[App Management] Apps whose image has no RepoDigest are silently reported as up to date and never listed as upgradable

Aperta
  • Qualcosa non va?
#591 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, go
Ambito
backend, devops

Direzione di ricerca

Inizia da service/appstore_management.go, in IsUpdateAvailableWith, poi leggi common/constants.go e pkg/docker/digest.go, in particolare CompareDigest e il percorso NeedCheckDigestTags. Riproduci il problema con un'immagine il cui output di docker image inspect abbia RepoDigests vuoto e controlla il log di gestione. Il lavoro è completo quando le informazioni sui digest mancanti non vengono riportate come aggiornate né omesse silenziosamente, mentre le immagini con digest validi mantengono il verdetto attuale.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Environment

  • ZimaOS v1.7.1 (ZimaCube), Docker 27.5.1, kernel 6.18.9
  • zimaos-app-management binary build: 2026-08-21
  • App Management log: /var/log/casaos/mod-management.log

Symptom

Several installed apps never appear in the App Store update list, even though their images are months out of date. The apps are reported as up to date:

GET http://127.0.0.1:<app-management-port>/v2/app_management/compose
n8n             update_available=false   installed: n8nio/n8n:latest               running 2.32.5, image built 2026-07-24
homeassistant   update_available=false   installed: homeassistant/home-assistant:latest   running 2026.7.4, image built 2026-07-24
prowlarr        update_available=false   installed: linuxserver/prowlarr:latest      image built 2026-07-22
audiobookshelf  update_available=false   installed: ghcr.io/advplyr/audiobookshelf:latest   image built 2026-07-27

Current upstream for comparison (checked 2026-09-11): n8n 2.38.7, Home Assistant 2026.9.1. So real updates exist and are never offered.

Root cause

For an app whose main image tag is latest, the update verdict comes from the digest comparison, not from a tag/version comparison — service/appstore_management.go gates on common.NeedCheckDigestTags, which in the published code is var NeedCheckDigestTags = []string{"latest"} (common/constants.go:35). Inside that branch the check compares the local image's RepoDigests against the digest the registry currently serves (pkg/docker/digest.go, CompareDigest) and returns early, so the tag-string path is never reached for these apps.

On this host the local images for those four apps carry no RepoDigests at all, so the comparison has nothing to match on and the app ends up presented as up to date:

$ docker image inspect n8nio/n8n:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect homeassistant/home-assistant:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect linuxserver/prowlarr:latest --format '{{.RepoDigests}}'
[]
$ docker image inspect ghcr.io/advplyr/audiobookshelf:latest --format '{{.RepoDigests}}'
[]

and every update check for them logs the same two errors, then the app is absent from the upgradable list:

2026-09-11T06:33:58.873-0400  error  no digests found
  {"func":"service.(*AppStoreManagement).IsUpdateAvailableWith","line":821,"image":"n8nio/n8n:latest"}
2026-09-11T06:33:58.873-0400  error  no latest digest found
  {"func":"service.(*AppStoreManagement).IsUpdateAvailableWith","line":828,"image":"n8nio/n8n:latest"}

Each affected app has logged that pair on essentially every check since 2026-04-09 — n8n 147 times, homeassistant 147, prowlarr 146, audiobookshelf 142, still occurring in today's cycles.

Why the missing digest is the cause, not a coincidence

The same log, same code path, on two apps that were later re-pulled:

  • bellamy/wallos:latest and jeessy/ddns-go:latest logged the identical no digests found / no latest digest found pair until 2026-04-25, then stopped once those images were pulled again (image build dates now 2026-09-08 and 2026-09-04).
  • docker image inspect for both now returns a populated RepoDigests, and both now receive a real verdict: ddns-go is correctly reported as current (local digest == registry digest), and wallos is one of only two apps in this installation flagged update_available=true.

So the failure tracks the absence of a local digest record, not the app or the image.

Reproduction

# 1. An app whose local image has no digest record
docker image inspect <image>:latest --format '{{.RepoDigests}}'
#    -> []

# 2. Its update check fails and it never appears among upgradable apps
grep -F 'no digests found' /var/log/casaos/mod-management.log | tail

# 3. Contrast: after a pull the digest record exists and the same check completes
docker pull <image>:latest
docker image inspect <image>:latest --format '{{.RepoDigests}}'
#    -> [<image>@sha256:...]

Expected

An image whose local digest cannot be resolved should not be rendered as up to date. Either resolve the current digest from the registry by manifest lookup (the check already performs a registry request for the other side of the comparison), or report the status as unknown / needs manual check, or fall back to the tag/version comparison. Today the app is silently omitted from the update list, which is the one surface a ZimaOS user has for app updates.

Suggested fix

In the digest branch of IsUpdateAvailableWith: when len(imageInfo.RepoDigests) == 0 (or the registry digest cannot be obtained), do not resolve to "no update available" — treat the result as undetermined and surface it. The existing hardcoded escape hatch in this area suggests the digest comparison is already known to be unreliable for some images:

// the patch is have no choice
// the digest compare is not work for these images
// I don't know why, but I have to do this
// I will remove the patch after I rewrite the digest compare
var NoUpdateBlacklist = []string{"johnguan/stable-diffusion-webui:latest"}

Related but distinct

  • #570 (phantom Nextcloud update) — same subsystem, inverse direction: a false positive rather than a silent false negative. The maintainer reply there describes the tag-string comparison as the known historical gap; for :latest apps the digest branch is what actually decides, and it is the branch failing here.
  • #330, #418, #524 — update visibility / auto-updater / update-all feature requests.
  • CasaOS #1493 — historical "main app image tag is latest, thus no update available"; the digest comparison was the replacement for that rule.
Lingua principale
Shell
Stelle
3.1k
Fork
130
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di IceWhaleTech/ZimaOS

Tutte le issue di IceWhaleTech/ZimaOS

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.