Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-106630

podman pull registry.redhat.io/ubi8:latest fails with "Source image rejected"

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • rhel-10.0
    • ubi8-container
    • None
    • Yes
    • Moderate
    • rhel-container-tools
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      Attempts to pull the Red Hat Universal Base Image 8
      ubi8 latest container is failing with the following error...

      Error: internal error: unable to copy from source docker://registry.redhat.io/ubi8:latest: copying system image from manifest list: Source image rejected: None of the signatures were accepted, reasons: missing dev.sigstore.cosign/bundle annotation; missing dev.sigstore.cosign/bundle annotation; Signature for identity "registry.redhat.io/ubi8:8.10" is not accepted; Signature for identity "registry.redhat.io/ubi8:8.10-1753769092" is not accepted; Signature for identity "registry.access.redhat.com/ubi8:latest" is not accepted
      

      However a pull of the actual dated tag is passing.  The latest tag appears to be broken.

      What is the impact of this issue to you?

      Please provide the package NVR for which the bug is seen:

      [root@kvm-03-guest24 ~]# rpm -q podman
      podman-5.5.1-1.el10.x86_64
      

      How reproducible is this bug?:

      It is reproducible today. Hopefully the next build will be better and the "latest" tag will pull successfully.
       

      Steps to reproduce

      [root@kvm-03-guest24 ~]# podman login -u *** -p *** registry.redhat.io
      Login Succeeded!
      
      [root@kvm-03-guest24 ~]# podman pull registry.redhat.io/ubi8:latest
      Trying to pull registry.redhat.io/ubi8:latest...
      Error: internal error: unable to copy from source docker://registry.redhat.io/ubi8:latest: copying system image from manifest list: Source image rejected: None of the signatures were accepted, reasons: missing dev.sigstore.cosign/bundle annotation; missing dev.sigstore.cosign/bundle annotation; Signature for identity "registry.redhat.io/ubi8:8.10" is not accepted; Signature for identity "registry.redhat.io/ubi8:8.10-1753769092" is not accepted; Signature for identity "registry.access.redhat.com/ubi8:latest" is not accepted
      
      [root@kvm-03-guest24 ~]# podman pull registry.redhat.io/ubi8:8.10-1753769092
      Trying to pull registry.redhat.io/ubi8:8.10-1753769092...
      Getting image source signatures
      Checking if image destination supports signatures
      Copying blob 36055582630d done   | 
      Copying config a8bbbd71e2 done   | 
      Writing manifest to image destination
      Storing signatures
      a8bbbd71e2416427e058e71a9555431c00ac4fc681fe5650551c169734840e3e
      
      [root@kvm-03-guest24 ~]# podman images
      REPOSITORY               TAG              IMAGE ID      CREATED       SIZE
      registry.redhat.io/ubi8  8.10-1753769092  a8bbbd71e241  36 hours ago  205 MB 

      Expected results

      Expected registry.redhat.io/ubi8:latest to pull successfully and be added to my list of container images.

      Actual results

      Shown above

       

      Additional Info:

      See the catalog https://catalog.redhat.com/software/containers/ubi8/5c647760bed8bd28d0e38f9f/history for the latest tagged ubi8 images

       

              jpopelka@redhat.com Jiri Popelka
              jsefler John Sefler
              Container Runtime Eng Bot Container Runtime Eng Bot
              Container Runtime Bugs Bot Container Runtime Bugs Bot
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: