dotnet / dotnet/sdk

GeneratedContainerDigest is incorrect if the built image is not published anywhere

Open
#52,260 0 comments 0 reactions 0 assignees View on GitHub
Area-Containers
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

### Describe the bug
I'm attempting to get the digest of a built image, as input to attestation tools (and to ensure tags aren't maliciously overwritten), but the value is wrong or otherwise doesn't match the hash of the built image _if it's not published_.

More specifically, in order to get a "correct" value, it must either be pushed to a registry or zipped to an archive.

### To Reproduce

1. Create a simple project, eg via `dotnet new web --output repro`
2. Modify the `.csproj` to look like the following:
```csproj



Exe
net8.0
enable
enable

somerepo
someversion
OCI






```
3. Build the project image via `dotnet publish -t:PublishContainer`. This builds the image into your local docker/podman system, and also outputs the generated digest into `output.txt`.
4. Run `docker inspect somerepo:someversion --format '{{.Id}}'` to extract the image hash from the built image. Contrast with the value in `output.txt`, which is different.

On the other hand, if the image is packaged into an archive, the hash matches in both places. Starting from the above:
1. Run `dotnet publish -t:PublishContainer -p:ContainerArchiveOutputPath=something.tar` to generate the archive
2. Run `docker load --input something.tar`.
3. Inspect the uploaded docker image again, and compare the hash with the hash from `output.txt`. The hashes now match.

Also, when creating an archive it leaves off the container registry (eg, if you supplied `-p:ContainerRegistry=someregistry.com`, even though it's valid to include that information in the archive (saving an image does so).

### Further technical details
details of dotnet --info


.NET SDK:
Version: 8.0.415
Commit: 7bd5a8c970
Workload version: 8.0.400-manifests.c414f008
MSBuild version: 17.11.48+02bf66295

Runtime Environment:
OS Name: debian
OS Version: 12
OS Platform: Linux
RID: linux-x64
Base Path: /usr/share/dotnet/sdk/8.0.415/

.NET workloads installed:
Configured to use loose manifests when installing new manifests.
There are no installed workloads to display.

Host:
Version: 8.0.21
Architecture: x64
Commit: 362ab6669d

.NET SDKs installed:
8.0.415 [/usr/share/dotnet/sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.21 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 8.0.21 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.