Skip to content

validate: skip non-layer layers#2298

Merged
Subserial merged 1 commit into
google:mainfrom
imjasonh:validate-attestation-layers
May 14, 2026
Merged

validate: skip non-layer layers#2298
Subserial merged 1 commit into
google:mainfrom
imjasonh:validate-attestation-layers

Conversation

@imjasonh

@imjasonh imjasonh commented May 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Docker Official Images like busybox and ubuntu now include "layers" in image manifests that are not layers, but are instead in-toto attestations about the layers. This confuses 'crane validate', which expected layers to be gzipped tarballs.

$ crane validate --remote=busybox
FAIL: busybox: validating children: failed to validate image Manifests[1](sha256:85018c50e23d1abd4dddbcfd55c5b7ee6516e956376e882eaa1b6009fbb2cc9b): validating layers: gzip: invalid header
failed to validate image Manifests[3](sha256:746ece13b4b267510484033c6b612a64e04fc32345321a159148b3894f6c79ef): validating layers: gzip: invalid header
failed to validate image Manifests[6](sha256:9e3e867b9f5db234dd756639e86d932c3c20f9d73610f80827d51ea73ddd708f): validating layers: gzip: invalid header
...

This change skips validation of layers that are not a layer media type.

With this change:

$ go run ./cmd/crane validate --remote=busybox
PASS: busybox

@imjasonh
validate: skip non-layer layers
e284282 
Docker Official Images like busybox and ubuntu now include "layers" in image manifests that are not layers, but are instead in-toto attestations about the layers. This confuses 'crane validate', which expected layers to be gzipped tarballs.

This change skips validation of layers that are not a layer media type.

With this change:

    $ go run ./cmd/crane validate --remote=busybox
    PASS: busybox

Signed-off-by: Jason Hall <imjasonh@gmail.com>
@google-cla

google-cla Bot commented May 14, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@codecov-commenter

codecov-commenter commented May 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.73%. Comparing base (8b3c303) to head (e284282).
⚠️ Report is 113 commits behind head on main.

Files with missing lines Patch % Lines
pkg/v1/validate/image.go 0.00% 10 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (8b3c303) and HEAD (e284282). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (8b3c303) HEAD (e284282)
2 1
Additional details and impacted files 
@@             Coverage Diff             @@
##             main    #2298       +/-   ##
===========================================
- Coverage   71.67%   56.73%   -14.94%     
===========================================
  Files         123      165       +42     
  Lines        9935    11259     +1324     
===========================================
- Hits         7121     6388      -733     
- Misses       2115     4112     +1997     
- Partials      699      759       +60

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Subserial Subserial merged commit 78bdf1b into google:main May 14, 2026
17 checks passed
Subserial pushed a commit to Subserial/go-containerregistry that referenced this pull request May 15, 2026
@imjasonh @Subserial
validate: skip non-layer layers (google#2298)
1632d94 
Docker Official Images like busybox and ubuntu now include "layers" in image manifests that are not layers, but are instead in-toto attestations about the layers. This confuses 'crane validate', which expected layers to be gzipped tarballs.

This change skips validation of layers that are not a layer media type.

With this change:

    $ go run ./cmd/crane validate --remote=busybox
    PASS: busybox

Signed-off-by: Jason Hall <imjasonh@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Subserial Subserial Subserial approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@imjasonh @codecov-commenter @Subserial