fix: select bundled parent before reading image metadata #135

Merged

gitchegumi merged 1 commit from kiyi/package-parent-inventory into main

2026-10-19 15:57:58 -05:00

kiyi commented

2026-10-19 15:47:46 -05:00

Member

Base-images #57 already picked up stable-v1 v1.47.3. Validator run 368 and Grafana build run 367 successfully pull and verify the DU Core package, then fail in package_parents.image_manifest with “Missing or changed OCI metadata blob,” before building an image.

The helper opens every image descriptor before selecting the requested digest. A component-filtered UDS bundle can retain the complete package image index while omitting unrelated optional-image blobs. Select the exact parent digest first. When resolving a multi-architecture parent, inspect only the OCI/Docker index named for that parent, then require its exact Linux amd64 child. Selected package/index/manifest/config/layer size and digest checks remain enforced; missing selected data still blocks. Diagnostics now distinguish missing metadata from changed metadata and identify its digest. No package declarations, charts, manifests, credential scopes, scan mitigations or check names change.

Validation: 573 Linux unit/contract tests passed (20 tool-dependent skips; the previously separate Windows Git-path case was not rerun). All 26 focused package-parent/container tests and Ruff passed; the native Gitleaks pre-commit gate passed. New synthetic fixtures cover omitted unrelated manifests/indexes, both Zarf image-name annotations, exact amd64 child selection, and missing/corrupt selected metadata. No local container build, real package pull, scanner run, publication or deployment was performed. Hosted acceptance remains required.

After merge, publish/promote the workflow fix to stable-v1, then retry base-images #57. Its caller already uses the channel; no new base-image source changes are required for this parser fix.

[Base-images #57](https://git.gitchegumi.com/Homelab/base-images/pulls/57) already picked up stable-v1 v1.47.3. [Validator run 368](https://git.gitchegumi.com/Homelab/base-images/actions/runs/368/jobs/1/attempt/1) and [Grafana build run 367](https://git.gitchegumi.com/Homelab/base-images/actions/runs/367/jobs/5/attempt/1) successfully pull and verify the DU Core package, then fail in package_parents.image_manifest with “Missing or changed OCI metadata blob,” before building an image. The helper opens every image descriptor before selecting the requested digest. A component-filtered UDS bundle can retain the complete package image index while omitting unrelated optional-image blobs. Select the exact parent digest first. When resolving a multi-architecture parent, inspect only the OCI/Docker index named for that parent, then require its exact Linux amd64 child. Selected package/index/manifest/config/layer size and digest checks remain enforced; missing selected data still blocks. Diagnostics now distinguish missing metadata from changed metadata and identify its digest. No package declarations, charts, manifests, credential scopes, scan mitigations or check names change. Validation: 573 Linux unit/contract tests passed (20 tool-dependent skips; the previously separate Windows Git-path case was not rerun). All 26 focused package-parent/container tests and Ruff passed; the native Gitleaks pre-commit gate passed. New synthetic fixtures cover omitted unrelated manifests/indexes, both Zarf image-name annotations, exact amd64 child selection, and missing/corrupt selected metadata. No local container build, real package pull, scanner run, publication or deployment was performed. Hosted acceptance remains required. After merge, publish/promote the workflow fix to stable-v1, then retry [base-images #57](https://git.gitchegumi.com/Homelab/base-images/pulls/57). Its caller already uses the channel; no new base-image source changes are required for this parser fix.

kiyi added 1 commit

2026-10-19 15:47:46 -05:00

fix: select bundled parent before reading image metadata

Workflow acceptance / acceptance (pull_request) Successful in 1m35s

Details

Repository security / security-1 (pull_request) Successful in 2m7s

Details

Library checks / tests (pull_request) Successful in 8m19s

Details

8a55ea72d9

portegumi approved these changes

2026-10-19 15:48:44 -05:00

portegumi left a comment

Reviewed the exact head's pipeline/package_parents.py and new package-parent fixtures. The change skips nonselected manifest descriptors before reading optional blobs, restricts alternate multiarch traversal to a parent-named OCI/Docker index, requires the exact Linux/amd64 child digest, and retains descriptor size/digest verification and the existing payload checks. Synthetic tests cover omitted unrelated metadata and missing selected metadata. This is UDS-bundle parsing (pinned client 0.39.0), not a deployment/routing/policy change; no new gateway, route, package declaration, or scan bypass is introduced. Source approved; Workflow acceptance, Repository security, and Library checks were still pending at review time. Approval is not merge or publication authorization; hosted gates and real package/build acceptance remain separate.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the exact head's `pipeline/package_parents.py` and new package-parent fixtures. The change skips nonselected manifest descriptors before reading optional blobs, restricts alternate multiarch traversal to a parent-named OCI/Docker index, requires the exact Linux/amd64 child digest, and retains descriptor size/digest verification and the existing payload checks. Synthetic tests cover omitted unrelated metadata and missing selected metadata. This is UDS-bundle parsing (pinned client 0.39.0), not a deployment/routing/policy change; no new gateway, route, package declaration, or scan bypass is introduced. Source approved; Workflow acceptance, Repository security, and Library checks were still pending at review time. Approval is not merge or publication authorization; hosted gates and real package/build acceptance remain separate. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.