Calculate digest from right manifest list when tagging

release-engineering · Apr 26, 2024 · d28e698 · d28e698
1 parent ec9c8ec
commit d28e698
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 18 deletions.
diff --git a/pubtools/_quay/tag_docker.py b/pubtools/_quay/tag_docker.py
@@ -647,23 +647,6 @@ def merge_manifest_lists_sign_images(
             to_sign_entries = []
             to_sign_entries_internal = []
 
-            # for cosign sign also manifest list
-            to_sign_entries_internal.append(
-                SignEntry(
-                    repo=list(push_item.repos.keys())[0],
-                    reference="quay.io/"
-                    + self.target_settings["quay_namespace"]
-                    + "/"
-                    + internal_repo
-                    + ":"
-                    + tag,
-                    digest="sha256:"
-                    + hashlib.sha256(json.dumps(new_manifest_list).encode("utf-8")).hexdigest(),
-                    arch="",
-                    signing_key=push_item.claims_signing_key,
-                )
-            )
-
             for manifest in new_manifest_list["manifests"]:
                 to_sign_entries_internal.append(
                     SignEntry(
@@ -741,11 +724,30 @@ def merge_manifest_lists_sign_images(
         ) == sorted(
             json.loads(raw_src_manifest)["manifests"], key=lambda manifest: manifest["digest"]
         ):
+            ml_to_sign = cast(ManifestList, raw_src_manifest)
             self.quay_client.upload_manifest(raw_src_manifest, dest_image, raw=True)
         else:
+            ml_to_sign = cast(ManifestList, new_manifest_list)
             self.quay_client.upload_manifest(new_manifest_list, dest_image)
 
         if push_item.claims_signing_key:
+            # for cosign sign also manifest list
+            to_sign_entries_internal.append(
+                SignEntry(
+                    repo=list(push_item.repos.keys())[0],
+                    reference="quay.io/"
+                    + self.target_settings["quay_namespace"]
+                    + "/"
+                    + internal_repo
+                    + ":"
+                    + tag,
+                    digest="sha256:"
+                    + hashlib.sha256(json.dumps(ml_to_sign).encode("utf-8")).hexdigest(),
+                    arch="",
+                    signing_key=push_item.claims_signing_key,
+                )
+            )
+
             set_aws_kms_environment_variables(self.target_settings, "cosign_signer")
             for signer in self.target_settings["signing"]:
                 if signer["enabled"] and not SIGNER_BY_LABEL[signer["label"]].pre_push:

diff --git a/tests/test_integration.py b/tests/test_integration.py
@@ -821,9 +821,9 @@ def test_tag_docker_multiarch_merge_ml(
                         "quay.io/some-namespace/namespace----test_repo:v1.6",
                     ],
                     digest=[
-                        "sha256:71e75d5344d529631eaf40a8f9522edb7a66620d73eda6aff667572d511c6519",
                         "sha256:1111111111",
                         "sha256:5555555555",
+                        "sha256:71e75d5344d529631eaf40a8f9522edb7a66620d73eda6aff667572d511c6519",
                     ],
                 ),
             ]