@vercel/container 8.2.1 → 8.2.2

package/dist/index.js

@@ -105,6 +105,9 @@ function elapsed(since) {
 function shortDigest(digest) {
   return digest.startsWith("sha256:") ? `${digest.slice(0, 19)}\u2026` : digest;
 }
+function delay(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
 async function withSpan(parent, name, attrs, fn) {
   if (!parent) {
     return fn(void 0);
@@ -517,7 +520,7 @@ function formatVcrAuthError(registry, username, detail) {
 // src/engines/types.ts
 var VCR_REGISTRY = process.env.VERCEL_VCR_REGISTRY || "vcr.vercel.com";
 var TARGET_PLATFORM = "linux/amd64";
-var DIGEST_RE = /sha256:[a-f0-9]{64}/;
+var DIGEST_RE = /^sha256:[a-f0-9]{64}$/;
 function buildArgFlags(params) {
   const flags = [];
   for (const [key, value] of Object.entries(params.buildArgs ?? {})) {
@@ -526,6 +529,161 @@ function buildArgFlags(params) {
   return flags;
 }
 
+// src/registry.ts
+async function resolveRegistryTarget(params) {
+  const token = await withSpan(
+    params.span,
+    "container.mint_oidc",
+    {},
+    (s) => resolveOidcTokenForBuild(s)
+  );
+  const claims = decodeOidcClaims(token);
+  debug(`registry token: ${tokenFingerprint(token)}`);
+  debugTokenClaims("OIDC token claims", token);
+  const username = claims.owner_id;
+  if (!username) {
+    throw new Error(
+      "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
+    );
+  }
+  const fullRepository = [claims.owner, claims.project, params.repository].join(
+    "/"
+  );
+  return {
+    token,
+    claims,
+    username,
+    fullRepository,
+    imageRef: `${VCR_REGISTRY}/${fullRepository}:${params.tag}`
+  };
+}
+var MANIFEST_MEDIA_TYPES = [
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json"
+].join(", ");
+var MANIFEST_LOOKUP_ATTEMPTS = 3;
+var MANIFEST_LOOKUP_TIMEOUT_MS = 1e4;
+async function resolvePushedImageDigest(params) {
+  const fail = (reason) => new Error(
+    `Image ${params.imageRef} was pushed, but its registry digest could not be resolved: ${reason}`
+  );
+  const ref = parseTaggedImageRef(params.imageRef, params.registry);
+  if (!ref) {
+    throw fail("Expected a tagged image reference in the push registry.");
+  }
+  const url = `https://${params.registry}/v2/${ref.repository}/manifests/${encodeURIComponent(ref.tag)}`;
+  const authorization = `Basic ${Buffer.from(
+    `${params.username}:${params.token}`
+  ).toString("base64")}`;
+  let failure = "Registry request failed.";
+  for (let attempt = 1; attempt <= MANIFEST_LOOKUP_ATTEMPTS; attempt++) {
+    debug(
+      `manifest lookup (${attempt}/${MANIFEST_LOOKUP_ATTEMPTS}): HEAD ${url}`
+    );
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "HEAD",
+        headers: { authorization, accept: MANIFEST_MEDIA_TYPES },
+        redirect: "manual",
+        signal: AbortSignal.timeout(MANIFEST_LOOKUP_TIMEOUT_MS)
+      });
+    } catch (err) {
+      failure = `Registry request failed: ${describeFetchError(err)}`;
+    }
+    if (response?.ok) {
+      const digest = response.headers.get("docker-content-digest");
+      if (!digest || !DIGEST_RE.test(digest)) {
+        throw fail("Registry returned a missing or invalid manifest digest.");
+      }
+      return digest;
+    }
+    if (response) {
+      failure = `Registry returned HTTP ${response.status}.`;
+      const retryable = response.status === 404 || response.status === 429 || response.status >= 500;
+      if (!retryable) {
+        throw fail(failure);
+      }
+    }
+    debug(`manifest lookup failed: ${failure}`);
+    if (attempt < MANIFEST_LOOKUP_ATTEMPTS) {
+      await delay(500 * 2 ** (attempt - 1));
+    }
+  }
+  throw fail(failure);
+}
+function parseTaggedImageRef(imageRef, registry) {
+  const prefix = `${registry}/`;
+  if (!imageRef.startsWith(prefix)) {
+    return void 0;
+  }
+  const imagePath = imageRef.slice(prefix.length);
+  const tagSeparator = imagePath.lastIndexOf(":");
+  if (tagSeparator <= imagePath.lastIndexOf("/") || tagSeparator === imagePath.length - 1) {
+    return void 0;
+  }
+  return {
+    repository: imagePath.slice(0, tagSeparator),
+    tag: imagePath.slice(tagSeparator + 1)
+  };
+}
+function describeFetchError(err) {
+  const error = err;
+  const cause = error.cause?.message;
+  return cause ? `${error.message} (${cause})` : error.message;
+}
+async function ensureRepository(repository, token, claims, span) {
+  if (repository.includes("/")) {
+    debug(`skipping repository auto-create (fully-qualified "${repository}")`);
+    span?.setAttributes({ "repository.create_result": "skipped_qualified" });
+    return;
+  }
+  const teamId = claims.owner_id;
+  const projectId = claims.project_id;
+  if (!teamId || !projectId) {
+    debug(
+      `skipping repository auto-create (missing ${!teamId ? "team id" : "project id"})`
+    );
+    span?.setAttributes({
+      "repository.create_result": "skipped_missing_ids"
+    });
+    return;
+  }
+  span?.setAttributes({ "team.id": teamId, "project.id": projectId });
+  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
+  const url = `${apiUrl}/v1/vcr/repository?teamId=${encodeURIComponent(teamId)}`;
+  const body = JSON.stringify({ name: repository, projectId });
+  step(`Ensuring registry repository "${repository}"`);
+  debug(`repository create: POST ${url}`);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body
+    });
+    span?.setAttributes({ "repository.create_status": toTag(res.status) });
+    if (res.ok) {
+      span?.setAttributes({ "repository.create_result": "created" });
+      done(`created repository "${repository}"`);
+    } else if (res.status === 409) {
+      span?.setAttributes({ "repository.create_result": "already_exists" });
+      done(`repository "${repository}" already exists`);
+    } else {
+      span?.setAttributes({ "repository.create_result": "unexpected_status" });
+      done("continuing \u2014 push will validate the repository");
+    }
+  } catch (err) {
+    debug(`repository auto-create failed: ${err.message}`);
+    span?.setAttributes({ "repository.create_result": "error" });
+    done("continuing \u2014 push will validate the repository");
+  }
+}
+
 // src/engines/buildah.ts
 async function runBuildah(args, opts = {}) {
   const storageArgs = await buildahStorageArgs();
@@ -693,6 +851,7 @@ ${stderr}`);
       `pushing ${params.imageRef} ` + (zstdEnabled ? "with zstd compression (level=3, force, oci)" : "with default compression (zstd disabled)")
     );
     const pushStart = Date.now();
+    let digest;
     try {
       await runBuildah([
         "push",
@@ -701,12 +860,7 @@ ${stderr}`);
         digestFile,
         params.imageRef
       ]);
-      const digest = (0, import_node_fs3.readFileSync)(digestFile, "utf8").trim();
-      const resolved = digest.match(/sha256:[a-f0-9]{64}/)?.[0] ?? (digest || void 0);
-      debug(
-        `push completed in ${Date.now() - pushStart}ms` + (resolved ? ` (digest ${resolved})` : "")
-      );
-      return resolved;
+      digest = readDigestFile(digestFile);
     } catch (err) {
       const message = err.message;
       if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
@@ -726,8 +880,25 @@ ${stderr}`);
     } finally {
       (0, import_node_fs3.rmSync)(digestDir, { recursive: true, force: true });
     }
+    debug(`push completed in ${Date.now() - pushStart}ms`);
+    if (DIGEST_RE.test(digest)) {
+      debug(`pushed digest ${digest}`);
+      return digest;
+    }
+    debug(
+      `--digestfile did not contain a digest (${JSON.stringify(digest)}) \u2014 resolving registry manifest`
+    );
+    return resolvePushedImageDigest(params);
   }
 };
+function readDigestFile(path4) {
+  try {
+    return (0, import_node_fs3.readFileSync)(path4, "utf8").trim();
+  } catch (err) {
+    debug(`could not read --digestfile: ${err.message}`);
+    return "";
+  }
+}
 
 // src/engines/docker.ts
 var import_node_child_process2 = require("child_process");
@@ -989,22 +1160,12 @@ ${version2.trim()}`);
     }
   },
   async push(params) {
+    let output;
     try {
       info(`pushing ${params.imageRef}`);
       const pushStart = Date.now();
-      const { stdout } = await runDocker(["push", params.imageRef]);
+      output = await runDocker(["push", params.imageRef]);
       debug(`push completed in ${Date.now() - pushStart}ms`);
-      let resolvedDigest = stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
-      if (!resolvedDigest) {
-        debug("digest not found in push output \u2014 inspecting RepoDigests");
-        const inspect = await run(
-          "docker",
-          ["inspect", "--format", "{{index .RepoDigests 0}}", params.imageRef],
-          { quiet: true }
-        );
-        resolvedDigest = inspect.stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
-      }
-      return resolvedDigest;
     } catch (err) {
       const message = err.message;
       if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
@@ -1022,6 +1183,13 @@ ${version2.trim()}`);
       }
       throw err;
     }
+    const summary = /^[^\s:]+: digest: (sha256:[a-f0-9]{64}) size: \d+\s*$/m;
+    const digest = output.stdout.match(summary)?.[1] ?? output.stderr.match(summary)?.[1];
+    if (digest) {
+      return digest;
+    }
+    debug("digest not found in push summary \u2014 resolving registry manifest");
+    return resolvePushedImageDigest(params);
   }
 };
 
@@ -1042,84 +1210,6 @@ var import_node_fs10 = require("fs");
 var import_node_os7 = require("os");
 var import_node_path10 = require("path");
 
-// src/registry.ts
-async function resolveRegistryTarget(params) {
-  const token = await withSpan(
-    params.span,
-    "container.mint_oidc",
-    {},
-    (s) => resolveOidcTokenForBuild(s)
-  );
-  const claims = decodeOidcClaims(token);
-  debug(`registry token: ${tokenFingerprint(token)}`);
-  debugTokenClaims("OIDC token claims", token);
-  const username = claims.owner_id;
-  if (!username) {
-    throw new Error(
-      "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
-    );
-  }
-  const fullRepository = [claims.owner, claims.project, params.repository].join(
-    "/"
-  );
-  return {
-    token,
-    claims,
-    username,
-    fullRepository,
-    imageRef: `${VCR_REGISTRY}/${fullRepository}:${params.tag}`
-  };
-}
-async function ensureRepository(repository, token, claims, span) {
-  if (repository.includes("/")) {
-    debug(`skipping repository auto-create (fully-qualified "${repository}")`);
-    span?.setAttributes({ "repository.create_result": "skipped_qualified" });
-    return;
-  }
-  const teamId = claims.owner_id;
-  const projectId = claims.project_id;
-  if (!teamId || !projectId) {
-    debug(
-      `skipping repository auto-create (missing ${!teamId ? "team id" : "project id"})`
-    );
-    span?.setAttributes({
-      "repository.create_result": "skipped_missing_ids"
-    });
-    return;
-  }
-  span?.setAttributes({ "team.id": teamId, "project.id": projectId });
-  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
-  const url = `${apiUrl}/v1/vcr/repository?teamId=${encodeURIComponent(teamId)}`;
-  const body = JSON.stringify({ name: repository, projectId });
-  step(`Ensuring registry repository "${repository}"`);
-  debug(`repository create: POST ${url}`);
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json"
-      },
-      body
-    });
-    span?.setAttributes({ "repository.create_status": toTag(res.status) });
-    if (res.ok) {
-      span?.setAttributes({ "repository.create_result": "created" });
-      done(`created repository "${repository}"`);
-    } else if (res.status === 409) {
-      span?.setAttributes({ "repository.create_result": "already_exists" });
-      done(`repository "${repository}" already exists`);
-    } else {
-      span?.setAttributes({ "repository.create_result": "unexpected_status" });
-      done("continuing \u2014 push will validate the repository");
-    }
-  } catch (err) {
-    debug(`repository auto-create failed: ${err.message}`);
-    span?.setAttributes({ "repository.create_result": "error" });
-    done("continuing \u2014 push will validate the repository");
-  }
-}
-
 // src/buildpacks/lifecycle/lifecycle.ts
 var import_build_utils3 = require("@vercel/build-utils");
 var import_node_crypto2 = require("crypto");
@@ -2767,16 +2857,14 @@ async function buildAndPushImage(params) {
           { "image.ref": imageRef },
           () => engine.push(buildParams)
         );
-        done(
-          digest ? `pushed ${shortDigest(digest)} in ${elapsed(pushStart)}` : `pushed in ${elapsed(pushStart)}`
-        );
+        done(`pushed ${shortDigest(digest)} in ${elapsed(pushStart)}`);
         await withSpan(
           buildSpan,
           "container.report_storage",
           { "container.engine": engine.name },
           (s) => engine.reportStorage?.(s) ?? Promise.resolve()
         );
-        const resolvedRef = digest ? `${VCR_REGISTRY}/${fullRepository}@${digest}` : imageRef;
+        const resolvedRef = `${VCR_REGISTRY}/${fullRepository}@${digest}`;
         buildSpan?.setAttributes({
           "image.digest": digest,
           "image.resolved_ref": resolvedRef

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/container",
-  "version": "8.2.1",
+  "version": "8.2.2",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "homepage": "https://vercel.com/docs",
@@ -31,7 +31,7 @@
     "build": "node ../../utils/build-builder.mjs",
     "type-check": "tsc --noEmit",
     "test": "vitest run --config ../../vitest.config.mts",
-    "test-unit": "vitest run --config ../../vitest.config.mts test/unit.test.ts test/diagnostics.test.ts test/workspace.test.ts test/lifecycle-docker.test.ts test/ruby-version.test.ts",
+    "test-unit": "vitest run --config ../../vitest.config.mts test/unit.test.ts test/diagnostics.test.ts test/workspace.test.ts test/lifecycle-docker.test.ts test/ruby-version.test.ts test/docker-push.test.ts",
     "test-e2e": "vitest run --config ../../vitest.config.mts test/e2e.test.ts"
   }
 }