[App Management] Apps whose image has no RepoDigest are silently reported as up to date and never listed as upgradable

Abierto
  • ¿Algo no está bien?
#591 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
docker, go
Área
backend, devops

Línea de trabajo

Comienza en service/appstore_management.go, en IsUpdateAvailableWith; después, lee common/constants.go y pkg/docker/digest.go, especialmente CompareDigest y la ruta NeedCheckDigestTags. Reproduce el problema con una imagen cuya salida de docker image inspect tenga RepoDigests vacíos y revisa el registro de gestión. Se considera terminado cuando la información de digest ausente no se informe como actual ni se omita silenciosamente, mientras que las imágenes con digests válidos conservan su veredicto actual.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Environment

  • ZimaOS v1.7.1 (ZimaCube), Docker 27.5.1, kernel 6.18.9
  • zimaos-app-management binary build: 2026-08-21
  • App Management log: /var/log/casaos/mod-management.log

Symptom

Several installed apps never appear in the App Store update list, even though their images are months out of date. The apps are reported as up to date:

GET http://127.0.0.1:<app-management-port>/v2/app_management/compose
n8n             update_available=false   installed: n8nio/n8n:latest               running 2.32.5, image built 2026-07-24
homeassistant   update_available=false   installed: homeassistant/home-assistant:latest   running 2026.7.4, image built 2026-07-24
prowlarr        update_available=false   installed: linuxserver/prowlarr:latest      image built 2026-07-22
audiobookshelf  update_available=false   installed: ghcr.io/advplyr/audiobookshelf:latest   image built 2026-07-27

Current upstream for comparison (checked 2026-09-11): n8n 2.38.7, Home Assistant 2026.9.1. So real updates exist and are never offered.

Root cause

For an app whose main image tag is latest, the update verdict comes from the digest comparison, not from a tag/version comparison — service/appstore_management.go gates on common.NeedCheckDigestTags, which in the published code is var NeedCheckDigestTags = []string{"latest"} (common/constants.go:35). Inside that branch the check compares the local image's RepoDigests against the digest the registry currently serves (pkg/docker/digest.go, CompareDigest) and returns early, so the tag-string path is never reached for these apps.

On this host the local images for those four apps carry no RepoDigests at all, so the comparison has nothing to match on and the app ends up presented as up to date:

$ docker image inspect n8nio/n8n:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect homeassistant/home-assistant:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect linuxserver/prowlarr:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect ghcr.io/advplyr/audiobookshelf:latest --format '{{.RepoDigests}}'
[]

and every update check for them logs the same two errors, then the app is absent from the upgradable list:

2026-09-11T06:33:58.873-0400  error  no digests found
  {"func":"service.(*AppStoreManagement).IsUpdateAvailableWith","line":821,"image":"n8nio/n8n:latest"}
2026-09-11T06:33:58.873-0400  error  no latest digest found
  {"func":"service.(*AppStoreManagement).IsUpdateAvailableWith","line":828,"image":"n8nio/n8n:latest"}

Each affected app has logged that pair on essentially every check since 2026-04-09 — n8n 147 times, homeassistant 147, prowlarr 146, audiobookshelf 142, still occurring in today's cycles.

Why the missing digest is the cause, not a coincidence

The same log, same code path, on two apps that were later re-pulled:

  • bellamy/wallos:latest and jeessy/ddns-go:latest logged the identical no digests found / no latest digest found pair until 2026-04-25, then stopped once those images were pulled again (image build dates now 2026-09-08 and 2026-09-04).
  • docker image inspect for both now returns a populated RepoDigests, and both now receive a real verdict: ddns-go is correctly reported as current (local digest == registry digest), and wallos is one of only two apps in this installation flagged update_available=true.

So the failure tracks the absence of a local digest record, not the app or the image.

Reproduction

# 1. An app whose local image has no digest record
docker image inspect <image>:latest --format '{{.RepoDigests}}'
#    -> []

# 2. Its update check fails and it never appears among upgradable apps
grep -F 'no digests found' /var/log/casaos/mod-management.log | tail

# 3. Contrast: after a pull the digest record exists and the same check completes
docker pull <image>:latest
docker image inspect <image>:latest --format '{{.RepoDigests}}'
#    -> [<image>@sha256:...]

Expected

An image whose local digest cannot be resolved should not be rendered as up to date. Either resolve the current digest from the registry by manifest lookup (the check already performs a registry request for the other side of the comparison), or report the status as unknown / needs manual check, or fall back to the tag/version comparison. Today the app is silently omitted from the update list, which is the one surface a ZimaOS user has for app updates.

Suggested fix

In the digest branch of IsUpdateAvailableWith: when len(imageInfo.RepoDigests) == 0 (or the registry digest cannot be obtained), do not resolve to "no update available" — treat the result as undetermined and surface it. The existing hardcoded escape hatch in this area suggests the digest comparison is already known to be unreliable for some images:

// the patch is have no choice
// the digest compare is not work for these images
// I don't know why, but I have to do this
// I will remove the patch after I rewrite the digest compare
var NoUpdateBlacklist = []string{"johnguan/stable-diffusion-webui:latest"}

Related but distinct

  • #570 (phantom Nextcloud update) — same subsystem, inverse direction: a false positive rather than a silent false negative. The maintainer reply there describes the tag-string comparison as the known historical gap; for :latest apps the digest branch is what actually decides, and it is the branch failing here.
  • #330, #418, #524 — update visibility / auto-updater / update-all feature requests.
  • CasaOS #1493 — historical "main app image tag is latest, thus no update available"; the digest comparison was the replacement for that rule.
Lenguaje dominante
Shell
Estrellas
3.1k
Forks
130
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de IceWhaleTech/ZimaOS

Todos los issues de IceWhaleTech/ZimaOS

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.