Merge pull request #6353 from nalind/tags-and-digests

Handle tagged+digested references when processing --all-platforms

imagebuildah/build.go

@@ -564,8 +564,30 @@ func platformsForBaseImages(ctx context.Context, logger *logrus.Logger, dockerfi
 		for _, candidate := range resolved.PullCandidates {
 			ref, err := docker.NewReference(candidate.Value)
 			if err != nil {
-				logrus.Debugf("parsing image reference %q: %v", candidate.Value.String(), err)
-				continue
+				// github.com/containers/common/libimage.Runtime.Pull() will catch
+				// references that include both a tag and a digest, and drop the
+				// tag as part of pulling the image.  Fall back to doing roughly
+				// the same here.
+				var nonDigestedRef reference.Named
+				if named, err2 := reference.ParseNamed(candidate.Value.String()); err2 == nil {
+					_, isTagged := named.(reference.NamedTagged)
+					digested, isDigested := named.(reference.Digested)
+					if isTagged && isDigested {
+						if nonDigestedRef, err2 = reference.WithDigest(reference.TrimNamed(named), digested.Digest()); err2 != nil {
+							nonDigestedRef = nil
+						}
+					}
+				}
+				if nonDigestedRef == nil {
+					// not a tagged-and-digested reference, either, so log the original error
+					logrus.Debugf("parsing image reference %q: %v", candidate.Value.String(), err)
+					continue
+				}
+				ref, err = docker.NewReference(nonDigestedRef)
+				if err != nil {
+					logrus.Debugf("re-parsing image reference %q: %v", nonDigestedRef.String(), err)
+					continue
+				}
 			}
 			src, err := ref.NewImageSource(ctx, systemContext)
 			if err != nil {

tests/bud.bats

@@ -7049,6 +7049,20 @@ _EOF
   assert "$manifests" = "386 amd64 arm arm arm64 ppc64le s390x" "arch list in manifest"
 }
 
+@test "bud-multiple-platform-with-base-as-arg-with-tag-and-digest" {
+  outputlist=localhost/testlist
+  run_buildah build $WITH_POLICY_JSON \
+              --build-arg=foo=${SAFEIMAGE}@${SAFEIMAGE_DIGEST} \
+              --all-platforms \
+              --manifest $outputlist \
+              -f $BUDFILES/all-platform/Containerfile.default-arg \
+              $BUDFILES/all-platform
+
+  run_buildah manifest inspect $outputlist
+  manifests=$(jq -r '.manifests[].platform.architecture' <<< "$output" | sort | fmt)
+  assert "$manifests" = "amd64 arm64 ppc64le s390x" "arch list in manifest did not match ${SAFEIMAGE}@${SAFEIMAGE_DIGEST}"
+}
+
 @test "bud-multiple-platform for --all-platform with additional-build-context" {
   outputlist=localhost/testlist
   local contextdir=${TEST_SCRATCH_DIR}/bud/platform

tests/helpers.bash

@@ -23,6 +23,7 @@ SAFEIMAGE_REGISTRY=${SAFEIMAGE_REGISTRY:-quay.io}
 SAFEIMAGE_USER=${SAFEIMAGE_USER:-libpod}
 SAFEIMAGE_NAME=${SAFEIMAGE_NAME:-testimage}
 SAFEIMAGE_TAG=${SAFEIMAGE_TAG:-20221018}
+SAFEIMAGE_DIGEST=sha256:c782d03c968791b10300fb15478f7555be560329c5182ea27cba5fc299c98911
 SAFEIMAGE="${SAFEIMAGE:-$SAFEIMAGE_REGISTRY/$SAFEIMAGE_USER/$SAFEIMAGE_NAME:$SAFEIMAGE_TAG}"
 
 # Prompt to display when logging buildah commands; distinguish root/rootless