Repository navigation
🐛 fix(oci): surface referrer lookup failures - #1873
Merged
Merged
Conversation
OCI clients received an empty index when upstream authentication, rate-limit, server, transport, or response-validation failures blocked a lookup. That result conflated failed discovery with a confirmed absence. Validate native success responses, limit tag fallback to native 404s, and preserve upstream status and `Retry-After`. Cache validated pages so a failed refresh leaves the last successful page available.
Merging this PR will not alter performance
Comparing 
Footnotes
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCI proxy clients could receive an empty referrers index when the upstream rejected, throttled, failed, disconnected, or returned a malformed success response. 🔎 That made an unavailable lookup indistinguishable from a confirmed empty result and could hide signatures or SBOMs.
The OCI Distribution Specification referrers contract reserves tag-schema fallback for a native
404. This change validates native200indexes, limits fallback to that status, preserves upstream status andRetry-After, fails the entire virtual union when any member fails, and caches only validated pages so a failed refresh retains the previous successful page.Closes #1193