oci: walk: return error from Close if applicable

Since we are reading blobs we should definitely be returning errors from
the lookup.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

oci/casext/walk.go

@@ -101,7 +101,7 @@ var ErrSkipDescriptor = errors.New("[internal] do not recurse into descriptor")
 //       more than once. This is quite important for remote CAS implementations.
 type WalkFunc func(descriptorPath DescriptorPath) error
 
-func (ws *walkState) recurse(ctx context.Context, descriptorPath DescriptorPath) error {
+func (ws *walkState) recurse(ctx context.Context, descriptorPath DescriptorPath) (Err error) {
 	log.WithFields(log.Fields{
 		"digest": descriptorPath.Descriptor().Digest,
 	}).Debugf("-> ws.recurse")
@@ -129,7 +129,13 @@ func (ws *walkState) recurse(ctx context.Context, descriptorPath DescriptorPath)
 		}
 		return err
 	}
-	defer blob.Close()
+	defer func() {
+		err := blob.Close()
+		if Err == nil {
+			log.Warnf("during recursion blob %v had error on Close: %v", descriptor.Digest, err)
+			Err = err
+		}
+	}()
 
 	// Recurse into children.
 	for _, child := range childDescriptors(blob.Data) {