commit: always return the config digest as the image ID

When committing, if we didn't get an image ID off the bat because the
image wasn't being committed to local storage, try to return the image's
configuration blob digest, which is what is traditionally used as the
image's ID.

This allows the --iidfile flag to write a value to a file in situations
where the image isn't being written to local storage.  The image ID is
of limited value in these cases, since we can't use it to look up the
image anywhere else, but at least we don't write a file that just has
the digest name prefix or log an empty string.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Author: nalind

commit.go

@@ -531,6 +531,16 @@ func (b *Builder) Commit(ctx context.Context, dest types.ImageReference, options
 	if err != nil {
 		return imgID, nil, "", fmt.Errorf("computing digest of manifest of new image %q: %w", transports.ImageName(dest), err)
 	}
+	if imgID == "" {
+		parsedManifest, err := manifest.FromBlob(manifestBytes, manifest.GuessMIMEType(manifestBytes))
+		if err != nil {
+			return imgID, nil, "", fmt.Errorf("parsing written manifest to determine the image's ID: %w", err)
+		}
+		configInfo := parsedManifest.ConfigInfo()
+		if configInfo.Size > 2 && configInfo.Digest.Validate() == nil { // don't be returning a digest of "" or "{}"
+			imgID = configInfo.Digest.Encoded()
+		}
+	}
 
 	var ref reference.Canonical
 	if name := dest.DockerReference(); name != nil {

imagebuildah/executor.go

@@ -1086,7 +1086,11 @@ func (b *Executor) Build(ctx context.Context, stages imagebuilder.Stages) (image
 	}
 	logrus.Debugf("printing final image id %q", imageID)
 	if b.iidfile != "" {
-		if err = os.WriteFile(b.iidfile, []byte("sha256:"+imageID), 0o644); err != nil {
+		iid := imageID
+		if iid != "" {
+			iid = "sha256:" + iid // only prepend a digest algorithm name if we actually got a value back
+		}
+		if err = os.WriteFile(b.iidfile, []byte(iid), 0o644); err != nil {
 			return imageID, ref, fmt.Errorf("failed to write image ID to file %q: %w", b.iidfile, err)
 		}
 	} else {

tests/bud.bats

@@ -8958,3 +8958,29 @@ EOF
   run_buildah build --layers=false "${contextdir}"
   expect_output --substring /mounted/brand-new-subdir
 }
+
+@test "bud with --iidfile" {
+  target=scratch-image
+  local contextdir=${TEST_SCRATCH_DIR}/context
+  mkdir -p "${contextdir}"
+  cat > "${contextdir}"/Dockerfile <<-EOF
+  FROM scratch
+  COPY . .
+EOF
+  for layers in "--layers=true" "--layers=false" ; do
+    for destination in "dir:${TEST_SCRATCH_DIR}/dir" "oci-archive:${TEST_SCRATCH_DIR}/oci-archive" "docker-archive:${TEST_SCRATCH_DIR}/docker-archive" "oci:${TEST_SCRATCH_DIR}/oci-layout" "local" ; do
+      rm -f "${TEST_SCRATCH_DIR}"/iidfile
+      fsname="${destination#*:}" # assume : is used in a non-containers-storage name rather than a repository name + tag combination
+      if test "${fsname}" != "${destination}" ; then
+        rm -fr "${fsname}"
+      fi
+      run_buildah build --iidfile "${TEST_SCRATCH_DIR}"/iidfile --no-cache "${layers}" -t "${destination}" "${contextdir}"
+      local iid=$(cat "${TEST_SCRATCH_DIR}"/iidfile)
+      assert "${iid}" != ""
+      assert "${iid#sha256:}" != ""
+      if test "${fsname}" != "${destination}" ; then
+        test -e "${fsname}"
+      fi
+    done
+  done
+}