check_layer_differences() incorrectly copies AMD64 result to ARM64 for multi-arch images, causing false "already synced" reports

[Elshayib]

Bug Report

Issue

In scripts/sync.sh, the check_layer_differences() function has a critical logic bug where ARM64 layer comparison incorrectly returns the same result as AMD64 for single-arch images, causing false "identical" reports.

Location

scripts/sync.sh lines 310-320 (in the check_layer_differences function)

Details

# For single-arch images, ARM64 diff is the same as AMD64
layer_diff_arm64=${layer_diff_amd64}

This line unconditionally sets layer_diff_arm64 to the value of layer_diff_amd64 for ALL images, not just single-arch ones. The comment says "For single-arch images, ARM64 diff is the same as AMD64" but there's NO CHECK for whether the image is actually single-arch.

The Bug:

1. For a multi-arch image where AMD64 layers match but ARM64 layers differ:

   • layer_diff_amd64 = 0 (identical)
   • layer_diff_arm64 = 0 (incorrectly copied from AMD64!)
   • Result: Reports "Already synced" when ARM64 layers are actually different

2. For a multi-arch image where AMD64 layers differ but ARM64 match:

   • layer_diff_amd64 = 1 (different)
   • layer_diff_arm64 = 1 (incorrectly copied)
   • Result: Correctly reports "different", but for the wrong reason

Root Cause

The multi_arch_enabled parameter IS passed to the function but is never used to gate this logic. The function checks it later for ARM64 inspection but not for this assignment.

Suggested Fix

# Only copy AMD64 result to ARM64 for single-arch images
if [[ "${multi_arch_enabled}" != "true" ]]; then
    layer_diff_arm64=${layer_diff_amd64}
fi

Or better yet, don't copy at all - just run the ARM64 inspection conditionally:

if [[ "${multi_arch_enabled}" == "true" ]]; then
    # ... existing ARM64 inspection code ...
else
    # Single-arch: ARM64 diff = AMD64 diff
    layer_diff_arm64=${layer_diff_amd64}
fi

Impact

• Severity: High - False positives cause multi-arch images with different ARM64 layers to be skipped during sync
• Affected scenarios: Any multi-arch image where AMD64 layers match but ARM64 don't (common when base images are updated differently per architecture)
• Silent data corruption: The ARM64 variant in destination registry becomes stale without any error or warning

Reproduction

1. Configure a multi-arch image in config/versions.yml
2. Have source with matching AMD64 layers but different ARM64 layers
3. Run sync - it will report "Already synced" and skip the ARM64 update