Actions
Story #1145
closed
As a user, I am assured that Pulp is downloading the correct manifests
Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
-
Start date:
Due date:
% Done:
100%
Estimated time:
Platform Release:
Target Release - Docker:
2.0.0
Groomed:
No
Sprint Candidate:
Yes
Tags:
Pulp 2
Sprint:
Quarter:
Description
The docker manifests have a digest, which is supposed to be a checksum of the manifest. However, the manifest checksum is not calculated on the downloaded manifest but on some permutation of the manifest. The necessary permutation is not known to the Pulp team at this time, so part of this effort will be determining how to calculate the checksum of the digest. There is a GitHub issue[0] with some information that may be useful. Hint: It may be related to removing signatures, but I am not sure.
Deliverables:
- Determine how to calculate the digest of the manifest, since the manifest as presented has a different checksum than the given digest from the registry.
- Rework the Importer to validate the digest of the downloaded manifests to ensure that the expected data was received
- Consider whether this should be a setting or not (I lean towards not). If you determine that it should, make sure pulp-admin supports it
- Tests
- Documentation
Related issues
Actions
.
Add the ability for users to be able to sync from other Pulp servers.
This commit adds code that can calculate the digest of a raw JSON manifest. This allows users to sync from feed URLs that do not provide the digest header, and it also allows Pulp to verify the digest of manifests downloaded from feed URLs that do provide the header.
https://pulp.plan.io/issues/1145 https://pulp.plan.io/issues/1316
closes #1145 closes #1316