Repository: provectus/kafka-ui
Issue: Cannot pull image of v0.6.1 from non OCI-compliant runtimes
Labels: type/bug
status/accepted
scope/infrastructure

**Describe the bug** (Actual behavior)

Hi, the update of [docker/build-push-action](https://github.com/docker/build-push-action) to `v4.0.0` (introduced by #3488) seems to cause issues with some container runtimes that are not OCI-compliant. 

Docker fails when pulling the `v0.6.1` image from non OCI-compliant runtimes (older Openshift platform).

`Failed to pull image "<dockerproxy>/provectuslabs/kafka-ui:v0.6.1": rpc error: code = Unknown desc = missing signature key
`

The changelog of docker/build-push-action states that it could introduce issues with some runtimes.

> ## v4.0.0
> **Note**
> Buildx v0.10 enables support for a minimal [SLSA Provenance](https://slsa.dev/provenance/) attestation, which requires support for [OCI-compliant](https://github.com/opencontainers/image-spec) multi-platform images. This may introduce issues with registry and runtime support (e.g. [Google Cloud Run and AWS Lambda](https://redirect.github.com/docker/buildx/issues/1533)). You can optionally disable the default provenance attestation functionality using `provenance: false`.

This could probably be fixed by using `provenance: false` as the changelog above suggests

**Expected behavior**

Can pull on older docker runtimes.

**Set up**

I realize this is a niche issue. In my case I got it when trying to pull the image in `v0.6.1` in an older Openshift platform, and I'm guessing that the problem comes from the OCI compliance.

**Steps to Reproduce**

Hard to test. Maybe by installing an older docker version and pulling v0.6.1.

I could potentially test an image with the suggested fix and see if it works.

**Additional information**

The manifest of the image previously contained (version <= `v0.6.0`):
`  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",`

From `v0.6.1` it became:
`  "mediaType": "application/vnd.oci.image.index.v1+json",`


Issue comments:
Hello there Dugong42! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀
Hey, thanks for bringing this to our attention. 

We'll def look into this shortly. 
Hello @Dugong42 
Can you please provide your docker version?
Hi. It's Docker `1.13`
Hi, would it possible to have an ETA for this fix ?
Thx  :)
https://github.com/provectus/kafka-ui/pull/3861#issuecomment-1601009788
The one left workflow fixed within #3986
The rest is our private ECR

Pull request review comments:

Patch that resolved the issue:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 19128550c08..7f18f994e3c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -77,6 +77,7 @@ jobs:
           builder: ${{ steps.buildx.outputs.name }}
           context: kafka-ui-api
           platforms: linux/amd64,linux/arm64
+          provenance: false
           push: true
           tags: |
             provectuslabs/kafka-ui:${{ steps.build.outputs.version }}


Test patch: