Merge pull request containers#878 from vrothberg/manifest-lookup

image lookup: apply checks for matching digest

libimage/image_test.go

@@ -14,8 +14,9 @@ import (
 func TestImageFunctions(t *testing.T) {
 	// Note: this will resolve pull from the GCR registry (see
 	// testdata/registries.conf).
-	busyboxLatest := "docker.io/library/busybox:latest"
-	busyboxDigest := "docker.io/library/busybox@"
+	busybox := "docker.io/library/busybox"
+	busyboxLatest := busybox + ":latest"
+	busyboxDigest := busybox + "@"
 
 	runtime, cleanup := testNewRuntime(t)
 	defer cleanup()
@@ -62,6 +63,14 @@ func TestImageFunctions(t *testing.T) {
 	require.Len(t, digests, 2)
 	require.Equal(t, origDigest.String(), digests[0].String(), "first recoreded digest should be the one of the image")
 
+	// containers/podman/issues/12729: make sure manifest lookup returns
+	// the correct error for both digests.
+	for _, digest := range digests {
+		_, err := runtime.LookupManifestList(busybox + "@" + digest.String())
+		require.Error(t, err, "Manifest lookup should fail on an ordinary image")
+		require.Equal(t, ErrNotAManifestList, errors.Cause(err))
+	}
+
 	// Below mostly smoke tests.
 	require.False(t, image.IsReadOnly())
 	isDangling, err := image.IsDangling(ctx)

libimage/runtime.go

@@ -406,9 +406,15 @@ func (r *Runtime) lookupImageInDigestsAndRepoTags(name string, options *LookupIm
 		digest := digested.Digest()
 		for _, image := range allImages {
 			for _, d := range image.Digests() {
-				if d == digest {
-					return image, name, nil
+				if d != digest {
+					continue
+				}
+				// Also make sure that the matching image fits all criteria (e.g., manifest list).
+				if _, err := r.lookupImageInLocalStorage(name, image.ID(), options); err != nil {
+					return nil, "", err
 				}
+				return image, name, nil
+
 			}
 		}
 		return nil, "", errors.Wrap(storage.ErrImageUnknown, name)