Consider ignoring image name annotations by default (default mode cannot be satisfied otherwise)

[Antiz96]

Hi,

Thanks for your work on diffoci!

Please correct me if I'm wrong, but it seems to me that it is not currently possible to use diffoci to verify reproducibility of an image with the default (non --semantic) mode, given the following "paradox":

• It's not possible to store (and therefore compare) two images with the same name.
• It's not possible to have two images with a different name without introducing unavoidable differences in the image name annotations (which diffoci will complain about).

I'm aware this is more of a Docker issue/limitation, but it's a bit paradoxical to not be able to fully satisfy diffoci from a technical point of view. The --semantic (a.k.a non-strict) mode allows a successful test, but it ignores too many attributes to be a fair representation of reproducibility IMHO. For instance, I was able to fix/normalize timestamps and file ordering (which are ignored with this mode), the unavoidable difference in image name annotations is the only remaining attribute that diffoci reports on my side.

As far as I can tell, the image name annotations are specific to metadata handling in container tooling, and do not affect the actual filesystem contents of the image. As a matter of fact, they do not appear to be part of the hashed object when generating the image digest, as a difference in image name annotations between my two images does not prevent digest equality.

As such, I'd like to suggest ignoring image name annotations by default (not only with --semantic). Assuming that the above observations are correct, it feels a bit weird not being able to satisfy diffoci in non-strict mode for something that is currently unavoidable & cannot be fixed or work around (as opposed to other attributes ignored by the --semantic mode) and that doesn't even go in the way of reproducibility (as far as I can tell).
Alternatively a dedicated flag specifically for image name annotation (whether it is to ignore it or take it into consideration) could eventually be added, rather than bundling it with other attributes in the --semantic flag.

Thanks again for your your work on diffoci and for your consideration!

[AkihiroSuda]

Alternatively a dedicated flag specifically for image name annotation

We already have --ignore-image-name

$ diffoci diff --help
[...]
      --ignore-file-mode-redundant-bits   Ignore redundant bits of file mode
      --ignore-file-order                 Ignore file order in tar layers
      --ignore-history                    Ignore history
      --ignore-image-name                 Ignore image name annotation
      --ignore-tar-format                 Ignore tar format
      --ignore-timestamps                 Ignore timestamps
[...]
      --treat-canonical-paths-equal ./    Treat leading ./ `/` `` in file paths as canonical
[...]

[Antiz96]

Alternatively a dedicated flag specifically for image name annotation

We already have --ignore-image-name

$ diffoci diff --help
[...]
--ignore-file-mode-redundant-bits Ignore redundant bits of file mode
--ignore-file-order Ignore file order in tar layers
--ignore-history Ignore history
--ignore-image-name Ignore image name annotation
--ignore-tar-format Ignore tar format
--ignore-timestamps Ignore timestamps
[...]
--treat-canonical-paths-equal ./ Treat leading ./ / `` in file paths as canonical
[...]

Oopsie... I missed that somehow, sorry 🫣

I guess one could still argue that the fact that it's technically not possible to get a successful run of diffoci by default is a bit "unusual" though. The difference between the "image name" attribute and the other attributes listed in the above --ignore-* options is that this one cannot be addressed currently (as far as I know). That means that one basically have to always run with --ignore-image-name (or eventually accept that differences in image name annotations will always be reported while knowing that nothing can de done about it).

That being said, once again, I'm aware that the underlying limitation about not being able to store two images with the same name with docker / podman (or rename one without introducing unavoidable non-deterministic data in the image name annotations) is not something that diffoci can do much about at its level. I would totally understand if this ticket gets closed as an "upstream" issue. I'll just use --ignore-image-name for now 😄