Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Manifest not displayed in GHCR UI when using attestations #900

Open
LeviPesin opened this issue Jul 7, 2023 · 9 comments
Open

Manifest not displayed in GHCR UI when using attestations #900

LeviPesin opened this issue Jul 7, 2023 · 9 comments
Labels
kind/upstream Changes need to be made on upstream project registry/github

Comments

@LeviPesin
Copy link

There is no problem with this:

No problem

- name: Push Docker image
  uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
  with:
    context: src
    tags: ${{ needs.metadata.outputs.tags }}
    labels: ${{ needs.metadata.outputs.labels }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
    load: true
- name: Push Docker image to GHCR
    run: docker push -a ghcr.io/${{ inputs.image-name }}

But a problem with this:

Breaks

- name: Push Docker image
  uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
  with:
    context: src
    tags: ${{ needs.metadata.outputs.tags }}
    labels: ${{ needs.metadata.outputs.labels }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
    push: true

Is this a GHCR problem or a problem with the action?

Expected behaviour (First code snippet)

image

Actual behaviour (Second code snippet)

image

As you can see some weird unknown/unknown architecture appears and GHCR can no longer read labels including license and description.

Logs

First log: https://pastebin.com/xVnafXKJ
Second log: https://pastebin.com/X4yyB9gx

@crazy-max
Copy link
Member

crazy-max commented Jul 7, 2023

Seems an issue with GHCR not being able to parse an OCI index or it tries to parse manifest attestations but fails to display infos from labels. Pure speculation but I think GitHub does not check the mime-type of the manifest on their side so it fails.

Can you try disabling provenance?:

- name: Push Docker image
  uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
  with:
    context: src
    tags: ${{ needs.metadata.outputs.tags }}
    labels: ${{ needs.metadata.outputs.labels }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
    push: true
    provenance: false

@crazy-max
Copy link
Member

@LeviPesin
Copy link
Author

LeviPesin commented Jul 7, 2023

But it seems the core issue -- moby/moby#43126 -- has been fixed already?
Or is GHCR using something else that reads OCI incorrectly?

It seems to display correctly with disabled proveance indeed.

@crazy-max
Copy link
Member

But it seems the core issue -- moby/moby#43126 -- has been fixed already?

Yes Docker tooling is fixed

Or is GHCR using something else that reads OCI incorrectly?

Maybe I don't know what GH is using internally. We had opened an internal discussion with them but no response yet. I'll keep you posted as soon as we know more.

@crazy-max crazy-max added the kind/upstream Changes need to be made on upstream project label Jul 7, 2023
@crazy-max crazy-max changed the title GHCR "breaks" on images built not with output: type=docker Manifest not displayed in GHCR UI when using attestations Jul 7, 2023
JosephKav added a commit to release-argus/Argus that referenced this issue Jul 19, 2023
ghcr/quay have been giving unknown/unknown images since I released 0.12.0

docker/build-push-action#900 (comment)
JosephKav added a commit to release-argus/Argus that referenced this issue Jul 19, 2023
ghcr/quay have been giving unknown/unknown images since I released 0.12.0

docker/build-push-action#900 (comment)
@aaomidi
Copy link

aaomidi commented Jan 23, 2024

@crazy-max have you learned more about this?

@kroese
Copy link

kroese commented Jan 23, 2024

@aaomidi This is fixed in BuildX 0.12 but Github runners still use 0.11.2 so you will have to be patient a bit longer...

@LeviPesin
Copy link
Author

Is there some estimation when GHCR would update to 0.12?

@kroese
Copy link

kroese commented Jan 24, 2024

Sorry, I mixed up two issues. I thought it was about GHCR not showing the description info for images. This can be solved by setting:

env:
     DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

in the metadata-action config and

annotations: ${{ steps.meta.outputs.annotations }}

in the build-push-action. But it requires BuildX 0.12 so it will work as soon as Github updates the workflow runners to that version. It does not require any change to GHCR at all.

But now I see this issue was about the unknown architecture, and that does require an update of GHCR and willl not be solved by BuildX 0.12, sorry.

@raoganeshr
Copy link

raoganeshr commented Aug 5, 2024

@crazy-max Did GitHub come back on when will this be addressed?

For us, this problem leads to creation of 3 image entries in GHCR. One is the main image and other two are the manifest and manifest list which are untagged. We have a workflow that deletes older images with a specific tag that also deletes untagged images which in turn ends up deleting the manifests causing the image pull to fail post the cleanup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/upstream Changes need to be made on upstream project registry/github
Projects
None yet
Development

No branches or pull requests

5 participants