crane: push command erroring with "file manifest.json not found in tar"

[Mo0rBy]

Describe the bug

I am using buildkit to build my image and then using crane to authenticate to a registry and push the image.

Here are some docs about the buildctl build command, specifically, the output option.

The command I am running to build the image is:

buildctl build \
--frontend dockerfile.v0 \
--local context=. \
--local dockerfile=. \
--output type=oci,dest=my-image.tar

This creates a my-image.tar OCI tarball file in the current working directory.

I am then authenticating to a private AWS ECR using aws ecr get-login-password --region ${region} | crane auth login --username AWS --password-stdin ${ecrRegistryUrl}") and attempting to run crane push my-image.tar ${ecrRegistryUrl}/my-repo/my-image:latest, but I get an error: Error: loading my-image.tar as tarball: file manifest.json not found in tar

To Reproduce

1. Install buildkit/buildctl for whatever OS you run.
2. Install crane
3. Build an image using buildctl build ... and make sure to save it as an OCI tarball using the flags --output type=oci,dest=my-image-tarball.tar
4. Attempt to push the image using crane push

Expected behavior

I would expect the crane push to work is all.

Anything else

❯ crane version
0.20.5

[Mo0rBy]

I did find this previous issue which seems related, but I don't really know how.

I also tried --output type=tar on my buildctl build command to see if that was any different, but crane push still gives the same error with the .tar file produced from that too.

[Mo0rBy]

Tried some previous versions. I usually have stuff installed using HomeBrew, but previous package versions were not available for crane.
Instead I did brew uninstall crane and installed previous versions using go install github.com/google/go-containerregistry/cmd/crane@<version>.

I tried v0.19.2, v0.19.0 and v0.18.0 and they all gave me the same error.

I have also found this issue for the Trivy vulnerability scanning tool.
The conclusion for this was "Trivy doesn't support OCI tarballs yet", and there is some info stating that only Docker artifacts contain a manifest.json, that file is not part of OCI compliance.

[Mo0rBy]

Ah yes, thats it!
Crane does not support OCI compliant tarballs I believe.

I ran buildctl build ... --output type=docker,dest=my-image which produces a file called my-image in the working directory, and this can be successfully pushed by crane push.

I will leave this open for now so it gets seen as being able to work with OCI compliant tarballs seems fairly important IMHO, but I don't mind if it gets closed.