libimage: pull: override even --pull=never with custom platform

As it turned out in Podman CI (containers/podman/pull/10739), the policy
is overridden via --arch/os/platform/variant even when the policy is set
to never.

While I think this is a bug, it is a separate one and must tackled
separately.

Signed-off-by: Valentin Rothberg <[email protected]>

libimage/pull.go

@@ -370,25 +370,29 @@ func (r *Runtime) copySingleImageFromRegistry(ctx context.Context, imageName str
 		}
 	}
 
-	if pullPolicy == config.PullPolicyNever {
-		if localImage != nil {
-			logrus.Debugf("Pull policy %q but no local image has been found for %s", pullPolicy, imageName)
-			return []string{resolvedImageName}, nil
-		}
-		logrus.Debugf("Pull policy %q and %s resolved to local image %s", pullPolicy, imageName, resolvedImageName)
-		return nil, errors.Wrap(storage.ErrImageUnknown, imageName)
-	}
-
 	// Unless the pull policy is "always", we must pessimistically assume
 	// that the local image has an invalid architecture (see
 	// containers/podman/issues/10682).  Hence, whenever the user requests
 	// a custom platform, set the pull policy to "always" to make sure
 	// we're pulling down the image.
+	//
+	// NOTE that this is will even override --pull={false,never}.  This is
+	// very likely a bug but a consistent one in Podman/Buildah and should
+	// be addressed at a later point.
 	if pullPolicy != config.PullPolicyAlways && len(options.Architecture)+len(options.OS)+len(options.Variant) > 0 {
 		logrus.Debugf("Enforcing pull policy to %q to support custom platform (arch: %q, os: %q, variant: %q)", "always", options.Architecture, options.OS, options.Variant)
 		pullPolicy = config.PullPolicyAlways
 	}
 
+	if pullPolicy == config.PullPolicyNever {
+		if localImage != nil {
+			logrus.Debugf("Pull policy %q but no local image has been found for %s", pullPolicy, imageName)
+			return []string{resolvedImageName}, nil
+		}
+		logrus.Debugf("Pull policy %q and %s resolved to local image %s", pullPolicy, imageName, resolvedImageName)
+		return nil, errors.Wrap(storage.ErrImageUnknown, imageName)
+	}
+
 	if pullPolicy == config.PullPolicyMissing && localImage != nil {
 		return []string{resolvedImageName}, nil
 	}