Bump CI VMs: local cache registry is now zstd

.cirrus.yml

@@ -33,7 +33,7 @@ env:
     DEBIAN_NAME: "debian-13"
 
     # Image identifiers
-    IMAGE_SUFFIX: "c20241016t144444z-f40f39d13"
+    IMAGE_SUFFIX: "c20241017t115000z-f40f39d13"
 
     # EC2 images
     FEDORA_AMI: "fedora-aws-${IMAGE_SUFFIX}"

go.mod

@@ -20,7 +20,7 @@ require (
 	github.com/containers/libhvee v0.7.1
 	github.com/containers/ocicrypt v1.2.0
 	github.com/containers/psgo v1.9.0
-	github.com/containers/storage v1.55.1-0.20241008185503-a397602515fd
+	github.com/containers/storage v1.55.1-0.20241016074337-b417e8d6376d
 	github.com/containers/winquit v1.1.0
 	github.com/coreos/go-systemd/v22 v22.5.1-0.20231103132048-7d375ecc2b09
 	github.com/coreos/stream-metadata-go v0.4.4
@@ -153,7 +153,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/klauspost/compress v1.17.10 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/leodido/go-urn v1.2.4 // indirect
@@ -226,3 +226,7 @@ require (
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	tags.cncf.io/container-device-interface/specs-go v0.8.0 // indirect
 )
+
+replace github.com/containers/common => github.com/mtrmac/common v0.8.2-0.20241016204223-72dbc99f1898
+
+replace github.com/containers/image/v5 => github.com/mtrmac/image/v5 v5.0.0-20241016195457-6045533dd9a2

go.sum

@@ -79,14 +79,10 @@ github.com/containernetworking/plugins v1.5.1 h1:T5ji+LPYjjgW0QM+KyrigZbLsZ8jaX+
 github.com/containernetworking/plugins v1.5.1/go.mod h1:MIQfgMayGuHYs0XdNudf31cLLAC+i242hNm6KuDGqCM=
 github.com/containers/buildah v1.37.1-0.20241002152719-c68e17b4ffed h1:qiE4J6RukT5+a2wV+Xeimu0c4Xx6DZrdt8JiP3c9CY8=
 github.com/containers/buildah v1.37.1-0.20241002152719-c68e17b4ffed/go.mod h1:ytj7qYHUdP/p+2lAXVaFSHDyYFJZ3y1ikpFERypXbCI=
-github.com/containers/common v0.60.1-0.20241011155906-25644f144d66 h1:3Op65/b+uB4ech61GRBHNggW5aGDoChPUDG2++tkHB8=
-github.com/containers/common v0.60.1-0.20241011155906-25644f144d66/go.mod h1:GRT29AbW4CdqEWP/jSxHyUvV5fprOzsCdhsFhqJiU4s=
 github.com/containers/conmon v2.0.20+incompatible h1:YbCVSFSCqFjjVwHTPINGdMX1F6JXHGTUje2ZYobNrkg=
 github.com/containers/conmon v2.0.20+incompatible/go.mod h1:hgwZ2mtuDrppv78a/cOBNiCm6O0UMWGx1mu7P00nu5I=
 github.com/containers/gvisor-tap-vsock v0.7.5 h1:bTy4u3DOmmUPwurL6me2rsgfypAFDhyeJleUcQmBR/E=
 github.com/containers/gvisor-tap-vsock v0.7.5/go.mod h1:GW9jOqAEEGdaS20XwTYdm6KCYDHIulOE/yEEOabkoE4=
-github.com/containers/image/v5 v5.32.3-0.20240923171149-9e1153a28c46 h1:eIwxm8+oAoTk+PDuOTbZRFG1DBF5tAlFO+niIamyzaM=
-github.com/containers/image/v5 v5.32.3-0.20240923171149-9e1153a28c46/go.mod h1:GgaW+YZJaJmcGtyPZNtsggfM4BBYIMfu/fFK62ZKU0o=
 github.com/containers/libhvee v0.7.1 h1:dWGF5GLq9DZvXo3P8aDp3cNieL5eCaSell4UmeA/jY4=
 github.com/containers/libhvee v0.7.1/go.mod h1:fRKB3AyIqHMvq6xaeYhTpckM2cdoq0oecolyoiuLP7M=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
@@ -97,8 +93,8 @@ github.com/containers/ocicrypt v1.2.0 h1:X14EgRK3xNFvJEfI5O4Qn4T3E25ANudSOZz/sir
 github.com/containers/ocicrypt v1.2.0/go.mod h1:ZNviigQajtdlxIZGibvblVuIFBKIuUI2M0QM12SD31U=
 github.com/containers/psgo v1.9.0 h1:eJ74jzSaCHnWt26OlKZROSyUyRcGDf+gYBdXnxrMW4g=
 github.com/containers/psgo v1.9.0/go.mod h1:0YoluUm43Mz2UnBIh1P+6V6NWcbpTL5uRtXyOcH0B5A=
-github.com/containers/storage v1.55.1-0.20241008185503-a397602515fd h1:Yh3v4wrVxMpccXjA451OsF4CdKuQEEGCNDHtK84y+10=
-github.com/containers/storage v1.55.1-0.20241008185503-a397602515fd/go.mod h1:H3XVD+Fwqe26DEP+Ev3s9VmdtXlAd9rV/WFC+dgALSI=
+github.com/containers/storage v1.55.1-0.20241016074337-b417e8d6376d h1:pEpS4UWW++IMwvWHLOVRYPofnRWFora35fHx/XwM18c=
+github.com/containers/storage v1.55.1-0.20241016074337-b417e8d6376d/go.mod h1:1Yv4k1PJCLjKLhQ5N4TdH7+5ntDjRcy/dHcZQKRQ4fg=
 github.com/containers/winquit v1.1.0 h1:jArun04BNDQvt2W0Y78kh9TazN2EIEMG5Im6/JY7+pE=
 github.com/containers/winquit v1.1.0/go.mod h1:PsPeZlnbkmGGIToMPHF1zhWjBUkd8aHjMOr/vFcPxw8=
 github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
@@ -308,8 +304,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.10 h1:oXAz+Vh0PMUvJczoi+flxpnBEPxoER1IaAnU/NMPtT0=
-github.com/klauspost/compress v1.17.10/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
 github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
@@ -382,6 +378,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mtrmac/common v0.8.2-0.20241016204223-72dbc99f1898 h1:ohyVzuJ7y/DVuc5vVa/wZT8uwBiZU+eLkLQ0vujyf4E=
+github.com/mtrmac/common v0.8.2-0.20241016204223-72dbc99f1898/go.mod h1:T8vpUWd7AspK7CMELf/c+NCZB6bKrRkLriRCspdFGyQ=
+github.com/mtrmac/image/v5 v5.0.0-20241016195457-6045533dd9a2 h1:jv0/6AabBWh1KPQPTD9nefFwVvimQA0K+phljh8mNU8=
+github.com/mtrmac/image/v5 v5.0.0-20241016195457-6045533dd9a2/go.mod h1:Ulwf/jQO4757C/uOJyNiZ10dRiXRwVnyhF9wYFno3GQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=

test/system/010-images.bats

@@ -384,10 +384,17 @@ EOF
     is "${lines[-1]}" "$IMAGE true" "image from readwrite store"
 
     CONTAINERS_STORAGE_CONF=$sconf run_podman images -a -n --format "{{.Id}}"
-    id=${lines[-1]}
+    local cd=$(image_config_digest $IMAGE) # Without $sconf, i.e. from the read-write store.
 
     CONTAINERS_STORAGE_CONF=$sconf run_podman pull -q $IMAGE
-    is "$output" "$id" "pull -q $IMAGE, using storage.conf"
+    local cd2=$(CONTAINERS_STORAGE_CONF=$sconf image_config_digest $IMAGE)
+    assert "$cd2" = "$cd" "pull -q $IMAGE, using storage.conf"
+
+    # $IMAGE might now be reusing layers from the additional store;
+    # stopping to use the additional store can result in dangling layer references.
+    # Try to fix that up.
+    CONTAINERS_STORAGE_CONF=$sconf run_podman rmi $IMAGE
+    _prefetch $IMAGE
 
     run_podman --root $imstore/root rmi --all
 }

test/system/120-load.bats

@@ -23,21 +23,23 @@ function teardown() {
 # Custom helpers for this test only. These just save us having to duplicate
 # the same thing four times (two tests, each with -i and stdin).
 #
-# initialize, read image ID and name
-get_iid_and_name() {
+# initialize, read image ID, image config digest, and name
+get_icd_and_name() {
     run_podman images -a --format '{{.ID}} {{.Repository}}:{{.Tag}}'
     read iid img_name <<<"$output"
+    icd=$(image_config_digest "$img_name")
 
     archive=$PODMAN_TMPDIR/myimage-$(random_string 8).tar
 }
 
 # Simple verification of image ID and name
-verify_iid_and_name() {
-    run_podman images -a --format '{{.ID}} {{.Repository}}:{{.Tag}}'
-    read new_iid new_img_name < <(echo "$output")
+verify_icd_and_name() {
+    run_podman images -a --format '{{.Repository}}:{{.Tag}}'
+    read new_img_name < <(echo "$output")
+    new_icd=$(image_config_digest "$new_img_name")
 
     # Verify
-    is "$new_iid"      "$iid" "Image ID of loaded image == original"
+    is "$new_icd"      "$icd" "Image config digest of loaded image == original"
     is "$new_img_name" "$1"   "Name & tag of restored image"
 }
 
@@ -178,49 +180,49 @@ verify_iid_and_name() {
 
 @test "podman load - by image ID" {
     # FIXME: how to build a simple archive instead?
-    get_iid_and_name
+    get_icd_and_name
 
     # Save image by ID, and remove it.
     run_podman save $iid -o $archive
     run_podman rmi $iid
 
     # Load using -i; IID should be preserved, but name is not.
     run_podman load -i $archive
-    verify_iid_and_name "<none>:<none>"
+    verify_icd_and_name "<none>:<none>"
 
     # Same as above, using stdin
     run_podman rmi $iid
     run_podman load < $archive
-    verify_iid_and_name "<none>:<none>"
+    verify_icd_and_name "<none>:<none>"
 
     # Same as above, using stdin but with `podman image load`
     run_podman rmi $iid
     run_podman image load < $archive
-    verify_iid_and_name "<none>:<none>"
+    verify_icd_and_name "<none>:<none>"
 }
 
 @test "podman load - by image name" {
-    get_iid_and_name
+    get_icd_and_name
     run_podman save $img_name -o $archive
     run_podman rmi $iid
 
     # Load using -i; this time the image should be tagged.
     run_podman load -i $archive
-    verify_iid_and_name $img_name
+    verify_icd_and_name $img_name
     run_podman rmi $iid
 
     # Also make sure that `image load` behaves the same.
     run_podman image load -i $archive
-    verify_iid_and_name $img_name
+    verify_icd_and_name $img_name
     run_podman rmi $iid
 
     # Same as above, using stdin
     run_podman load < $archive
-    verify_iid_and_name $img_name
+    verify_icd_and_name $img_name
 }
 
 @test "podman load - from URL" {
-    get_iid_and_name
+    get_icd_and_name
     run_podman save $img_name -o $archive
     run_podman rmi $iid
 
@@ -234,7 +236,7 @@ verify_iid_and_name() {
             $IMAGE /bin/busybox-extras httpd -f -p 80
 
     run_podman load -i $SERVER/image.tar
-    verify_iid_and_name $img_name
+    verify_icd_and_name $img_name
 
     run_podman rm -f -t0 myweb
 }

test/system/150-login.bats

@@ -149,9 +149,8 @@ EOF
 }
 
 function _push_search_test() {
-    # Preserve image ID for later comparison against push/pulled image
-    run_podman inspect --format '{{.Id}}' $IMAGE
-    iid=$output
+    # Look up image config digest for later comparison against push/pulled image
+    local icd=$(image_config_digest $IMAGE)
 
     destname=ok-$(random_string 10 | tr A-Z a-z)-ok
     # Use command-line credentials
@@ -188,8 +187,8 @@ function _push_search_test() {
                localhost:${PODMAN_LOGIN_REGISTRY_PORT}/$destname
 
     # Compare to original image
-    run_podman inspect --format '{{.Id}}' $destname
-    is "$output" "$iid" "Image ID of pulled image == original IID"
+    local icd2=$(image_config_digest localhost:${PODMAN_LOGIN_REGISTRY_PORT}/$destname)
+    assert "$icd2" = "$icd" "config digest of pulled image == original digest"
 
     run_podman rmi $destname
 }
@@ -345,12 +344,12 @@ function _test_skopeo_credential_sharing() {
         $image1
     run_podman rmi $image1
 
-    run_podman images $IMAGE --format {{.ID}}
-    local podman_image_id=$output
+    local podman_image_cd=$(image_config_digest $IMAGE)
 
     run_podman pull -q --retry 4 --retry-delay "0s" --authfile=$authfile \
         --tls-verify=false $image1
-    assert "${output:0:12}" = "$podman_image_id" "First pull (before stopping registry)"
+    local pulled_image_cd=$(image_config_digest $output)
+    assert "$pulled_image_cd" = "$podman_image_cd" "First pull (before stopping registry)"
     run_podman rmi $image1
 
     # This actually STOPs the registry, so the port is unbound...
@@ -360,7 +359,8 @@ function _test_skopeo_credential_sharing() {
     run_podman 0+w pull -q --retry 4 --retry-delay "5s" --authfile=$authfile \
             --tls-verify=false $image1
     assert "$output" =~ "Failed, retrying in 5s.*Error: initializing.* connection refused"
-    assert "${lines[-1]:0:12}" = "$podman_image_id" "push should succeed via retry"
+    local pulled_image_cd2=$(image_config_digest "${lines[-1]:0:12}")
+    assert "$pulled_image_cd2" = "$podman_image_cd" "push should succeed via retry"
     unpause_registry
 
     run_podman rmi $image1

test/system/helpers.bash

@@ -847,6 +847,16 @@ function _ensure_container_running() {
     die "Timed out waiting for container $1 to enter state running=$2"
 }
 
+# Return the config digest of an image.
+# Historically, the image ID was a good indicator of “the same” image;
+# with zstd:chunked, the same image might have different IDs depending on whether
+# creating layers happened based on the TOC (and per-file operations) or the full layer tarball
+function image_config_digest() {
+    run skopeo inspect --raw --config "$0"
+    local sha_output=$(printf "$output" | sha256sum)
+    echo "${sha_output%% *}"
+}
+
 ###########################
 #  _add_label_if_missing  #  make sure skip messages include rootless/remote
 ###########################