From 89035c7634331dfd307241cef9d94db38edb546b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miloslav=20Trma=C4=8D?= Date: Wed, 11 Mar 2026 22:17:32 +0100 Subject: [PATCH] Actually include the config digest in the TOC computation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ... as, previously, the commit meessage claimed we do. Otherwise we could easily deduplicate images with different configs or even different (non-chunked-pulled) layers. Signed-off-by: Miloslav Trmač --- image/storage/storage_dest.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/image/storage/storage_dest.go b/image/storage/storage_dest.go index d684165d1d..318dcc0c3d 100644 --- a/image/storage/storage_dest.go +++ b/image/storage/storage_dest.go @@ -841,6 +841,8 @@ func (s *storageImageDestination) computeID(m manifest.Manifest) (string, error) // ordinaryImageID is a digest of a config, which is a JSON value. // To avoid the risk of collisions, start the input with @ so that the input is not a valid JSON. tocIDInput.WriteString("@With TOC:") + tocIDInput.WriteString(ordinaryImageID) + tocIDInput.WriteByte('|') // "|" can not be present in a digest, so this is an unambiguous separator. hasLayerPulledByTOC := false for i, li := range layerInfos { trusted, ok := s.trustedLayerIdentityDataLocked(i, li.Digest)