[POC] Some exploration base image puller and matcher #16417
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Skipping CI for Draft Pull Request. |
|
Caution There are some errors in your PipelineRun template.
|
|
Images are ready for the commit at 52822a6. To use with deploy scripts, first |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #16417 +/- ##
=======================================
Coverage 49.07% 49.08%
=======================================
Files 2640 2640
Lines 195603 195603
=======================================
+ Hits 95999 96002 +3
+ Misses 92095 92093 -2
+ Partials 7509 7508 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a proof-of-concept (POC) tool for base image detection that infers an image's base by matching the target's layer digest prefix against a set of candidate base images. The tool operates without pulling image layers, instead relying on manifest inspection for efficient analysis.
Key changes:
- Implementation of a registry client for container image inspection
- Base image detection algorithm using layer digest prefix matching
- JSON-based caching system for registry metadata
- CLI tool with support for both explicit base references and repository exploration
Reviewed Changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| registry/registry.go | Registry client implementation for image inspection and tag listing |
| main.go | Main CLI application with base image detection logic and semver-based tag sorting |
| jsoncache/jsoncache.go | JSON file cache for storing registry inspection results |
| go.mod | Go module dependencies including container registry libraries |
| README.md | Documentation explaining the POC concept, usage, and limitations |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
| } | ||
|
|
||
| func (rc *Client) authID(authfile string) string { | ||
| h := sha1.New() |
There was a problem hiding this comment.
SHA-1 is cryptographically weak and should not be used for security purposes. Consider using SHA-256 or another secure hash function from the crypto/sha256 package.
Suggested change
| h := sha1.New() | |
| h := sha256.New() |
Copilot uses AI. Check for mistakes.
| func (c *JSONCache) pathFor(key string) string { | ||
| // slug + digest to keep filenames short & safe | ||
| slug := regexp.MustCompile(`[^a-zA-Z0-9]+`).ReplaceAllString(strings.ToLower(key), "") | ||
| sum := sha1.Sum([]byte(key)) |
There was a problem hiding this comment.
SHA-1 is cryptographically weak and should not be used. Consider using SHA-256 or another secure hash function from the crypto/sha256 package.
Suggested change
| sum := sha1.Sum([]byte(key)) | |
| sum := sha256.Sum256([]byte(key)) |
Copilot uses AI. Check for mistakes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
A ad-hoc tool to explore the concept and idea behind the plans for base image detection. See README for further details.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
Example on how this works: