manifestlist implicitly supports OCI Indices in client code #3836
Description
It's known for clients using distribution.UnmarshalManifest() to use empty imports to enable support for manifest types (playground):
package main
import (
"fmt"
"github.com/distribution/distribution/v3"
_ "github.com/distribution/distribution/v3/manifest/manifestlist"
_ "github.com/distribution/distribution/v3/manifest/schema2"
)
func main() {
_, descriptor, err := distribution.UnmarshalManifest("application/vnd.docker.distribution.manifest.list.v2+json", dockerManifestList)
fmt.Println("Docker Manifest List :", descriptor.Digest, err)
_, descriptor, err = distribution.UnmarshalManifest("application/vnd.docker.distribution.manifest.v2+json", dockerV2schema2)
fmt.Println("Docker Image Manifest v2 schema2:", descriptor.Digest, err)
_, descriptor, err = distribution.UnmarshalManifest("application/vnd.oci.image.index.v1+json", ociImageIndexV1)
fmt.Println("OCI Image Index V1 :", descriptor.Digest, err)
_, descriptor, err = distribution.UnmarshalManifest("application/vnd.oci.image.manifest.v1+json", ociImageManifestV1)
fmt.Println("OCI Image Manifest V1 :", descriptor.Digest, err)
}But because OCI Indices are implimented in the manifestlist package, any such client code expecting to support Docker manifest lists and image manifests now also supports OCI Indices but not OCI Images. The failure cases might not work the way the client author intended.
This could be fixed by moving the registration of the OCI Image Index schema from manifestlist.init() to ocischema.init(), since OCI v1.0 contains both Image and Index. This would be a breaking change that could be done for v3. Or possibly this is so inconsequential that it need not be changed?