Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: avoid possible digest mismatch error #5343

Merged
merged 1 commit into from
Oct 7, 2024

Conversation

tonistiigi
Copy link
Member

There is a possibility to get a digest mismatch error if the metadata for previous download does not point to a valid reference anymore.

To mitigate this, check that ref that etag points to is still valid before using it.

Additionally .cacheKey property was not previously set in the cases where the old reference was reused. This caused a case where even if the download needed to be performed again, it always failed validation, even if the digest had not actually changed since the previous download.

There is still a small possibility that gc/prune request will delete the downloaded record in between cachemap and exec call and that the contents changes in the server at that exact time. To fix that case, we would need to modify cachemap so that it can keep hold of references until build is complete.

fixes #5020

cc @dnephin

Copy link
Member

@dnephin dnephin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Copy link
Member

@crazy-max crazy-max left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs rebase to fix freebsd issue

There is a possibility to get a digest mismatch error
if the metadata for previous download does not point to
a valid reference anymore.

To mitigate this, check that ref that etag points to
is still valid before using it.

Additionally `.cacheKey` property was not previously
set in the cases where old reference was reused. This
caused a case where even if the download needed to be
performed again, it always failed validation, even if
the digest had not actually changed since previous download.

There is still a small possibility that gc/prune request
will delete the downloaded record in between cachemap and
exec call and that the contents changes in the server
at that exact time. To fix that case we would need to
modify cachemap so that it can keep hold of references
until build is complete.

Signed-off-by: Tonis Tiigi <[email protected]>
@tonistiigi tonistiigi force-pushed the http-digest-mismatch branch from 415f934 to 3b35fc3 Compare October 5, 2024 00:18
@tonistiigi tonistiigi added this to the v0.17.0 milestone Oct 7, 2024
@tonistiigi tonistiigi merged commit 8c313f9 into moby:master Oct 7, 2024
92 checks passed
jedevc pushed a commit to jedevc/buildkit that referenced this pull request Oct 10, 2024
http: avoid possible digest mismatch error
(cherry picked from commit 8c313f9)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ADD of remote file in Dockerfile causes occasional "digest mismatch"
3 participants