Repository: deislabs/ratify
Pull request #931 (2023-07-12 19:01:12)

chore: upgrade to image spec rc4 and oras-go 2.2.1
# Description

## What this PR does / why we need it:
- upgrade image spec to 1.1.0-rc4
- upgrade oras-go to 2.2.1
- adds empty descriptor logic for selecting artifact type
- adds unit tests

NOTE: This PR still maintains ratify oci artifact backwards compatability

## Which issue(s) this PR fixes *(optional, using `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when the PR gets merged)*:
Fixes #

## Type of change

Please delete options that are not relevant.

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] Helm Chart Change (any edit/addition/update that is necessary for changes merged to the `main` branch)
- [ ] This change requires a documentation update

# How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

- [ ] Test A
- [ ] Test B

# Checklist:

- [ ] Does the affected code have corresponding tests?
- [ ] Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
- [ ] Does this introduce breaking changes that would require an announcement or bumping the major version?
- [ ] Do all new files have appropriate license header?

# Post Merge Requirements
- [ ] MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates `Helm Chart Change`


akashsinghal: closing in favor of #931 
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs) Report
Patch coverage: **`85.71`**% and project coverage change: **`+0.32`** :tada:
> Comparison is base [(`fa559b0`)](https://app.codecov.io/gh/deislabs/ratify/commit/fa559b0186a8307ef844bbebcccc40a3a6541770?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs) 56.08% compared to head [(`d8cfd44`)](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs) 56.40%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main     #931      +/-   ##
==========================================
+ Coverage   56.08%   56.40%   +0.32%     
==========================================
  Files          87       69      -18     
  Lines        5037     4049     -988     
==========================================
- Hits         2825     2284     -541     
+ Misses       1921     1545     -376     
+ Partials      291      220      -71     
```


| [Impacted Files](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs) | Coverage Δ | |
|---|---|---|
| [pkg/common/plugin/download.go](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs#diff-cGtnL2NvbW1vbi9wbHVnaW4vZG93bmxvYWQuZ28=) | `7.36% <0.00%> (-34.74%)` | :arrow_down: |
| [pkg/common/utils/utils.go](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs#diff-cGtnL2NvbW1vbi91dGlscy91dGlscy5nbw==) | `100.00% <100.00%> (ø)` | |
| [pkg/referrerstore/oras/oras.go](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs#diff-cGtnL3JlZmVycmVyc3RvcmUvb3Jhcy9vcmFzLmdv) | `58.72% <100.00%> (-11.41%)` | :arrow_down: |

... and [37 files with indirect coverage changes](https://app.codecov.io/gh/deislabs/ratify/pull/931/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/deislabs/ratify/pull/931?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=deislabs).

akashsinghal: @binbin-li @susanshi could I get a review on this when you have a chance? 

Patch:
diff --git a/go.mod b/go.mod
index f579104..e7334c8 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/open-policy-agent/frameworks/constraint v0.0.0-20230201235642-777dc99a6669
 	github.com/open-policy-agent/opa v0.51.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.0-rc2
+	github.com/opencontainers/image-spec v1.1.0-rc4
 	github.com/pkg/errors v0.9.1
 	github.com/sigstore/cosign/v2 v2.0.2
 	github.com/sigstore/sigstore v1.6.4
@@ -39,13 +39,13 @@ require (
 	go.opentelemetry.io/otel/exporters/prometheus v0.37.0
 	go.opentelemetry.io/otel/metric v0.37.0
 	go.opentelemetry.io/otel/sdk/metric v0.37.0
-	golang.org/x/sync v0.2.0
+	golang.org/x/sync v0.3.0
 	google.golang.org/grpc v1.55.1
 	google.golang.org/protobuf v1.30.0
 	k8s.io/api v0.26.6
 	k8s.io/apimachinery v0.26.6
 	k8s.io/client-go v0.26.6
-	oras.land/oras-go/v2 v2.2.0
+	oras.land/oras-go/v2 v2.2.1
 )
 
 require (
diff --git a/go.sum b/go.sum
index fab5d63..b791894 100644
--- a/go.sum
+++ b/go.sum
@@ -699,8 +699,8 @@ github.com/open-policy-agent/opa v0.51.0 h1:2hS5xhos8HtkN+mgpqMhNJSFtn/1n/h3wh+A
 github.com/open-policy-agent/opa v0.51.0/go.mod h1:OjmwLfXdeR7skSxrt8Yd3ScXTqPxyJn7GeTRJrcEerU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
-github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
+github.com/opencontainers/image-spec v1.1.0-rc4 h1:oOxKUJWnFC4YGHCCMNql1x4YaDfYBTS5Y4x/Cgeo1E0=
+github.com/opencontainers/image-spec v1.1.0-rc4/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -1058,8 +1058,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1380,8 +1380,8 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
 k8s.io/utils v0.0.0-20230115233650-391b47cb4029 h1:L8zDtT4jrxj+TaQYD0k8KNlr556WaVQylDXswKmX+dE=
 k8s.io/utils v0.0.0-20230115233650-391b47cb4029/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go/v2 v2.2.0 h1:E1fqITD56Eg5neZbxBtAdZVgDHD6wBabJo6xESTcQyo=
-oras.land/oras-go/v2 v2.2.0/go.mod h1:pXjn0+KfarspMHHNR3A56j3tgvr+mxArHuI8qVn59v8=
+oras.land/oras-go/v2 v2.2.1 h1:3VJTYqy5KfelEF9c2jo1MLSpr+TM3mX8K42wzZcd6qE=
+oras.land/oras-go/v2 v2.2.1/go.mod h1:GeAwLuC4G/JpNwkd+bSZ6SkDMGaaYglt6YK2WvZP7uQ=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/pkg/common/plugin/download.go b/pkg/common/plugin/download.go
index c931faf..4a809b5 100644
--- a/pkg/common/plugin/download.go
+++ b/pkg/common/plugin/download.go
@@ -117,7 +117,7 @@ func DownloadPlugin(source PluginSource, targetPath string) error {
 			return err
 		}
 		referenceManifest = commonutils.OciManifestToReferenceManifest(imageManifest)
-	} else if referenceManifestDescriptor.MediaType == oci.MediaTypeArtifactManifest {
+	} else if referenceManifestDescriptor.MediaType == ocispecs.MediaTypeArtifactManifest {
 		if err := json.Unmarshal(manifestBytes, &referenceManifest); err != nil {
 			return err
 		}
diff --git a/pkg/common/utils/utils.go b/pkg/common/utils/utils.go
index c0980ce..8efffb1 100644
--- a/pkg/common/utils/utils.go
+++ b/pkg/common/utils/utils.go
@@ -21,9 +21,14 @@ import (
 )
 
 func OciManifestToReferenceManifest(ociManifest oci.Manifest) ocispecs.ReferenceManifest {
+	artifactType := ociManifest.Config.MediaType
+	if artifactType == oci.DescriptorEmptyJSON.MediaType {
+		artifactType = ociManifest.ArtifactType
+	}
+
 	return ocispecs.ReferenceManifest{
 		MediaType:    ociManifest.MediaType,
-		ArtifactType: ociManifest.Config.MediaType,
+		ArtifactType: artifactType,
 		Blobs:        ociManifest.Layers,
 		Subject:      ociManifest.Subject,
 		Annotations:  ociManifest.Annotations,
diff --git a/pkg/ocispecs/descriptor.go b/pkg/ocispecs/descriptor.go
index c37a197..dda4d5c 100644
--- a/pkg/ocispecs/descriptor.go
+++ b/pkg/ocispecs/descriptor.go
@@ -19,6 +19,8 @@ import (
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
+const MediaTypeArtifactManifest = "application/vnd.oci.artifact.manifest.v1+json"
+
 // ReferenceDescriptor represents a descriptor for an artifact manifest
 type ReferenceDescriptor struct {
 	oci.Descriptor
diff --git a/pkg/referrerstore/oras/oras.go b/pkg/referrerstore/oras/oras.go
index 37bad6c..fda7791 100644
--- a/pkg/referrerstore/oras/oras.go
+++ b/pkg/referrerstore/oras/oras.go
@@ -351,7 +351,7 @@ func (store *orasStore) GetReferenceManifest(ctx context.Context, subjectReferen
 			return ocispecs.ReferenceManifest{}, err
 		}
 		referenceManifest = commonutils.OciManifestToReferenceManifest(imageManifest)
-	} else if referenceDesc.Descriptor.MediaType == oci.MediaTypeArtifactManifest {
+	} else if referenceDesc.Descriptor.MediaType == ocispecs.MediaTypeArtifactManifest {
 		if err := json.Unmarshal(manifestBytes, &referenceManifest); err != nil {
 			return ocispecs.ReferenceManifest{}, err
 		}


Test patch:
diff --git a/pkg/common/utils/utils_test.go b/pkg/common/utils/utils_test.go
index 25665ae..7a35fe9 100644
--- a/pkg/common/utils/utils_test.go
+++ b/pkg/common/utils/utils_test.go
@@ -23,6 +23,8 @@ import (
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
+const TestArtifactType = "application/vnd.test.artifacttype"
+
 func TestOciManifestToReferenceManifest(t *testing.T) {
 	type args struct {
 		ociManifest oci.Manifest
@@ -48,13 +50,29 @@ func TestOciManifestToReferenceManifest(t *testing.T) {
 				ociManifest: oci.Manifest{
 					MediaType: "application/vnd.oci.image.manifest.v1+json",
 					Config: oci.Descriptor{
-						MediaType: "application/vnd.oci.image.config.v1+json",
+						MediaType: TestArtifactType,
+					},
+				},
+			},
+			want: ocispecs.ReferenceManifest{
+				MediaType:    "application/vnd.oci.image.manifest.v1+json",
+				ArtifactType: TestArtifactType,
+			},
+		},
+		{
+			name: "empty config media type",
+			args: args{
+				ociManifest: oci.Manifest{
+					MediaType: "application/vnd.oci.image.manifest.v1+json",
+					Config: oci.Descriptor{
+						MediaType: oci.DescriptorEmptyJSON.MediaType,
 					},
+					ArtifactType: TestArtifactType,
 				},
 			},
 			want: ocispecs.ReferenceManifest{
 				MediaType:    "application/vnd.oci.image.manifest.v1+json",
-				ArtifactType: "application/vnd.oci.image.config.v1+json",
+				ArtifactType: TestArtifactType,
 			},
 		},
 		{
@@ -63,7 +81,7 @@ func TestOciManifestToReferenceManifest(t *testing.T) {
 				ociManifest: oci.Manifest{
 					MediaType: "application/vnd.oci.image.manifest.v1+json",
 					Config: oci.Descriptor{
-						MediaType: "application/vnd.oci.image.config.v1+json",
+						MediaType: TestArtifactType,
 					},
 					Layers: []oci.Descriptor{
 						{
@@ -74,7 +92,7 @@ func TestOciManifestToReferenceManifest(t *testing.T) {
 			},
 			want: ocispecs.ReferenceManifest{
 				MediaType:    "application/vnd.oci.image.manifest.v1+json",
-				ArtifactType: "application/vnd.oci.image.config.v1+json",
+				ArtifactType: TestArtifactType,
 				Blobs: []oci.Descriptor{
 					{
 						MediaType: "application/vnd.oci.image.layer.v1.tar+gzip",
diff --git a/pkg/referrerstore/oras/oras_test.go b/pkg/referrerstore/oras/oras_test.go
index 11e08ff..782c041 100644
--- a/pkg/referrerstore/oras/oras_test.go
+++ b/pkg/referrerstore/oras/oras_test.go
@@ -308,7 +308,7 @@ func TestORASGetReferenceManifest_CachedDesc(t *testing.T) {
 	}
 	manifest, err := store.GetReferenceManifest(ctx, inputRef, ocispecs.ReferenceDescriptor{
 		Descriptor: oci.Descriptor{
-			MediaType: oci.MediaTypeArtifactManifest,
+			MediaType: ocispecs.MediaTypeArtifactManifest,
 			Digest:    artifactDigest,
 		},
 	})
@@ -372,7 +372,7 @@ func TestORASGetReferenceManifest_NotCachedDesc(t *testing.T) {
 	}
 	manifest, err := store.GetReferenceManifest(ctx, inputRef, ocispecs.ReferenceDescriptor{
 		Descriptor: oci.Descriptor{
-			MediaType: oci.MediaTypeArtifactManifest,
+			MediaType: ocispecs.MediaTypeArtifactManifest,
 			Digest:    artifactDigest,
 		},
 	})