Merge pull request #29 from imjasonh/fix/digest-only-images

Fix: Remove automatic image tagging, make it optional

.github/workflows/ci.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  RUSTFLAGS: "--cfg ci"
 
 jobs:
   test:
@@ -20,8 +19,7 @@ jobs:
         rust: [stable, beta]
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Install Rust
+    - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master
-      uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master
       with:
         toolchain: ${{ matrix.rust }}
         targets: x86_64-unknown-linux-musl,aarch64-unknown-linux-musl
@@ -44,14 +42,12 @@ jobs:
       with:
         path: target
         key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
-    - name: Verify cross-compilation setup
+
-      run: make verify-cross-compile
+    - run: make verify-cross-compile
-    - name: Build
+    - run: make build
-      run: make build-verbose
+    - run: make test
-    - name: Run unit tests
+    - run: make test-e2e
-      run: make test-verbose
+    #- run: make run-built-image
-    - name: Run e2e tests
-      run: make test-e2e-verbose
 
   fmt:
     name: Rustfmt
@@ -93,114 +89,6 @@ jobs:
     - name: Run security audit
       run: cargo audit
 
-  integration:
-    name: Integration Test
-    runs-on: ubuntu-latest
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-      with:
-        toolchain: stable
-        targets: x86_64-unknown-linux-musl,aarch64-unknown-linux-musl
-    - name: Install musl tools
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y musl-tools gcc-aarch64-linux-gnu
-    - name: Setup cargo config for cross-compilation
-      run: |
-        mkdir -p .cargo
-        cat > .cargo/config.toml << 'EOF'
-        [target.x86_64-unknown-linux-musl]
-        linker = "x86_64-linux-musl-gcc"
-
-        [target.aarch64-unknown-linux-musl]
-        linker = "aarch64-linux-gnu-gcc"
-        EOF
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-    - name: Build krust
-      run: cargo build --release
-    - name: Add krust to PATH
-      run: echo "${{ github.workspace }}/target/release" >> $GITHUB_PATH
-    - name: Test krust version
-      run: krust version
-    - name: Build and run example with krust
-      run: |
-        cd example/hello-krust
-        # Build and push to ttl.sh (ephemeral registry)
-        export KRUST_REPO=ttl.sh/${{ github.run_id }}
-        IMAGE_REF=$(krust build ./)
-        echo "Built image: $IMAGE_REF"
-        # Run the image
-        docker run --rm $IMAGE_REF
-    - name: Test docker run with command substitution
-      run: |
-        cd example/hello-krust
-        export KRUST_REPO=ttl.sh/${{ github.run_id }}-test2
-        docker run --rm $(krust build ./)
-    - name: Test build with --no-push
-      run: |
-        cd example/hello-krust
-        krust build --no-push --image local.test/hello:latest ./
-    - name: Test multi-arch build and run
-      run: |
-        cd example/hello-krust
-        # Build for both platforms and push
-        export KRUST_REPO=ttl.sh/${{ github.run_id }}-multiarch
-        IMAGE_REF=$(krust build --platform linux/amd64,linux/arm64 ./)
-        echo "Built multi-arch image: $IMAGE_REF"
-        # Run the image - should automatically select the right architecture
-        docker run --rm $IMAGE_REF
-
-  # Test extended platform support
-  extended-platforms:
-    name: Extended Platform Support
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-      with:
-        toolchain: stable
-        targets: x86_64-unknown-linux-musl,i686-unknown-linux-musl,aarch64-unknown-linux-musl,armv7-unknown-linux-musleabihf
-    - name: Install cross-compilation tools
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y musl-tools gcc-multilib
-    - name: Setup cargo config
-      run: |
-        mkdir -p .cargo
-        cat > .cargo/config.toml << 'EOF'
-        [target.x86_64-unknown-linux-musl]
-        linker = "x86_64-linux-musl-gcc"
-
-        [target.i686-unknown-linux-musl]
-        linker = "musl-gcc"
-        rustflags = ["-C", "target-cpu=i686"]
-
-        [target.aarch64-unknown-linux-musl]
-        linker = "aarch64-linux-gnu-gcc"
-
-        [target.armv7-unknown-linux-musleabihf]
-        linker = "arm-linux-gnueabihf-gcc"
-        EOF
-    - name: Build krust
-      run: cargo build --release
-    - name: Test multi-platform build with Alpine base
-      run: |
-        # Test that platform detection works (even if we can't build all platforms)
-        ./target/release/krust build --no-push --image test.local/alpine-test:latest ./example/alpine-base 2>&1 | tee build.log
-
-        # Verify platform detection happened
-        grep -q "Detecting available platforms from base image: alpine:latest" build.log
-        grep -q "Found platforms:" build.log
-
   # Takes too long to run on CI, so it's commented out for now.
   # coverage:
   #   name: Code coverage

Makefile

@@ -5,10 +5,6 @@ TEST_FLAGS := -- --test-threads=1
 
 # Build the project
 build:
-	cargo build
-
-# Build verbosely
-build-verbose:
 	cargo build --verbose
 
 # Setup cargo config for cross-compilation
@@ -16,7 +12,7 @@ setup-cross-compile:
 	@mkdir -p .cargo
 	@cat > .cargo/config.toml <<'EOF'
 	[target.x86_64-unknown-linux-musl]
-	linker = "x86_64-linux-musl-gcc"
+	linker = "musl-gcc"
 
 	[target.aarch64-unknown-linux-musl]
 	linker = "aarch64-linux-gnu-gcc"
@@ -56,21 +52,13 @@ run:
 # Run all tests
 test: test-unit test-e2e
 
-# Run all tests verbosely (for CI)
-test-verbose:
-	cargo test --verbose $(TEST_FLAGS)
-
 # Run unit tests only
 test-unit:
-	cargo test --lib --bins $(TEST_FLAGS)
+	cargo test --verbose --lib --bins $(TEST_FLAGS)
 
 # Run e2e tests only
 test-e2e:
-	cargo test --test '*' $(TEST_FLAGS)
+	cargo test --verbose --test '*' $(TEST_FLAGS)
-
-# Run e2e tests verbosely (for CI)
-test-e2e-verbose:
-	cargo test --test '*' --verbose $(TEST_FLAGS)
 
 # Clean build artifacts
 clean:
@@ -94,3 +82,16 @@ check-code:
 
 # Run all checks (format, lint, test)
 check: check-fmt lint test
+
+push-ttl:
+	@echo "Pushing to ttl.sh..."
+	KRUST_REPO=ttl.sh/jason cargo run build ./example/hello-krust
+
+push-gar:
+	@echo "Pushing to gar.sh..."
+	KRUST_REPO=us-central1-docker.pkg.dev/jason-chainguard/krust cargo run build ./example/hello-krust
+
+run-built-image:
+	@image=$$(KRUST_REPO=ttl.sh/jason cargo run build ./example/hello-krust) && \
+	echo "Running image: $$image" && \
+	docker run --rm $$image

src/cli/mod.rs

@@ -34,6 +34,10 @@ pub enum Commands {
         #[arg(long)]
         no_push: bool,
 
+        /// Tag to apply to the manifest list (e.g., latest, v1.0.0)
+        #[arg(long)]
+        tag: Option<String>,
+
         /// Repository prefix (e.g., ghcr.io/username)
         #[arg(long, env = "KRUST_REPO")]
         repo: Option<String>,

src/main.rs

@@ -34,6 +34,7 @@ async fn main() -> Result<()> {
             image,
             platform,
             no_push,
+            tag,
             repo,
             cargo_args,
         } => {
@@ -48,15 +49,19 @@ async fn main() -> Result<()> {
                 .base_image
                 .unwrap_or(config.base_image.clone());
 
-            // Determine the image name
+            // Determine the base repository name (without any tag)
-            let image_ref = if let Some(image) = image {
+            let target_repo = if let Some(image) = image {
-                // Use explicit image if provided
+                // Use explicit image if provided, strip any tag/digest
-                image
+                if let Some(pos) = image.rfind([':', '@']) {
+                    image[..pos].to_string()
+                } else {
+                    image
+                }
             } else {
-                // Build image name from repo and project name
+                // Build repository name from repo and project name
                 let repo = repo.context("Either --image or KRUST_REPO must be set")?;
                 let project_name = get_project_name(&project_path)?;
-                format!("{}/{}:latest", repo, project_name)
+                format!("{}/{}", repo, project_name)
             };
 
             // Initialize registry client
@@ -123,26 +128,12 @@ async fn main() -> Result<()> {
 
                     let layers = vec![(layer_data, manifest.layers[0].media_type.clone())];
 
-                    // For manifest lists to work properly, we need to push to a consistent location
-                    // We'll use the base image ref with a unique tag for each platform
-                    let (base_ref, _) = if let Some(pos) = image_ref.rfind(':') {
-                        (
-                            image_ref[..pos].to_string(),
-                            image_ref[pos + 1..].to_string(),
-                        )
-                    } else {
-                        (image_ref.to_string(), "latest".to_string())
-                    };
-
-                    // Create a unique tag for this platform to avoid conflicts
-                    let platform_tag = format!("platform-{}", platform_str.replace('/', "-"));
-                    let platform_ref = format!("{}:{}", base_ref, platform_tag);
-
                     // Get auth for the target registry
-                    let push_auth = resolve_auth(&platform_ref)?;
+                    let push_auth = resolve_auth(&target_repo)?;
 
+                    // Push platform image by digest only (no tags)
                     let (digest_ref, manifest_size) = registry_client
-                        .push_image(&platform_ref, config_data, layers, &push_auth)
+                        .push_image_by_digest(&target_repo, config_data, layers, &push_auth)
                         .await?;
 
                     // Parse platform string
@@ -180,14 +171,24 @@ async fn main() -> Result<()> {
             if !no_push {
                 info!("Creating and pushing manifest list...");
 
+                // Determine the target for the manifest list
+                let manifest_target = if let Some(tag_name) = tag {
+                    // If --tag is specified, push to that tag
+                    format!("{}:{}", target_repo, tag_name)
+                } else {
+                    // If no tag specified, push digest-only by using a temporary tag
+                    // We'll use a temporary tag and return the digest reference
+                    format!("{}:temp-{}", target_repo, std::process::id())
+                };
+
                 // Get auth for the final image push
-                let final_auth = resolve_auth(&image_ref)?;
+                let final_auth = resolve_auth(&manifest_target)?;
 
                 let manifest_list_ref = registry_client
-                    .push_manifest_list(&image_ref, manifest_descriptors, &final_auth)
+                    .push_manifest_list(&manifest_target, manifest_descriptors, &final_auth)
                     .await?;
 
-                // Output the manifest list reference
+                // Output the manifest list reference (always by digest)
                 println!("{}", manifest_list_ref);
             } else {
                 info!(

src/registry/mod.rs

@@ -18,6 +18,97 @@ impl RegistryClient {
         Ok(Self { client })
     }
 
+    pub async fn push_image_by_digest(
+        &mut self,
+        repository: &str,
+        config_data: Vec<u8>,
+        layers: Vec<(Vec<u8>, String)>,
+        auth: &RegistryAuth,
+    ) -> Result<(String, usize)> {
+        // Create a temporary reference for authentication - we'll only use the digest result
+        let temp_ref = format!("{}:temp", repository);
+        let reference: Reference = temp_ref
+            .parse()
+            .context("Failed to parse repository reference")?;
+
+        info!("Pushing image to {} (digest only)", repository);
+
+        // Authenticate with the registry
+        self.client
+            .auth(&reference, auth, oci_distribution::RegistryOperation::Push)
+            .await
+            .context("Failed to authenticate with registry")?;
+
+        // Push config blob
+        let config_digest = format!("sha256:{}", sha256::digest(&config_data));
+        debug!("Pushing config blob: {}", config_digest);
+
+        self.client
+            .push_blob(&reference, &config_data, &config_digest)
+            .await
+            .context("Failed to push config blob")?;
+
+        // Push layers
+        let mut manifest_layers = Vec::new();
+        for (layer_data, media_type) in layers {
+            let digest = format!("sha256:{}", sha256::digest(&layer_data));
+            debug!("Pushing layer: {}", digest);
+
+            self.client
+                .push_blob(&reference, &layer_data, &digest)
+                .await
+                .context("Failed to push layer")?;
+
+            manifest_layers.push(OciDescriptor {
+                media_type: media_type.clone(),
+                digest: digest.clone(),
+                size: layer_data.len() as i64,
+                urls: None,
+                annotations: None,
+            });
+        }
+
+        // Create and push manifest (this will generate a digest)
+        let image_manifest = OciImageManifest {
+            schema_version: 2,
+            media_type: Some("application/vnd.oci.image.manifest.v1+json".to_string()),
+            artifact_type: None,
+            config: OciDescriptor {
+                media_type: "application/vnd.oci.image.config.v1+json".to_string(),
+                digest: config_digest,
+                size: config_data.len() as i64,
+                urls: None,
+                annotations: None,
+            },
+            layers: manifest_layers,
+            annotations: None,
+        };
+
+        // Wrap the image manifest in the OciManifest enum
+        let manifest = OciManifest::Image(image_manifest);
+
+        debug!("Pushing manifest for digest-only image");
+        let (manifest_url, digest) = self
+            .client
+            .push_manifest_and_get_digest(&reference, &manifest)
+            .await
+            .context("Failed to push manifest")?;
+
+        info!(
+            "Successfully pushed image to {} (digest: {})",
+            manifest_url, digest
+        );
+
+        // Build the full image reference with digest only
+        let registry = reference.registry();
+        let repository = reference.repository();
+        let digest_ref = format!("{}/{}@{}", registry, repository, digest);
+
+        // Return both the digest ref and the actual manifest size
+        let manifest_size = serde_json::to_vec(&manifest)?.len();
+        Ok((digest_ref, manifest_size))
+    }
+
     pub async fn push_image(
         &mut self,
         image_ref: &str,