Module delta 

Support for oci-delta artifacts (--from-delta).

An oci-delta is an OCI layout (normally packed as an uncompressed tar) whose single manifest is an artifact rather than an image. It carries the target image manifest and config verbatim, plus binary patches for the layers that changed relative to a source image. Layers that did not change are omitted entirely and are expected to already be present locally.

See https://github.com/containers/oci-delta for the format.

Trust model

Everything in a delta is verified against a single value, the target manifest digest: the embedded manifest and config must hash to the digests the delta records, the config must be the one the manifest references, and each reconstructed layer is checked against the corresponding diff_id in that config.

What is not currently established is that the digest is the one you meant to deploy: it comes from the file rather than from a registry, and nothing signs it. Future work may use signatures to complete this.

Structs

Delta 🔒

A validated oci-delta artifact, ready to be applied.

Enums

Layout 🔒

The OCI layout a delta was read from.

Functions

open_opt 🔒

Open the delta named by a --from-delta argument, if there is one.

parse 🔒

Read the single manifest out of an OCI layout and parse it as a delta.

read_verified 🔒

Read a blob and verify that it hashes to expected.

reject_unified_storage 🔒

Reject --from-delta for an image that also has to be in containers-storage.