enhancementhelp wantedquestion
Repository metrics
- Stars
- (270 stars)
- PR merge metrics
- (PR metrics pending)
Description
The current implementation of content/oci and registry/remote only supports monolithic blob upload where the descriptor must be known in advance.
If we want to support chunked blob push, we should have the implementations to implement a new interface like
type UnsafePusher interface {
// UnsafePush pushes the content, matching the specified field in the expected descriptor.
// - The `Digest` of the expected descriptor is recalculated if empty
// - The `Size` of the expected descriptor is recalculated if less than zero
// The recalculated descriptor is returned upon a successful push.
UnsafePush(ctx context.Context, expected ocispec.Descriptor, content io.Reader) (ocispec.Descriptor, error)
}
This issue is to track the discussion on whether we should support chunked blob push with security considerations.
- Since the digest might be missing, the integrity of the content might not be guaranteed. That is, the pushed content might be different from expected.
- Since the size might be missing, arbitrary length or even infinite length of content might be written to the target without notice.