oras-project/oras-go

Allow chunked blob push

Open

#338 opened on Sep 30, 2022

View on GitHub
 (3 comments) (1 reaction) (0 assignees)Go (112 forks)auto 404
enhancementhelp wantedquestion

Repository metrics

Stars
 (270 stars)
PR merge metrics
 (PR metrics pending)

Description

The current implementation of content/oci and registry/remote only supports monolithic blob upload where the descriptor must be known in advance.

If we want to support chunked blob push, we should have the implementations to implement a new interface like

type UnsafePusher interface {
	// UnsafePush pushes the content, matching the specified field in the expected descriptor.
	// - The `Digest` of the expected descriptor is recalculated if empty
	// - The `Size` of the expected descriptor is recalculated if less than zero
	// The recalculated descriptor is returned upon a successful push.
	UnsafePush(ctx context.Context, expected ocispec.Descriptor, content io.Reader) (ocispec.Descriptor, error)
}

This issue is to track the discussion on whether we should support chunked blob push with security considerations.

  • Since the digest might be missing, the integrity of the content might not be guaranteed. That is, the pushed content might be different from expected.
  • Since the size might be missing, arbitrary length or even infinite length of content might be written to the target without notice.

Contributor guide