Number of descriptors that should be returned in referrers with filter conformance test?

[sstrollo]

Hi,

I have implemented an embedded registry that is part of our product here at Avassa, and I have always run the OCI conformance test to make sure it complies. But I hadn't implemented the referrers API, so I was running the v1.1.0-rc1 release up until now.

Last week I implemented the referrers API, and tried to up the test to the conformance test to first the v1.1.0-rc3, and then the latest main, but I still failed one test, the "GET request to existing blob with filter should yield 200", specifically the number of descriptors returned (03_discovery_test.go line 340). Specifically, the test expects there to be two descriptors, and my implementation returned only one. At this point I am a bit unsure if I've understood the spec completely, or if there is something wrong with the test. Here is output from a run from my implementation:

First the unfiltered referrers GET, "GET request to existing blob should yield 200"

~~~ REQUEST ~~~
GET  /v2/foo/bar/referrers/sha256:e0307b12b5d5a18a84662fd41610689c40c2fbc4091ccf24bdbda0025822cc95  HTTP/1.1
HOST   : 127.0.0.1:8888
HEADERS:
        Authorization: Basic YWxpY2U6c2VjcmV0
        User-Agent: distribution-spec-conformance-tests
BODY   :
***** NO CONTENT *****
------------------------------------------------------------------------------
~~~ RESPONSE ~~~
STATUS       : 200 OK
PROTO        : HTTP/1.1
RECEIVED AT  : 2023-10-02T10:01:12.129951+02:00
TIME DURATION: 617.625µs
HEADERS      :
        Content-Length: 1224
        Content-Type: application/vnd.oci.image.index.v1+json
        Date: Mon, 02 Oct 2023 08:01:12 GMT
        Server: Mona
BODY         :
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "artifactType": "application/vnd.nhl.peanut.butter.bagel",
         "digest": "sha256:6e54201a24c7de9de03f2dd1c22c56a94d7a6a1b63c873236e4eb94a2bcbb82f",
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         },
         "size": 771
      },
      {
         "digest": "sha256:8f43d76f0e445f2da55380e76cee1a415a5aa6aed69636064fd08a750319c478",
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         },
         "size": 711
      },
      {
         "digest": "sha256:b350164697784d931e533f8fe29505a4ab5b9564a9f0b8b1e87dcf42c6bdddd1",
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         },
         "size": 716
      },
      {
         "artifactType": "application/vnd.nba.strawberry.jam.croissant",
         "digest": "sha256:8a3101bad4ff22ca3356477a10f985c46416de94c6d8418e1e573c8351634678",
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         },
         "size": 781
      },
      {
         "artifactType": "application/vnd.food.stand",
         "digest": "sha256:8584abecd193777a1d21d60db596ad48143dc64ca076e20f762e008a4f8352e8",
         "mediaType": "application/vnd.oci.image.index.v1+json",
         "size": 769
      }
   ]
}

The next test does a filtered get, with the filter set to artifactType=vnd.nhl.peanut.butter.bagel, again output from my implementation:

~~~ REQUEST ~~~
GET  /v2/foo/bar/referrers/sha256:e0307b12b5d5a18a84662fd41610689c40c2fbc4091ccf24bdbda0025822cc95?artifactType=application%2Fvnd.nhl.peanut.butter.bagel  HTTP/1.1
HOST   : 127.0.0.1:8888
HEADERS:
        Authorization: Basic YWxpY2U6c2VjcmV0
        User-Agent: distribution-spec-conformance-tests
BODY   :
***** NO CONTENT *****
------------------------------------------------------------------------------
~~~ RESPONSE ~~~
STATUS       : 200 OK
PROTO        : HTTP/1.1
RECEIVED AT  : 2023-10-02T10:01:12.130739+02:00
TIME DURATION: 565.416µs
HEADERS      :
        Content-Length: 350
        Content-Type: application/vnd.oci.image.index.v1+json
        Date: Mon, 02 Oct 2023 08:01:12 GMT
        Oci-Filters-Applied: artifactType
        Server: Mona
BODY         :
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "artifactType": "application/vnd.nhl.peanut.butter.bagel",
         "digest": "sha256:6e54201a24c7de9de03f2dd1c22c56a94d7a6a1b63c873236e4eb94a2bcbb82f",
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         },
         "size": 771
      }
   ]
}

First of all, did I understand it right that I'm supposed to return OCI-Filters-Applied: artifactType (and not OCI-Filters-Applied: application/vnd.nhl.peanut.butter.bagel)? Second, isn't sha256:6e54201a24c7de9de03f2dd1c22c56a94d7a6a1b63c873236e4eb94a2bcbb82f the only manifest that matches? If that is the case, then I suspect the following should be done to the test:

diff --git a/conformance/03_discovery_test.go b/conformance/03_discovery_test.go
index bd54c3e..a7655ef 100644
--- a/conformance/03_discovery_test.go
+++ b/conformance/03_discovery_test.go
@@ -337,7 +337,7 @@ var test03ContentDiscovery = func() {
 
 				// also check resp header "OCI-Filters-Applied: artifactType" denoting that an artifactType filter was applied
 				if resp.Header().Get("OCI-Filters-Applied") != "" {
-					Expect(len(index.Manifests)).To(Equal(2))
+					Expect(len(index.Manifests)).To(Equal(1))
 					Expect(resp.Header().Get("OCI-Filters-Applied")).To(Equal(artifactTypeFilter))
 				} else {
 					Expect(len(index.Manifests)).To(Equal(5))

Or it could be that what I returned in the first GET was wrong, has anyone else implemented this?

Thanks,

/Sebastian

[sudo-bmitch]

There are two separate artifacts pushed with the testRefArtifactTypeA artifact type value, refsManifestAConfigArtifact, and refsManifestALayerArtifact. One has the artifactType explicitly set, the other has it inferred from the config.mediaType value. It looks like you didn't pull up the config media type with the artifactType isn't explicitly set.

I'm also confused that you have the platform set in the responses. Are you attempting to parse the config blob for artifacts with unknown media types?

[sstrollo]

Ahh - thank you! I had a feeling that I had missed something - will fix.

I'm also confused that you have the platform set in the responses. Are you attempting to parse the config blob for artifacts with unknown media types?

Well, yes, I am a bit unsure about that one too. My reasoning was like this, the Listing referrers section says that the registry should return an "image index containing a list of descriptors". And the in the image spec repo, it says "Descriptors pointing to application/vnd.oci.image.manifest.v1+json SHOULD include the extended field platform". So I assumed, since the "mediaType" is "application/vnd.oci.image.manifest.v1+json" (even thought the artifactType is "application/vnd.nhl.peanut.butter.bagel") that I was supposed to at least try to figure out the platform (and yes, I do it by parsing the config blob)...

[tianon]

You will likely enjoy opencontainers/image-spec#1131 😁

[sstrollo]

Indeed - I guess I just made his point :)

Thanks for the help and the pointers @sudo-bmitch and @tianon - much appreciated. I'm closing the issue, as it is obviously my bug and not a problem with the test.