Repository navigation
fix(verifier): retry transient image download failures - #1388
Merged
Merged
Conversation
A dropped connection or a body truncated before Content-Length failed the whole /verify, even though the next attempt would usually succeed. Retry the fetch up to three times on transport errors and 5xx responses; 4xx and local errors still fail immediately. The existing download_timeout still bounds the whole download. Carries over the retry half of #1205; the single-flight half is already on next as e300871.
kvinwang
added a commit
that referenced
this pull request
Sep 25, 2026
The verifier now retries a transient image download failure (#1388), so a two-second download timeout expires before the download error is reported. Give the one-shot rows enough time to observe the retries, and assert that a refused connection is retried, a 404 is not, and a 503 recovers. Also assert the in-process manifest digest check on a tampered archive (#1251, #1337) and that the removed debug request field is ignored and the debug response fields are gone (#1332). Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
added a commit
that referenced
this pull request
Sep 25, 2026
…bounds #1251 renamed the manifest confinement test the image-download case ran by name. Run its replacement plus the tests that pin the sha256sum grammar, the end-to-end image binding (#1337) and the truncated-download retry (#1388), and extend the measurement cache case with shape-only keying (#1334) and the bounded cache directory (#1369). Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A dropped connection or a body truncated before
Content-Lengthcurrently fails the whole/verify. Retry the image fetch up to 3 times on transport errors and 5xx responses; 4xx and local errors still fail immediately.download_timeoutstill bounds the whole download.This carries over the retry half of #1205; its single-flight half is already on
next(e300871). A truncated archive was never cached — the manifest check rejects it — so this only affects availability.