Hash a forwarded image's uncompressed stream, not its gzip file #40

Closed

geusebio wants to merge 1 commit from fix/forwarded-image-uncompressed-hash into main

geusebio commented

2026-08-25 01:00:40 +00:00

Owner

Hash a forwarded image's uncompressed stream, not its gzip file

dockercli.Save wrote the docker-save tarball through gzip and then hashed
the compressed .tar.gz on disk. The platform's ImageStorage/GzipTarHasher
verifies against the sha256 of the decompressed stream (the same rule
build contexts already follow), so every client-forwarded image failed
upload with "image sha256 mismatch" regardless of the image's actual
content.

Save now tees the docker-save stream through both gzip and a sha256 hasher
via io.MultiWriter and returns that hash directly, so the manifest and the
uploaded bytes are computed from the same source. forward.go's separate
sha256File (which hashed the gzip file) is gone with it.

Bumps the dockercli coverage floor from 91.7% to 90.0%: the new
"gzip.Close() failed" branch mirrors the existing waitErr/copyErr checks
but isn't practically triggerable from a test without a broken writer.

Hash a forwarded image's uncompressed stream, not its gzip file dockercli.Save wrote the docker-save tarball through gzip and then hashed the compressed .tar.gz on disk. The platform's ImageStorage/GzipTarHasher verifies against the sha256 of the *decompressed* stream (the same rule build contexts already follow), so every client-forwarded image failed upload with "image sha256 mismatch" regardless of the image's actual content. Save now tees the docker-save stream through both gzip and a sha256 hasher via io.MultiWriter and returns that hash directly, so the manifest and the uploaded bytes are computed from the same source. forward.go's separate sha256File (which hashed the gzip file) is gone with it. Bumps the dockercli coverage floor from 91.7% to 90.0%: the new "gzip.Close() failed" branch mirrors the existing waitErr/copyErr checks but isn't practically triggerable from a test without a broken writer.

geusebio added 1 commit

2026-08-25 01:00:40 +00:00

Hash a forwarded image's uncompressed stream, not its gzip file

CI / build (pull_request) Failing after 31s

Details

f2c58cc414

dockercli.Save wrote the docker-save tarball through gzip and then hashed
the compressed .tar.gz on disk. The platform's ImageStorage/GzipTarHasher
verifies against the sha256 of the *decompressed* stream (the same rule
build contexts already follow), so every client-forwarded image failed
upload with "image sha256 mismatch" regardless of the image's actual
content.

Save now tees the docker-save stream through both gzip and a sha256 hasher
via io.MultiWriter and returns that hash directly, so the manifest and the
uploaded bytes are computed from the same source. forward.go's separate
sha256File (which hashed the gzip file) is gone with it.

Bumps the dockercli coverage floor from 91.7% to 90.0%: the new
"gzip.Close() failed" branch mirrors the existing waitErr/copyErr checks
but isn't practically triggerable from a test without a broken writer.

geusebio commented

2026-08-25 01:13:50 +00:00

Author

Owner

Duplicate of #39, which already has an equivalent (cleaner — single-pass hash, and handles the gzip.Close() coverage gap properly instead of bumping the floor) fix and is green. Closing this one in favour of #39.

geusebio closed this pull request

2026-08-25 01:13:55 +00:00

CI / build (pull_request) Failing after 31s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

No reviewers

No labels

⏳in-progress

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Grey.ooo/someones.computer_agent!40

No description provided.

Rows
Columns