application/vnd.oci.empty.v1 is not supported for datasource docker for OCI artifact?

[Devinwong]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

I have a minimal repro. https://github.com/Devinwong/RenovateTest/blob/main/test_components_simple.json

In my repro, there are 2 components.

1. mcr.microsoft.com/oss/kubernetes-csi/secrets-store/driver
   This is used for a reference as a passed case. It is a general container image.

2. mcr.microsoft.com/oss/binaries/kubernetes/kubernetes-node
   This is the one I am encountering issue. It is a OCI artifact. (a tar file)

The error I encountered for the 2nd component is "mediaType": "Invalid enum value. Expected 'application/vnd.oci.image.config.v1+json' | 'application/vnd.cncf.helm.config.v1+json' | 'application/vnd.devcontainers', received 'application/vnd.oci.empty.v1+json'"
It seems to me the request API is using header application/vnd.oci.empty.v1+json but Renovate doesn't support it. (Or I misunderstood it)

Then I used curl to run a quick test.

By running
curl -s -H "Accept: **application/vnd.oci.image.manifest.v1+json**" https://mcr.microsoft.com/v2/oss/binaries/kubernetes/kubernetes-node/manifests/v1.31.2-linux-amd64
I got response
{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","artifactType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.empty.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"data":"e30="},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar","digest":"sha256:97f5f25e369b2831a9f92a8beab89ce8641f085d4a72202ddd08a2e1bcb8cb5e","size":91478086,"annotations":{"org.opencontainers.image.title":"kubernetes-node-linux-amd64.tar.gz"}}],"annotations":{"org.opencontainers.image.created":"2024-10-23T19:36:07Z"}}
which looks correct.

Does it mean Renovate is somehow using header application/vnd.oci.empty.v1+json to do the GET call? Can I ask it to use header application/vnd.oci.image.manifest.v1+json, like what I did with the curl command?

Logs (if relevant)

Logs

DEBUG: getLabels(https://mcr.microsoft.com, oss/binaries/kubernetes/kubernetes-node, v1.31.2-linux-amd64)
DEBUG: getManifestResponse(https://mcr.microsoft.com, oss/binaries/kubernetes/kubernetes-node, v1.31.2-linux-amd64, get)
DEBUG: Using queue: host=mcr.microsoft.com, concurrency=16
DEBUG: No registry auth required for https://mcr.microsoft.com/v2/
DEBUG: Invalid manifest response
{
"registry": "https://mcr.microsoft.com"
"dockerRepository": "oss/binaries/kubernetes/kubernetes-node"
"tag": "v1.31.2-linux-amd64"
"body": "{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","artifactType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.empty.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"data":"e30="},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar","digest":"sha256:97f5f25e369b2831a9f92a8beab89ce8641f085d4a72202ddd08a2e1bcb8cb5e","size":91478086,"annotations":{"org.opencontainers.image.title":"kubernetes-node-linux-amd64.tar.gz"}}],"annotations":{"org.opencontainers.image.created":"2024-10-23T19:36:07Z"}}"
"headers": {
"content-length": "626",
"content-type": "application/vnd.oci.image.manifest.v1+json",
"etag": ""sha256:d693fdfe036a817671a96138bda8366df0ec8799623e5e60e98fc85b7f40b063"",
"access-control-expose-headers": "Docker-Content-Digest, WWW-Authenticate, Link, X-Ms-Correlation-Request-Id",
"docker-content-digest": "sha256:d693fdfe036a817671a96138bda8366df0ec8799623e5e60e98fc85b7f40b063",
"docker-distribution-api-version": "registry/2.0",
"strict-transport-security": "max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains",
"x-content-type-options": "nosniff",
"x-ms-client-request-id": "",
"x-ms-correlation-request-id": "e700a14a-4fab-46a0-a1eb-234ae0f1a65f",
"x-ms-request-id": "2655883d-58c6-4ba2-ab00-e2b3a7d4aa52",
"x-cache": "CONFIG_NOCACHE",
"x-mcr-env": "prod",
"x-mcr-privacy": "https://privacy.microsoft.com/en-us/privacystatement",
"x-msedge-ref": "Ref A: 06FA8075D21B4EB39FCB63FD664A0A86 Ref B: MNZ221060619011 Ref C: 2024-10-29T19:50:33Z",
"date": "Tue, 29 Oct 2024 19:50:32 GMT"
}
"err": {
"message": "Schema error",
"stack": "ZodError: Schema error\n at Object.get error [as error] (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/zod/lib/types.js:55:31)\n at DockerDatasource.getManifest (/usr/local/renovate/lib/modules/datasource/docker/index.ts:308:23)\n at processTicksAndRejections (node:internal/process/task_queues:95:5)\n at DockerDatasource.getLabels (/usr/local/renovate/lib/modules/datasource/docker/index.ts:478:24)\n at /usr/local/renovate/lib/util/cache/package/decorator.ts:134:20\n at DockerDatasource.getReleases (/usr/local/renovate/lib/modules/datasource/docker/index.ts:1106:20)\n at getRegistryReleases (/usr/local/renovate/lib/modules/datasource/index.ts:85:15)\n at fetchReleases (/usr/local/renovate/lib/modules/datasource/index.ts:318:15)\n at lookupUpdates (/usr/local/renovate/lib/workers/repository/process/lookup/index.ts:140:56)\n at Function.wrap (/usr/local/renovate/lib/util/stats.ts:38:20)\n at fetchDepUpdates (/usr/local/renovate/lib/workers/repository/process/fetch.ts:58:42)\n at /usr/local/renovate/lib/workers/repository/process/fetch.ts:104:23\n at /usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/p-map/index.js:57:22",
"issues": {
"config": {
"mediaType": "Invalid enum value. Expected 'application/vnd.oci.image.config.v1+json' | 'application/vnd.cncf.helm.config.v1+json' | 'application/vnd.devcontainers', received 'application/vnd.oci.empty.v1+json'"
}
}
}
}

[rarkins]

The validation error you're seeing comes from here:

renovate/lib/modules/datasource/docker/schema.ts

Lines 59 to 74 in cd192d7

	/**
	* OCI Image Manifest
	* The same structure as docker image manifest, but mediaType is not required and is not present in the wild.
	* https://github.com/opencontainers/image-spec/blob/main/manifest.md
	*/
	export const OciImageManifest = ManifestObject.extend({
	mediaType: z.literal('application/vnd.oci.image.manifest.v1+json'),
	config: Descriptor.extend({
	mediaType: z.enum([
	'application/vnd.oci.image.config.v1+json',
	'application/vnd.cncf.helm.config.v1+json',
	'application/vnd.devcontainers',
	]),
	}),
	annotations: z.record(z.string()).nullish(),
	});

There is no hit for application/vnd.oci.empty.v1+json in the source code. Here is a spec for it: https://github.com/opencontainers/image-spec/blob/main/manifest.md#guidance-for-an-empty-descriptor

Should we simply ignore it when it's found?

[viceice]

probably yes.

[Devinwong]

Should I create an issue for this request or Renovate team will take care of it? Thanks.

[Devinwong]

Or if it is just to add this line in line71 in schema.ts, I can do it too.
'application/vnd.oci.empty.v1+json'

[rarkins]

It might be ok to just add it. I guess it will have no annotations field?

[Devinwong]

From the curl response, it does have annotations

"annotations": {
    "org.opencontainers.image.created": "2024-10-23T19:36:07Z"
  }

[Devinwong]

@rarkins Thanks for merging my PR. I know it's being released. https://github.com/renovatebot/renovate/releases/tag/39.4.0
How do I check the version on the http://developer.mend.io?

[rarkins]

The version used will be printed in every job log

[Devinwong]

Thanks for the help. By adding the additional http header 'application/vnd.oci.empty.v1+json', it works now. Closing this discussion.