Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-3486

Signed Schema 1 manifests are not generated with the key ID in the correct format

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Undefined Undefined
    • quay-v3.8.0
    • None
    • quay

      Clients expect signed schema 1 manifests to contain a signature with the key ID in the correct format. We currently pass the automatically generated key ID which is just a hash of characters. 
      This causes errors in clients that try to pull signed schema 1 manifests that are generated by Quay - when creating tags through the UI or manifest conversions.
      The expected format of the Key ID can be found here: https://docs.docker.com/registry/spec/auth/jwt/

      How to reproduce:

      • Have a running instance of Quay
      • Use skopeo to push an image as a Docker V2 Schema 1 manifest
      skopeo copy --dest-creds='user:pass' --dest-tls-verify=false --format=v2s1 docker://docker.io/library/nginx:latest docker://localhost:8080/quayadmin/nginx:latest
      • In the Quay console, go to the image that has been pushed and add another tag

      • Try to pull image with the new tag
        • podman pull --tls-verify=false localhost:8080/quayadmin/nginx:new-tag
      • Image pull will fail with the following error: "unmarshalling public key: JWK RSA Public Key ID does not match"

            bcaton@redhat.com Brandon Caton
            bcaton@redhat.com Brandon Caton
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: