Respect digests.Options in sif:, tarball:, and for configs in docker-daemon: and docker-archive:

image/copy/copy.go

@@ -14,6 +14,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"go.podman.io/image/v5/docker/reference"
 	internalblobinfocache "go.podman.io/image/v5/internal/blobinfocache"
+	"go.podman.io/image/v5/internal/digests"
 	"go.podman.io/image/v5/internal/image"
 	"go.podman.io/image/v5/internal/imagedestination"
 	"go.podman.io/image/v5/internal/imagesource"
@@ -155,6 +156,15 @@ type Options struct {
 	// In oci-archive: destinations, this will set the create/mod/access timestamps in each tar entry
 	// (but not a timestamp of the created archive file).
 	DestinationTimestamp *time.Time
+
+	// FIXME:
+	// - this reference to an internal type is unusable from the outside even if we made the field public
+	// - what is the actual semantics? Right now it is probably “choices to use when writing to the destination”, TBD
+	// - anyway do we want to expose _all_ of the digests.Options tunables, or fewer?
+	// - … do we want to expose _more_ granularity than that?
+	//   - (“must have at least sha512 integrity when reading”, what does “at least” mean for random pairs of algorithms?)
+	//   - should some of this be in config files, maybe ever per-registry?
+	digestOptions digests.Options
 }
 
 // OptionCompressionVariant allows to supply information about
@@ -200,6 +210,12 @@ func Image(ctx context.Context, policyContext *signature.PolicyContext, destRef,
 	if options == nil {
 		options = &Options{}
 	}
+	// FIXME: Currently, digestsOptions is not implemented at all, and exists in the codebase
+	// only to allow gradually building the feature set.
+	// After c/image/copy consistently implements it, provide a public digest options API of some kind.
+	optionsCopy := *options
+	optionsCopy.digestOptions = digests.CanonicalDefault()
+	options = &optionsCopy
 
 	if err := validateImageListSelection(options.ImageListSelection); err != nil {
 		return nil, err
@@ -232,11 +248,13 @@ func Image(ctx context.Context, policyContext *signature.PolicyContext, destRef,
 	dest := imagedestination.FromPublic(publicDest)
 	defer safeClose("dest", dest)
 
-	publicRawSource, err := srcRef.NewImageSource(ctx, options.SourceCtx)
+	rawSource, err := imagesource.NewImageSource(ctx, srcRef, private.NewImageSourceOptions{
+		Sys:     options.SourceCtx,
+		Digests: options.digestOptions,
+	})
 	if err != nil {
 		return nil, fmt.Errorf("initializing source %s: %w", transports.ImageName(srcRef), err)
 	}
-	rawSource := imagesource.FromPublic(publicRawSource)
 	defer safeClose("src", rawSource)
 
 	// If reportWriter is not a TTY (e.g., when piping to a file), do not

image/copy/single.go

@@ -19,6 +19,7 @@ import (
 	"github.com/vbauerster/mpb/v8"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/internal/image"
+	"go.podman.io/image/v5/internal/imagesource"
 	"go.podman.io/image/v5/internal/pkg/platform"
 	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/internal/set"
@@ -379,7 +380,10 @@ func (ic *imageCopier) noPendingManifestUpdates() bool {
 // compareImageDestinationManifestEqual compares the source and destination image manifests (reading the manifest from the
 // (possibly remote) destination). If they are equal, it returns a full copySingleImageResult, nil otherwise.
 func (ic *imageCopier) compareImageDestinationManifestEqual(ctx context.Context, targetInstance *digest.Digest) (*copySingleImageResult, error) {
-	destImageSource, err := ic.c.dest.Reference().NewImageSource(ctx, ic.c.options.DestinationCtx)
+	destImageSource, err := imagesource.NewImageSource(ctx, ic.c.dest.Reference(), private.NewImageSourceOptions{
+		Sys:     ic.c.options.DestinationCtx,
+		Digests: ic.c.options.digestOptions,
+	})
 	if err != nil {
 		logrus.Debugf("Unable to create destination image %s source: %v", ic.c.dest.Reference(), err)
 		return nil, nil

image/directory/directory_transport.go

@@ -11,6 +11,8 @@ import (
 	"go.podman.io/image/v5/directory/explicitfilepath"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/internal/image"
+	"go.podman.io/image/v5/internal/imagereference/impl"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/transports"
 	"go.podman.io/image/v5/types"
 )
@@ -143,10 +145,16 @@ func (ref dirReference) NewImage(ctx context.Context, sys *types.SystemContext)
 	return image.FromReference(ctx, sys, ref)
 }
 
+// NewImageSourceWithOptions returns a types.ImageSource for this reference.
+// The caller must call .Close() on the returned ImageSource.
+func (ref dirReference) NewImageSourceWithOptions(ctx context.Context, options private.NewImageSourceOptions) (private.ImageSource, error) {
+	return newImageSource(ref)
+}
+
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
 func (ref dirReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
-	return newImageSource(ref)
+	return impl.NewImageSource(ref, ctx, sys)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.

image/directory/directory_transport_test.go

@@ -9,10 +9,13 @@ import (
 	digest "github.com/opencontainers/go-digest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.podman.io/image/v5/internal/private"
 	_ "go.podman.io/image/v5/internal/testing/explicitfilepath-tmpdir"
 	"go.podman.io/image/v5/types"
 )
 
+var _ private.ImageReference = (*dirReference)(nil)
+
 func TestTransportName(t *testing.T) {
 	assert.Equal(t, "dir", Transport.Name())
 }

image/docker/archive/src.go

@@ -13,21 +13,21 @@ type archiveImageSource struct {
 
 // newImageSource returns a types.ImageSource for the specified image reference.
 // The caller must call .Close() on the returned ImageSource.
-func newImageSource(sys *types.SystemContext, ref archiveReference) (private.ImageSource, error) {
+func newImageSource(ref archiveReference, options private.NewImageSourceOptions) (private.ImageSource, error) {
 	var archive *tarfile.Reader
 	var closeArchive bool
 	if ref.archiveReader != nil {
 		archive = ref.archiveReader
 		closeArchive = false
 	} else {
-		a, err := tarfile.NewReaderFromFile(sys, ref.path)
+		a, err := tarfile.NewReaderFromFile(options.Sys, ref.path)
 		if err != nil {
 			return nil, err
 		}
 		archive = a
 		closeArchive = true
 	}
-	src := tarfile.NewSource(archive, closeArchive, ref.Transport().Name(), ref.ref, ref.sourceIndex)
+	src := tarfile.NewSource(archive, closeArchive, ref.Transport().Name(), ref.ref, ref.sourceIndex, options)
 	return &archiveImageSource{
 		Source: src,
 		ref:    ref,

image/docker/archive/transport.go

@@ -10,6 +10,8 @@ import (
 	"go.podman.io/image/v5/docker/internal/tarfile"
 	"go.podman.io/image/v5/docker/reference"
 	ctrImage "go.podman.io/image/v5/internal/image"
+	"go.podman.io/image/v5/internal/imagereference/impl"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/transports"
 	"go.podman.io/image/v5/types"
 )
@@ -191,10 +193,16 @@ func (ref archiveReference) NewImage(ctx context.Context, sys *types.SystemConte
 	return ctrImage.FromReference(ctx, sys, ref)
 }
 
+// NewImageSourceWithOptions returns a types.ImageSource for this reference.
+// The caller must call .Close() on the returned ImageSource.
+func (ref archiveReference) NewImageSourceWithOptions(ctx context.Context, options private.NewImageSourceOptions) (private.ImageSource, error) {
+	return newImageSource(ref, options)
+}
+
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
 func (ref archiveReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
-	return newImageSource(sys, ref)
+	return impl.NewImageSource(ref, ctx, sys)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.

image/docker/archive/transport_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/types"
 )
 
@@ -19,6 +20,8 @@ const (
 	tarFixture      = "fixtures/almostempty.tar"
 )
 
+var _ private.ImageReference = (*archiveReference)(nil)
+
 func TestTransportName(t *testing.T) {
 	assert.Equal(t, "docker-archive", Transport.Name())
 }

image/docker/daemon/daemon_src.go

@@ -23,8 +23,8 @@ type daemonImageSource struct {
 // (We could, perhaps, expect an exact sequence, assume that the first plaintext file
 // is the config, and that the following len(RootFS) files are the layers, but that feels
 // way too brittle.)
-func newImageSource(ctx context.Context, sys *types.SystemContext, ref daemonReference) (private.ImageSource, error) {
-	c, err := newDockerClient(sys)
+func newImageSource(ctx context.Context, ref daemonReference, options private.NewImageSourceOptions) (private.ImageSource, error) {
+	c, err := newDockerClient(options.Sys)
 	if err != nil {
 		return nil, fmt.Errorf("initializing docker engine client: %w", err)
 	}
@@ -38,11 +38,11 @@ func newImageSource(ctx context.Context, sys *types.SystemContext, ref daemonRef
 	}
 	defer inputStream.Close()
 
-	archive, err := tarfile.NewReaderFromStream(sys, inputStream)
+	archive, err := tarfile.NewReaderFromStream(options.Sys, inputStream)
 	if err != nil {
 		return nil, err
 	}
-	src := tarfile.NewSource(archive, true, ref.Transport().Name(), nil, -1)
+	src := tarfile.NewSource(archive, true, ref.Transport().Name(), nil, -1, options)
 	return &daemonImageSource{
 		ref:    ref,
 		Source: src,

image/docker/daemon/daemon_transport.go

@@ -9,6 +9,8 @@ import (
 	"go.podman.io/image/v5/docker/policyconfiguration"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/internal/image"
+	"go.podman.io/image/v5/internal/imagereference/impl"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/transports"
 	"go.podman.io/image/v5/types"
 )
@@ -201,10 +203,16 @@ func (ref daemonReference) NewImage(ctx context.Context, sys *types.SystemContex
 	return image.FromReference(ctx, sys, ref)
 }
 
+// NewImageSourceWithOptions returns a types.ImageSource for this reference.
+// The caller must call .Close() on the returned ImageSource.
+func (ref daemonReference) NewImageSourceWithOptions(ctx context.Context, options private.NewImageSourceOptions) (private.ImageSource, error) {
+	return newImageSource(ctx, ref, options)
+}
+
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
 func (ref daemonReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
-	return newImageSource(ctx, sys, ref)
+	return impl.NewImageSource(ref, ctx, sys)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.

image/docker/daemon/daemon_transport_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/types"
 )
 
@@ -16,6 +17,8 @@ const (
 	sha256digest    = "sha256:" + sha256digestHex
 )
 
+var _ private.ImageReference = (*daemonReference)(nil)
+
 func TestTransportName(t *testing.T) {
 	assert.Equal(t, "docker-daemon", Transport.Name())
 }

image/docker/docker_image.go

@@ -12,7 +12,9 @@ import (
 	"github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
 	"go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/internal/digests"
 	"go.podman.io/image/v5/internal/image"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/manifest"
 	"go.podman.io/image/v5/types"
 )
@@ -28,7 +30,10 @@ type Image struct {
 // a client to the registry hosting the given image.
 // The caller must call .Close() on the returned Image.
 func newImage(ctx context.Context, sys *types.SystemContext, ref dockerReference) (types.ImageCloser, error) {
-	s, err := newImageSource(ctx, sys, ref)
+	s, err := newImageSource(ctx, ref, private.NewImageSourceOptions{
+		Sys:     sys,
+		Digests: digests.CanonicalDefault(),
+	})
 	if err != nil {
 		return nil, err
 	}

image/docker/docker_image_src.go

@@ -53,16 +53,16 @@ type dockerImageSource struct {
 // newImageSource creates a new ImageSource for the specified image reference.
 // The caller must call .Close() on the returned ImageSource.
 // The caller must ensure !ref.isUnknownDigest.
-func newImageSource(ctx context.Context, sys *types.SystemContext, ref dockerReference) (*dockerImageSource, error) {
+func newImageSource(ctx context.Context, ref dockerReference, options private.NewImageSourceOptions) (*dockerImageSource, error) {
 	if ref.isUnknownDigest {
 		return nil, fmt.Errorf("reading images from docker: reference %q without a tag or digest is not supported", ref.StringWithinTransport())
 	}
 
-	registryConfig, err := loadRegistryConfiguration(sys)
+	registryConfig, err := loadRegistryConfiguration(options.Sys)
 	if err != nil {
 		return nil, err
 	}
-	registry, err := sysregistriesv2.FindRegistry(sys, ref.ref.Name())
+	registry, err := sysregistriesv2.FindRegistry(options.Sys, ref.ref.Name())
 	if err != nil {
 		return nil, fmt.Errorf("loading registries configuration: %w", err)
 	}
@@ -92,12 +92,12 @@ func newImageSource(ctx context.Context, sys *types.SystemContext, ref dockerRef
 	}
 	attempts := []attempt{}
 	for _, pullSource := range pullSources {
-		if sys != nil && sys.DockerLogMirrorChoice {
+		if options.Sys != nil && options.Sys.DockerLogMirrorChoice {
 			logrus.Infof("Trying to access %q", pullSource.Reference)
 		} else {
 			logrus.Debugf("Trying to access %q", pullSource.Reference)
 		}
-		s, err := newImageSourceAttempt(ctx, sys, ref, pullSource, registryConfig)
+		s, err := newImageSourceAttempt(ctx, options.Sys, ref, pullSource, registryConfig)
 		if err == nil {
 			return s, nil
 		}

image/docker/docker_transport.go

@@ -8,6 +8,8 @@ import (
 
 	"go.podman.io/image/v5/docker/policyconfiguration"
 	"go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/internal/imagereference/impl"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/transports"
 	"go.podman.io/image/v5/types"
 )
@@ -177,10 +179,16 @@ func (ref dockerReference) NewImage(ctx context.Context, sys *types.SystemContex
 	return newImage(ctx, sys, ref)
 }
 
+// NewImageSourceWithOptions returns a types.ImageSource for this reference.
+// The caller must call .Close() on the returned ImageSource.
+func (ref dockerReference) NewImageSourceWithOptions(ctx context.Context, options private.NewImageSourceOptions) (private.ImageSource, error) {
+	return newImageSource(ctx, ref, options)
+}
+
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
 func (ref dockerReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
-	return newImageSource(ctx, sys, ref)
+	return impl.NewImageSource(ref, ctx, sys)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.

image/docker/docker_transport_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.podman.io/image/v5/docker/reference"
+	"go.podman.io/image/v5/internal/private"
 	"go.podman.io/image/v5/types"
 )
 
@@ -17,6 +18,8 @@ const (
 	unknownDigestSuffixTest = "@@unknown-digest@@"
 )
 
+var _ private.ImageReference = (*dockerReference)(nil)
+
 func TestTransportName(t *testing.T) {
 	assert.Equal(t, "docker", Transport.Name())
 }