear error or fall back to
ref.String() if appropriate), then pass dr.String() (or the fallback) into
libart.NewArtifactReference; reference the symbols DockerReference(), String(),
libart.NewArtifactReference, and the strRef variable when making the change.

@bitoku

bitoku commented Feb 5, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@bitoku

bitoku commented Feb 6, 2026

Copy link
Copy Markdown
Contributor Author

@cri-o/cri-o-maintainers PTAL

1 similar comment
@bitoku

bitoku commented Feb 16, 2026

Copy link
Copy Markdown
Contributor Author

@cri-o/cri-o-maintainers PTAL

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Feb 16, 2026
@openshift-ci

openshift-ci Bot commented Feb 16, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bitoku, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [bitoku,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 16, 2026
@openshift-merge-bot openshift-merge-bot Bot merged commit 57a6eba into cri-o:main Feb 16, 2026
85 of 91 checks passed
@bitoku

bitoku commented Feb 16, 2026

Copy link
Copy Markdown
Contributor Author

/cherry-pick release-1.35

@openshift-cherrypick-robot

Copy link
Copy Markdown

@bitoku: #9691 failed to apply on top of branch "release-1.35":

Applying: bump c/common, c/storage
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	internal/lib/checkpoint.go
M	internal/oci/runtime_oci.go
M	vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.go
A	vendor/github.com/cyphar/filepath-securejoin/.golangci.yml
M	vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md
M	vendor/github.com/cyphar/filepath-securejoin/VERSION
A	vendor/github.com/cyphar/filepath-securejoin/deprecated_linux.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/README.md
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/doc.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/lookup_linux.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/mkdir_linux.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/open_linux.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/openat2_linux.go
A	vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs/procfs_linux.go
M	vendor/github.com/klauspost/compress/flate/deflate.go
M	vendor/github.com/klauspost/compress/flate/huffman_bit_writer.go.git/rebase-apply/patch:7363: trailing whitespace.
   
.git/rebase-apply/patch:18322: trailing whitespace.
  
.git/rebase-apply/patch:21065: trailing whitespace.
  // exported logger. See Godoc. 
error: patch failed: vendor/github.com/klauspost/compress/README.md:27
error: vendor/github.com/klauspost/compress/README.md: patch does not apply
error: Did you hand edit your patch?
It does not apply to blobs recorded in its index.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

M	vendor/github.com/klauspost/compress/flate/stateless.go
M	vendor/modules.txt
Patch failed at 0001 bump c/common, c/storage

Details

In response to this:

/cherry-pick release-1.35

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@bitoku

bitoku commented Feb 16, 2026

Copy link
Copy Markdown
Contributor Author

I knew it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants