expectedLayerDiffIDFlag expectation mismatch

[mtrmac]

@edsantiago reports in containers/common#2202 (comment) , that we see

`TOC digest "sha256:…" for layer "…" is present but "expected-layer-diffid" flag is not a string

By code inspection, that might be possible if the image write+read both happen in the same process (we are writing a digest.Digest, and expecting a string).

[mtrmac]

A reproducer (from the point of c/image; I didn’t immediately find a Podman/Buildah one, I suspect it requires some combination of pulling chunked and non-chunked versions of the same image to prepopulate the UncompressedDigest field + layer deduplication, but I didn’t spend much time looking):

# cat main.go 
package main

import (
	"context"
	"fmt"
	"os"

	"github.com/containers/image/v5/copy"
	"github.com/containers/image/v5/signature"
	"github.com/containers/image/v5/transports/alltransports"
	"github.com/containers/storage/pkg/reexec"
	"github.com/sirupsen/logrus"
)

func realMain() error {
	if len(os.Args) != 4 {
		return fmt.Errorf("usage: $this src intermediate dest")
	}

	ctx := context.Background()
	logrus.SetLevel(logrus.DebugLevel)

	srcRef, err := alltransports.ParseImageName(os.Args[1])
	if err != nil {
		return fmt.Errorf("%q: %w", os.Args[1], err)
	}
	midRef, err := alltransports.ParseImageName(os.Args[2])
	if err != nil {
		return fmt.Errorf("%q: %w", os.Args[2], err)
	}
	destRef, err := alltransports.ParseImageName(os.Args[3])
	if err != nil {
		return fmt.Errorf("%q: %w", os.Args[3], err)
	}

	policy := &signature.Policy{Default: []signature.PolicyRequirement{signature.NewPRInsecureAcceptAnything()}}
	policyContext, err := signature.NewPolicyContext(policy)
	if err != nil {
		return err
	}
	defer policyContext.Destroy()

	if _, err = copy.Image(ctx, policyContext, midRef, srcRef, nil); err != nil {
		return fmt.Errorf("first copy: %w", err)
	}
	if _, err = copy.Image(ctx, policyContext, destRef, midRef, nil); err != nil {
		return fmt.Errorf("second copy: %w", err)
	}
	return nil
}

func main() {
	if reexec.Init() {
		return
	}

	if err := realMain(); err != nil {
		fmt.Fprintf(os.Stderr, "%v\n", err.Error())
		os.Exit(1)
	}
}
# bin/podman rmi -a # required! does not trigger on a re-run otherwise
# go run ./main.go docker://quay.io/libpod/testimage:20241010 containers-storage:tmp dir:t
…
DEBU[0002] Retrieved partial blob sha256:d005489f1e59bed02315c1c34bb95b3f46a970a5fd20cdc73c93c6e279689dde 
…
second copy: TOC digest "sha256:c76138319d7e627d68d63400da4c699617607cd21bb2a982159ab35dc91963ab" for layer "3e9be8391183b829c476f875d3f34c550275cac7cb78371bd88fa05bc963b321" is present but "expected-layer-diffid" flag is not a string

[mtrmac]

Confirming that #2603 fixes this.