2022-03-30 10:42:47 +02:00
|
|
|
// Copyright 2022 The Gitea Authors. All rights reserved.
|
2022-11-27 13:20:29 -05:00
|
|
|
// SPDX-License-Identifier: MIT
|
2022-03-30 10:42:47 +02:00
|
|
|
|
|
|
|
package container
|
|
|
|
|
|
|
|
import (
|
feat: support artifact uploads for OCI container packages (#8070)
# Fix OCI artifact uploads with`oras`
## Problem
ORAS (OCI Registry As Storage) artifact uploads were failing with several HTTP-related errors when pushing to Forgejo's container registry. This prevented users from storing OCI artifacts like `artifacthub-repo.yaml` in commands like `oras push [...] artifacthub-repo.yaml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml`.
This has been discussed previously in https://github.com/go-gitea/gitea/issues/25846
## Root Causes and Fixes
### 1. Missing Content-Length for Empty Blobs
**Issue**: Empty blobs (size 0) were not getting the required `Content-Length: 0` header, causing ORAS to fail with "unknown response Content-Length".
**Fix**: Changed the condition in `setResponseHeaders` from `if h.ContentLength != 0` to `if h.ContentLength >= 0` to ensure the Content-Length header is always set for valid blob sizes.
```go
// Before
if h.ContentLength != 0 {
resp.Header().Set("Content-Length", strconv.FormatInt(h.ContentLength, 10))
}
// After
if h.ContentLength >= 0 {
resp.Header().Set("Content-Length", strconv.FormatInt(h.ContentLength, 10))
}
```
### 2. Content-Length Mismatch in JSON Error Responses
**Issue**: The `jsonResponse` function was calling `WriteHeader()` before writing JSON content, causing "wrote more than the declared Content-Length" errors when the HTTP stack calculated a different Content-Length than what was actually written.
**Fix**: Modified `jsonResponse` to buffer JSON content first, calculate the exact Content-Length, then write the complete response.
### 3. Incomplete HTTP Responses in Error Handling
**Issue**: The `apiError` function was only setting response headers without writing any response body, causing EOF errors when clients expected a complete HTTP response.
**Fix**: Updated `apiError` to write proper JSON error responses following the OCI Distribution Specification format with `code` and `message` fields.
### 4. Empty Config Blob Handling for OCI Artifacts
**Issue**: OCI artifacts often have empty config blobs (required by spec but contain no data). The JSON decoder was failing with EOF when trying to parse these empty configs.
**Fix**: Added EOF handling in `parseOCIImageConfig` to return a valid default metadata object for empty config blobs.
```go
if err := json.NewDecoder(r).Decode(&image); err != nil {
// Handle empty config blobs (common in OCI artifacts)
if err == io.EOF {
return &Metadata{
Type: TypeOCI,
Platform: DefaultPlatform,
}, nil
}
return nil, err
}
```
## Testing
Verified that ORAS artifact uploads now work correctly:
```bash
oras push registry/owner/package:artifacthub.io \
--config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
artifacthub-repo.yaml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
```
### Tests
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8070
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: pat-s <patrick.schratz@gmail.com>
Co-committed-by: pat-s <patrick.schratz@gmail.com>
2025-06-09 10:14:53 +02:00
|
|
|
"io"
|
2022-03-30 10:42:47 +02:00
|
|
|
"strings"
|
|
|
|
"testing"
|
|
|
|
|
2025-03-27 19:40:14 +00:00
|
|
|
"forgejo.org/modules/packages/container/helm"
|
2022-03-30 10:42:47 +02:00
|
|
|
|
2023-02-06 11:07:09 +01:00
|
|
|
oci "github.com/opencontainers/image-spec/specs-go/v1"
|
2022-03-30 10:42:47 +02:00
|
|
|
"github.com/stretchr/testify/assert"
|
2024-07-30 19:41:10 +00:00
|
|
|
"github.com/stretchr/testify/require"
|
2022-03-30 10:42:47 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
func TestParseImageConfig(t *testing.T) {
|
|
|
|
description := "Image Description"
|
|
|
|
author := "Gitea"
|
|
|
|
license := "MIT"
|
2023-08-27 19:59:12 +08:00
|
|
|
projectURL := "https://gitea.com"
|
2022-03-30 10:42:47 +02:00
|
|
|
repositoryURL := "https://gitea.com/gitea"
|
2023-08-27 19:59:12 +08:00
|
|
|
documentationURL := "https://docs.gitea.com"
|
2022-03-30 10:42:47 +02:00
|
|
|
|
|
|
|
configOCI := `{"config": {"labels": {"` + labelAuthors + `": "` + author + `", "` + labelLicenses + `": "` + license + `", "` + labelURL + `": "` + projectURL + `", "` + labelSource + `": "` + repositoryURL + `", "` + labelDocumentation + `": "` + documentationURL + `", "` + labelDescription + `": "` + description + `"}}, "history": [{"created_by": "do it 1"}, {"created_by": "dummy #(nop) do it 2"}]}`
|
|
|
|
|
2023-02-06 11:07:09 +01:00
|
|
|
metadata, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader(configOCI))
|
2024-07-30 19:41:10 +00:00
|
|
|
require.NoError(t, err)
|
2022-03-30 10:42:47 +02:00
|
|
|
|
|
|
|
assert.Equal(t, TypeOCI, metadata.Type)
|
|
|
|
assert.Equal(t, description, metadata.Description)
|
|
|
|
assert.ElementsMatch(t, []string{author}, metadata.Authors)
|
|
|
|
assert.Equal(t, license, metadata.Licenses)
|
|
|
|
assert.Equal(t, projectURL, metadata.ProjectURL)
|
|
|
|
assert.Equal(t, repositoryURL, metadata.RepositoryURL)
|
|
|
|
assert.Equal(t, documentationURL, metadata.DocumentationURL)
|
2023-04-22 23:56:27 +02:00
|
|
|
assert.ElementsMatch(t, []string{"do it 1", "do it 2"}, metadata.ImageLayers)
|
2022-03-30 10:42:47 +02:00
|
|
|
assert.Equal(
|
|
|
|
t,
|
|
|
|
map[string]string{
|
|
|
|
labelAuthors: author,
|
|
|
|
labelLicenses: license,
|
|
|
|
labelURL: projectURL,
|
|
|
|
labelSource: repositoryURL,
|
|
|
|
labelDocumentation: documentationURL,
|
|
|
|
labelDescription: description,
|
|
|
|
},
|
|
|
|
metadata.Labels,
|
|
|
|
)
|
2023-04-02 11:53:37 +02:00
|
|
|
assert.Empty(t, metadata.Manifests)
|
2022-03-30 10:42:47 +02:00
|
|
|
|
|
|
|
configHelm := `{"description":"` + description + `", "home": "` + projectURL + `", "sources": ["` + repositoryURL + `"], "maintainers":[{"name":"` + author + `"}]}`
|
|
|
|
|
2023-02-06 11:07:09 +01:00
|
|
|
metadata, err = ParseImageConfig(helm.ConfigMediaType, strings.NewReader(configHelm))
|
2024-07-30 19:41:10 +00:00
|
|
|
require.NoError(t, err)
|
2022-03-30 10:42:47 +02:00
|
|
|
|
|
|
|
assert.Equal(t, TypeHelm, metadata.Type)
|
|
|
|
assert.Equal(t, description, metadata.Description)
|
|
|
|
assert.ElementsMatch(t, []string{author}, metadata.Authors)
|
|
|
|
assert.Equal(t, projectURL, metadata.ProjectURL)
|
|
|
|
assert.Equal(t, repositoryURL, metadata.RepositoryURL)
|
|
|
|
}
|
feat: support artifact uploads for OCI container packages (#8070)
# Fix OCI artifact uploads with`oras`
## Problem
ORAS (OCI Registry As Storage) artifact uploads were failing with several HTTP-related errors when pushing to Forgejo's container registry. This prevented users from storing OCI artifacts like `artifacthub-repo.yaml` in commands like `oras push [...] artifacthub-repo.yaml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml`.
This has been discussed previously in https://github.com/go-gitea/gitea/issues/25846
## Root Causes and Fixes
### 1. Missing Content-Length for Empty Blobs
**Issue**: Empty blobs (size 0) were not getting the required `Content-Length: 0` header, causing ORAS to fail with "unknown response Content-Length".
**Fix**: Changed the condition in `setResponseHeaders` from `if h.ContentLength != 0` to `if h.ContentLength >= 0` to ensure the Content-Length header is always set for valid blob sizes.
```go
// Before
if h.ContentLength != 0 {
resp.Header().Set("Content-Length", strconv.FormatInt(h.ContentLength, 10))
}
// After
if h.ContentLength >= 0 {
resp.Header().Set("Content-Length", strconv.FormatInt(h.ContentLength, 10))
}
```
### 2. Content-Length Mismatch in JSON Error Responses
**Issue**: The `jsonResponse` function was calling `WriteHeader()` before writing JSON content, causing "wrote more than the declared Content-Length" errors when the HTTP stack calculated a different Content-Length than what was actually written.
**Fix**: Modified `jsonResponse` to buffer JSON content first, calculate the exact Content-Length, then write the complete response.
### 3. Incomplete HTTP Responses in Error Handling
**Issue**: The `apiError` function was only setting response headers without writing any response body, causing EOF errors when clients expected a complete HTTP response.
**Fix**: Updated `apiError` to write proper JSON error responses following the OCI Distribution Specification format with `code` and `message` fields.
### 4. Empty Config Blob Handling for OCI Artifacts
**Issue**: OCI artifacts often have empty config blobs (required by spec but contain no data). The JSON decoder was failing with EOF when trying to parse these empty configs.
**Fix**: Added EOF handling in `parseOCIImageConfig` to return a valid default metadata object for empty config blobs.
```go
if err := json.NewDecoder(r).Decode(&image); err != nil {
// Handle empty config blobs (common in OCI artifacts)
if err == io.EOF {
return &Metadata{
Type: TypeOCI,
Platform: DefaultPlatform,
}, nil
}
return nil, err
}
```
## Testing
Verified that ORAS artifact uploads now work correctly:
```bash
oras push registry/owner/package:artifacthub.io \
--config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
artifacthub-repo.yaml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
```
### Tests
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8070
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: pat-s <patrick.schratz@gmail.com>
Co-committed-by: pat-s <patrick.schratz@gmail.com>
2025-06-09 10:14:53 +02:00
|
|
|
|
|
|
|
func TestParseImageConfigEmptyBlob(t *testing.T) {
|
|
|
|
t.Run("Empty config blob (EOF)", func(t *testing.T) {
|
|
|
|
// Test empty reader (simulates empty config blob common in OCI artifacts)
|
|
|
|
metadata, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader(""))
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
assert.Equal(t, TypeOCI, metadata.Type)
|
|
|
|
assert.Equal(t, DefaultPlatform, metadata.Platform)
|
|
|
|
assert.Empty(t, metadata.Description)
|
|
|
|
assert.Empty(t, metadata.Authors)
|
|
|
|
assert.Empty(t, metadata.Labels)
|
|
|
|
assert.Empty(t, metadata.Manifests)
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("Empty JSON object", func(t *testing.T) {
|
|
|
|
// Test minimal valid JSON config
|
|
|
|
metadata, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader("{}"))
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
assert.Equal(t, TypeOCI, metadata.Type)
|
|
|
|
assert.Equal(t, DefaultPlatform, metadata.Platform)
|
|
|
|
assert.Empty(t, metadata.Description)
|
|
|
|
assert.Empty(t, metadata.Authors)
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("Invalid JSON still returns error", func(t *testing.T) {
|
|
|
|
// Test that actual JSON errors (not EOF) are still returned
|
|
|
|
_, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader("{invalid json"))
|
|
|
|
require.Error(t, err)
|
|
|
|
assert.NotEqual(t, io.EOF, err)
|
|
|
|
})
|
|
|
|
|
|
|
|
t.Run("OCI artifact with empty config", func(t *testing.T) {
|
|
|
|
// Test OCI artifact scenario with minimal config
|
|
|
|
configOCI := `{"config": {}}`
|
|
|
|
metadata, err := ParseImageConfig(oci.MediaTypeImageManifest, strings.NewReader(configOCI))
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
assert.Equal(t, TypeOCI, metadata.Type)
|
|
|
|
assert.Equal(t, DefaultPlatform, metadata.Platform)
|
|
|
|
assert.Empty(t, metadata.Description)
|
|
|
|
assert.Empty(t, metadata.Authors)
|
|
|
|
assert.Empty(t, metadata.ImageLayers)
|
|
|
|
})
|
|
|
|
}
|