Make dangerzone-image prepare-archive work with new buildkit versions

[almet]

Accept OCI image indexes as multi-arch container images In addition to Docker manifest lists.

BuildKit 0.31.0 and later pushes OCI image indexes by default, which made dangerzone-image prepare-archive fail with InvalidMutliArchImage against newly published images.

[apyrgio]

Other than dangerzone-image prepare-archive, is regular Dangerzone affected? Asking to make sure that previous Dangerzone releases can handle the new image types.

[almet]

They're not affected, this only affects the "prepare-archive" codepath

[deeplow]

Look at the code, that's also the only code path I see directly into IMAGE_LIST_MEDIA_TYPE.

But get_manifest has an Accept header that I supposed could lead to a refusal in fetching the resource:

def get_manifest(image_str: str) -> requests.Response:
    """Get manifest information for a specific tag"""
    image = parse_image_location(image_str)
    if image.digest:
        manifest_url = f"{_url(image)}/manifests/{image.digest}"
    else:
        manifest_url = f"{_url(image)}/manifests/{image.tag}"
    headers = {
        "Accept": ACCEPT_MANIFESTS_HEADER,
    }
    headers.update(_get_auth_header(image))

    ...

But I'm not sure which comment this is ultimately called in.

[deeplow]

@apyrgio for now the plan is to release with a buildkit version that regenerated the old headers, so I don't think we're run the risk download failures in this next release, but we should definitely have this in the release test plan (just as a sanity-check).

[almet]

But get_manifest has an Accept header that [...] could lead to a refusal in fetching the resource:

Don't worry :-)

The client provides the Accept header of all the resources it can accept, and the server decides to return them if it has content types that match. Here, IMAGE_INDEX_MEDIA_TYPE and IMAGE_LIST_MEDIA_TYPE are part of the Accept header provided to the server.

I validated that in practice, upgrading Dangerzone to images built with BuildKit v0.31.0 (using the new OCI Media Type, by changing share/dangerzone-image.txt) works properly, and so only the prepare-archive code path would be impacted.

We decided to pin images to BuildKit 0.30.0 for now, until we have a way to prepare images with at least one version of DZ (that will be 0.11.1).

[deeplow]

OK. Great. Thanks for the due diligence!