feat: index referrers for image manifests

manifest/ocischema/builder.go

@@ -22,6 +22,10 @@ type Builder struct {
 	// calls to AppendReference.
 	layers []distribution.Descriptor
 
+	// Subject specifies the descriptor of another manifest. This value is
+	// used by the referrers API.
+	subject *distribution.Descriptor
+
 	// Annotations contains arbitrary metadata relating to the targeted content.
 	annotations map[string]string
 
@@ -32,10 +36,11 @@ type Builder struct {
 // NewManifestBuilder is used to build new manifests for the current schema
 // version. It takes a BlobService so it can publish the configuration blob
 // as part of the Build process, and annotations.
-func NewManifestBuilder(bs distribution.BlobService, configJSON []byte, annotations map[string]string) distribution.ManifestBuilder {
+func NewManifestBuilder(bs distribution.BlobService, configJSON []byte, subject *distribution.Descriptor, annotations map[string]string) distribution.ManifestBuilder {
 	mb := &Builder{
 		bs:          bs,
 		configJSON:  make([]byte, len(configJSON)),
+		subject:     subject,
 		annotations: annotations,
 		mediaType:   v1.MediaTypeImageManifest,
 	}
@@ -63,6 +68,7 @@ func (mb *Builder) Build(ctx context.Context) (distribution.Manifest, error) {
 			MediaType:     mb.mediaType,
 		},
 		Layers:      make([]distribution.Descriptor, len(mb.layers)),
+		Subject:     mb.subject,
 		Annotations: mb.annotations,
 	}
 	copy(m.Layers, mb.layers)

manifest/ocischema/builder_test.go

@@ -126,7 +126,7 @@ func TestBuilder(t *testing.T) {
 	annotations := map[string]string{"hot": "potato"}
 
 	bs := &mockBlobService{descriptors: make(map[digest.Digest]distribution.Descriptor)}
-	builder := NewManifestBuilder(bs, imgJSON, annotations)
+	builder := NewManifestBuilder(bs, imgJSON, nil, annotations)
 
 	for _, d := range descriptors {
 		if err := builder.AppendReference(d); err != nil {

manifest/ocischema/manifest.go

@@ -51,6 +51,10 @@ type Manifest struct {
 	// configuration.
 	Layers []distribution.Descriptor `json:"layers"`
 
+	// Subject specifies the descriptor of another manifest. This value is
+	// used by the referrers API.
+	Subject *distribution.Descriptor `json:"subject,omitempty"`
+
 	// Annotations contains arbitrary metadata for the image manifest.
 	Annotations map[string]string `json:"annotations,omitempty"`
 }

registry/storage/manifeststore_test.go

@@ -407,7 +407,7 @@ func testOCIManifestStorage(t *testing.T, testname string, includeMediaTypes boo
 	// Build a manifest and store it and its layers in the registry
 
 	blobStore := env.repository.Blobs(ctx)
-	builder := ocischema.NewManifestBuilder(blobStore, []byte{}, map[string]string{})
+	builder := ocischema.NewManifestBuilder(blobStore, []byte{}, nil, map[string]string{})
 	err = builder.(*ocischema.Builder).SetMediaType(imageMediaType)
 	if err != nil {
 		t.Fatal(err)

registry/storage/ocimanifesthandler.go

@@ -8,16 +8,18 @@ import (
 	"github.com/distribution/distribution/v3"
 	dcontext "github.com/distribution/distribution/v3/context"
 	"github.com/distribution/distribution/v3/manifest/ocischema"
+	"github.com/distribution/distribution/v3/registry/storage/driver"
 	"github.com/opencontainers/go-digest"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
-//ocischemaManifestHandler is a ManifestHandler that covers ocischema manifests.
+// ocischemaManifestHandler is a ManifestHandler that covers ocischema manifests.
 type ocischemaManifestHandler struct {
-	repository   distribution.Repository
-	blobStore    distribution.BlobStore
-	ctx          context.Context
-	manifestURLs manifestURLs
+	repository    distribution.Repository
+	blobStore     distribution.BlobStore
+	ctx           context.Context
+	manifestURLs  manifestURLs
+	storageDriver driver.StorageDriver
 }
 
 var _ ManifestHandler = &ocischemaManifestHandler{}
@@ -56,6 +58,12 @@ func (ms *ocischemaManifestHandler) Put(ctx context.Context, manifest distributi
 		return "", err
 	}
 
+	err = ms.indexReferrers(ctx, m, revision.Digest)
+	if err != nil {
+		dcontext.GetLogger(ctx).Errorf("error indexing referrers: %v", err)
+		return "", err
+	}
+
 	return revision.Digest, nil
 }
 
@@ -78,6 +86,21 @@ func (ms *ocischemaManifestHandler) verifyManifest(ctx context.Context, mnfst oc
 		return err
 	}
 
+	// validate the subject
+	if mnfst.Subject != nil {
+		// check if the digest is valid
+		err := mnfst.Subject.Digest.Validate()
+		if err != nil {
+			errs = append(errs, err, distribution.ErrManifestBlobUnknown{Digest: mnfst.Subject.Digest})
+		} else {
+			// check the presence
+			exists, err := manifestService.Exists(ctx, mnfst.Subject.Digest)
+			if err != nil || !exists {
+				errs = append(errs, distribution.ErrManifestBlobUnknown{Digest: mnfst.Subject.Digest})
+			}
+		}
+	}
+
 	blobsService := ms.repository.Blobs(ctx)
 
 	for _, descriptor := range mnfst.References() {
@@ -141,3 +164,20 @@ func (ms *ocischemaManifestHandler) verifyManifest(ctx context.Context, mnfst oc
 
 	return nil
 }
+
+// indexReferrers indexes the subject of the given revision in its referrers index store.
+func (ms *ocischemaManifestHandler) indexReferrers(ctx context.Context, dm *ocischema.DeserializedManifest, revision digest.Digest) error {
+	if dm.Subject == nil {
+		return nil
+	}
+
+	// [TODO] We can use artifact type in the link path to support filtering by artifact type
+	//  but need to consider the max path length in different os
+	subjectRevision := dm.Subject.Digest
+
+	referrersLinkPath, err := pathFor(referrersLinkPathSpec{name: ms.repository.Named().Name(), revision: revision, subjectRevision: subjectRevision})
+	if err != nil {
+		return fmt.Errorf("failed to generate referrers link path for %v", revision)
+	}
+	return ms.storageDriver.PutContent(ctx, referrersLinkPath, []byte(revision.String()))
+}

registry/storage/registry.go

@@ -283,10 +283,11 @@ func (repo *repository) Manifests(ctx context.Context, options ...distribution.M
 			blobStore:  blobStore,
 		},
 		ocischemaHandler: &ocischemaManifestHandler{
-			ctx:          ctx,
-			repository:   repo,
-			blobStore:    blobStore,
-			manifestURLs: repo.registry.manifestURLs,
+			ctx:           ctx,
+			repository:    repo,
+			blobStore:     blobStore,
+			manifestURLs:  repo.registry.manifestURLs,
+			storageDriver: repo.driver,
 		},
 		ociartifactHandler: &ociArtifactManifestHandler{
 			repository:    repo,