ROX-30918, ROX-31049: Update labels, fix docker mediaType

[msugakov]

Description

In this PR:

1. I set cpe and name labels similar to as suggested in PRs from Ralph, e.g. chore(KONFLUX-6210): fix name label and set cpe label #2148.
2. Set org.opencontainers.image.created label. This one is flagged as a warning by Conforma and so worth proactively addressing. It goes via BUILD_TIMESTAMP param. See the related thread.
3. Fix media type that wasn't correctly set for multi-arch images see the Slack thread after this message. This one's done via BUILDAH_FORMAT param.

The PR can be reviewed by commits.

This PR is to backported to release branches (part of the same task).

Validation

• Pulled images for each of 4 architectures as well as index image and inspected their labels.
• cpe is there.
• name is new.
• org.opencontainers.image.created is there and looks valid.
• Verified media type of 4 per-arch images and of index image.

Did this by looking at the output of the script provided below.

• Verified Conforma does not flag missing SBOMs or something similar.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[msugakov]

/retest

[msugakov]

Checking mediaType

First, on image index.

For the new image

$ skopeo inspect --raw docker://quay.io/rhacs-eng/release-scanner-db:2.37.x-123-g85c1a10c2f-fast | jq | grep mediaType
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",

For some old image

$ skopeo inspect --raw docker://quay.io/rhacs-eng/release-scanner-db:2.37.x-86-g512e07171a-fast | jq | grep mediaType 
  "mediaType": "application/vnd.oci.image.index.v1+json",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",

From there, one can check on per-arch images like this:

$ skopeo inspect --raw docker://quay.io/rhacs-eng/release-scanner-db:2.37.x-123-g85c1a10c2f-fast-arm64 | jq | grep mediaType                   
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "mediaType": "application/vnd.docker.container.image.v1+json",
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",

$ skopeo inspect --raw docker://quay.io/rhacs-eng/release-scanner-db:2.37.x-86-g512e07171a-fast-arm64 | jq | grep mediaType 
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
    "mediaType": "application/vnd.oci.image.config.v1+json",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",

So we need to make sure there's .docker. and no .oci. for the new images.

[msugakov]

Here's my "data dump" script:

#!/usr/bin/env bash

set -euo pipefail

tag="2.37.x-123-g85c1a10c2f-fast"
parent="quay.io/rhacs-eng"
repos=(release-scanner release-scanner-db release-scanner-slim release-scanner-db-slim)
arch_suffixes=(amd64 s390x ppc64le arm64)

echo " >>> Checking mediaType on indexes"

for repo in "${repos[@]}"; do
  index="${parent}/${repo}:${tag}"
  echo "  >>> on ${index}"
  skopeo inspect --raw "docker://${index}" | jq | grep mediaType
done

echo " >>> Checking mediaType on images"

for repo in "${repos[@]}"; do
  index="${parent}/${repo}:${tag}"

  for arch in "${arch_suffixes[@]}"; do
    image="${index}-${arch}"
    echo "  >>> on ${image}"
    skopeo inspect --raw "docker://${image}" | jq | grep mediaType
  done
done

echo " >>> Checking labels on images"

for repo in "${repos[@]}"; do
  index="${parent}/${repo}:${tag}"

  for arch in "${arch_suffixes[@]}"; do
    image="${index}-${arch}"
    echo "  >>> on ${image}"
    skopeo inspect --no-tags "docker://${image}" | grep -E '"(cpe|name|org.opencontainers.image.created)"'
  done
done

Ran it both stand-alone and looked in the output and as ./check.sh | sort | uniq -c also looking through the output.

[tommartensen]

[post-merge] This needs to be mentioned in the https://spaces.redhat.com/spaces/StackRox/pages/690979844/Upstream+Konflux+Release#Upstream+KonfluxRelease-update-version-in-reposPutversioninKonfluxpipelinesandDockerfiles

[openshift-ci]

@msugakov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-tests	85c1a10	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.