Get more information in case of failed syncing signed repos
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 31
- Forks
- 56
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 22
Description
Is your feature request related to a problem? Please describe.
Trying to sync signed - via cosign - repositories with filtered tags and enforcing the sync to mirror only signed content, but without including the sha256-{digest}.sig tag, will fail and no error will be presented.
Describe the solution you'd like
Consider the sync task as failed in case no manifests were synced because of the missing sig tag in the include-tags filter and "cosign repo".
Describe alternatives you've considered
We could provide a warning message (not sure if it would be better in docs or logs, maybe both) saying to not forget to include the sig tag in case of syncing filtered repos with cosign signatures and no sigstore.
Additional context
Steps to reproduce:
$ pulp container repository create --name foo
$ pulp container remote create --name foo --url "https://quay.io" --upstream-name=curl/curl --include-tags='["8.9.1"]'
$ curl -H 'content-type:application/json' -u<user>:<pass> -X POST ${BASE_ADDR}$(pulp container repository show --name foo |jq .pulp_href -r)sync/ -d '{"signed_only": true, "remote": '$(pulp container remote show --name foo |jq .pulp_href)'}'
From pulp logs, we can only see that the sync task completed:
('pulp [bd85f6a2fa13419cb3d67bb1163b1581]: ::ffff:127.0.0.1 - admin [30/Aug/2024:16:15:10 +0000] "GET /pulp/api/v3/tasks/0191a411-b9ce-71a1-899b-7a4bee062ece/ HTTP/1.0" 200 677 "-" "Pulp-CLI/0.27.1"',)
pulp [56bfc0cd783045c286b891070cd51235]: pulp_container.app.tasks.sync_stages:INFO: The unsigned image sha256:7dd57efcae8c9c2a611816151d731a02a31fab5ab9fb5e0ff877f43009944a51 can't be synced due to a requirement to sync signed content only.
pulp [56bfc0cd783045c286b891070cd51235]: pulpcore.tasking.tasks:INFO: Task completed 0191a411-b63a-7b30-9318-6251f74fb8cf
pulp [bd85f6a2fa13419cb3d67bb1163b1581]: pulpcore.tasking.tasks:INFO: Starting task 0191a411-b9ce-71a1-899b-7a4bee062ece
pulp [bd85f6a2fa13419cb3d67bb1163b1581]: pulpcore.tasking.tasks:INFO: Task completed 0191a411-b9ce-71a1-899b-7a4bee062ece
but checking the manifests, there is no synced manifest:
$ pulp container content -tmanifest list
[]
adding the .sig tag to the include-tags list will successfully sync the manifests:
pulp container remote create --name foo --url "https://quay.io" --upstream-name=curl/curl --include-tags='["8.9.1","sha256-7dd57efcae8c9c2a611816151d731a02a31fab5ab9fb5e0ff877f43009944a51.sig"]'
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the sync with the shown Pulp CLI and API commands, using filtered tags and signed_only, then inspect the sync task output and resulting manifest list. Done means the task clearly fails or emits the requested warning when the signature tag is excluded, while including the tag continues to sync the manifest.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100