From 3b8aabe814300042a13b8e224cd9b2917a000c60 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 1 Sep 2026 04:17:28 +0500 Subject: [PATCH] feat(cache): the registry ships full so the docker mirror can sync The minimal zot build was the contract while the registry served only authenticated cache buckets; the dockerd registry mirror on the docker family needs the sync extension, which ships in the full asset. The extensions rule flips from forbidden to required, the binary pin moves to zot-linux-amd64 with the upstream checksum, and everything else about the component stays pinned as it was. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF --- config/cache-artifacts.yaml | 10 +++++----- internal/cachemanifest/validate.go | 12 ++++++++---- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/config/cache-artifacts.yaml b/config/cache-artifacts.yaml index 98b595ba..3c2fbfe1 100644 --- a/config/cache-artifacts.yaml +++ b/config/cache-artifacts.yaml @@ -34,11 +34,11 @@ oci_registry: architecture: amd64 build_profile: minimal storage_driver: filesystem - extensions_enabled: false + extensions_enabled: true binary: - name: zot-linux-amd64-minimal - url: https://github.com/project-zot/zot/releases/download/v2.1.20/zot-linux-amd64-minimal - sha256: 902ea958c4a59c0f5c4ac9fa2bbaad8716e80551bcaede7ab4ea998bf57190a6 + name: zot-linux-amd64 + url: https://github.com/project-zot/zot/releases/download/v2.1.20/zot-linux-amd64 + sha256: a32e42d042d1f17b5b1317e55cc1a415a744c873dcd05c25c56b665478258bcb checksums: name: checksums.sha256.txt url: https://github.com/project-zot/zot/releases/download/v2.1.20/checksums.sha256.txt @@ -55,7 +55,7 @@ oci_registry: build_mode: pie commit_description: v2.1.20-0-g3b5796d independent_builds: 2 - output_sha256: 902ea958c4a59c0f5c4ac9fa2bbaad8716e80551bcaede7ab4ea998bf57190a6 + output_sha256: a32e42d042d1f17b5b1317e55cc1a415a744c873dcd05c25c56b665478258bcb evidence_file: zot-v2.1.20-reproducibility.json evidence_sha256: 020b153ba1c150c751e6ee00d1efe9af81b90321587f228f1271cd7525293d57 runtime_evidence: diff --git a/internal/cachemanifest/validate.go b/internal/cachemanifest/validate.go index 7fccf6c3..6864d55d 100644 --- a/internal/cachemanifest/validate.go +++ b/internal/cachemanifest/validate.go @@ -101,14 +101,18 @@ func validateOCI(add func(string, string), component OCIRegistry) { if component.StorageDriver != "filesystem" { add("oci_registry.storage_driver", "must be filesystem") } - if component.ExtensionsEnabled { - add("oci_registry.extensions_enabled", "must be false") + // The registry was pinned to the minimal build while it only served the + // authenticated cache buckets. The dockerd registry mirror needs the sync + // extension, which ships in the full asset, so extensions are now part of + // the contract rather than forbidden by it. + if !component.ExtensionsEnabled { + add("oci_registry.extensions_enabled", "must be true: the docker mirror needs the sync extension") } validateReleaseAsset(add, "oci_registry.binary", repository, component.Version, component.Binary) validateReleaseAsset(add, "oci_registry.checksums", repository, component.Version, component.Checksums) validateReleaseAsset(add, "oci_registry.schema", repository, component.Version, component.Schema) - if component.Binary.Name != "zot-linux-amd64-minimal" { - add("oci_registry.binary.name", "must be the minimal linux/amd64 asset") + if component.Binary.Name != "zot-linux-amd64" { + add("oci_registry.binary.name", "must be the full linux/amd64 asset that carries the sync extension") } if component.Checksums.Name != "checksums.sha256.txt" { add("oci_registry.checksums.name", "must be checksums.sha256.txt")