feat(api): added oci-subject header when pushing an image with subject field (#1415)

- as requested by the latest version of the oci distribution spec

Signed-off-by: Laurentiu Niculae <niculae.laurentiu1@gmail.com>

pkg/api/constants/consts.go

@@ -7,6 +7,7 @@ const (
 	Uploads                      = "uploads"
 	DistAPIVersion               = "Docker-Distribution-API-Version"
 	DistContentDigestKey         = "Docker-Content-Digest"
+	SubjectDigestKey             = "OCI-Subject"
 	BlobUploadUUID               = "Blob-Upload-UUID"
 	DefaultMediaType             = "application/json"
 	BinaryMediaType              = "application/octet-stream"

pkg/api/routes.go

@@ -606,7 +606,7 @@ func (rh *RouteHandler) UpdateManifest(response http.ResponseWriter, request *ht
 		return
 	}
 
-	digest, err := imgStore.PutImageManifest(name, reference, mediaType, body)
+	digest, subjectDigest, err := imgStore.PutImageManifest(name, reference, mediaType, body)
 	if err != nil {
 		if errors.Is(err, zerr.ErrRepoNotFound) { //nolint:gocritic // errorslint conflicts with gocritic:IfElseChain
 			WriteJSON(response, http.StatusNotFound,
@@ -656,6 +656,10 @@ func (rh *RouteHandler) UpdateManifest(response http.ResponseWriter, request *ht
 		}
 	}
 
+	if subjectDigest.String() != "" {
+		response.Header().Set(constants.SubjectDigestKey, subjectDigest.String())
+	}
+
 	response.Header().Set("Location", fmt.Sprintf("/v2/%s/manifests/%s", name, digest))
 	response.Header().Set(constants.DistContentDigestKey, digest.String())
 	response.WriteHeader(http.StatusCreated)

pkg/api/routes_test.go

@@ -148,8 +148,10 @@ func TestRoutes(t *testing.T) {
 					"reference": "reference",
 				},
 				&mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", zerr.ErrRepoNotFound
+						godigest.Digest, error,
+					) {
+						return "", "", zerr.ErrRepoNotFound
 					},
 				})
 			So(statusCode, ShouldEqual, http.StatusNotFound)
@@ -161,8 +163,10 @@ func TestRoutes(t *testing.T) {
 				},
 
 				&mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", zerr.ErrManifestNotFound
+						godigest.Digest, error,
+					) {
+						return "", "", zerr.ErrManifestNotFound
 					},
 				})
 			So(statusCode, ShouldEqual, http.StatusNotFound)
@@ -173,8 +177,10 @@ func TestRoutes(t *testing.T) {
 					"reference": "reference",
 				},
 				&mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", zerr.ErrBadManifest
+						godigest.Digest, error,
+					) {
+						return "", "", zerr.ErrBadManifest
 					},
 				})
 			So(statusCode, ShouldEqual, http.StatusBadRequest)
@@ -185,8 +191,10 @@ func TestRoutes(t *testing.T) {
 					"reference": "reference",
 				},
 				&mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", zerr.ErrBlobNotFound
+						godigest.Digest, error,
+					) {
+						return "", "", zerr.ErrBlobNotFound
 					},
 				})
 			So(statusCode, ShouldEqual, http.StatusBadRequest)
@@ -198,8 +206,10 @@ func TestRoutes(t *testing.T) {
 					"reference": "reference",
 				},
 				&mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", zerr.ErrRepoBadVersion
+						godigest.Digest, error,
+					) {
+						return "", "", zerr.ErrRepoBadVersion
 					},
 				})
 			So(statusCode, ShouldEqual, http.StatusInternalServerError)

pkg/extensions/search/cve/trivy/scanner_internal_test.go

@@ -52,7 +52,7 @@ func generateTestImage(storeController storage.StoreController, image string) {
 
 	manifestBlob, err := json.Marshal(manifest)
 	So(err, ShouldBeNil)
-	_, err = store.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBlob)
+	_, _, err = store.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBlob)
 	So(err, ShouldBeNil)
 }
 

pkg/extensions/search/search_test.go

@@ -4515,8 +4515,10 @@ func TestRepoDBWhenSigningImages(t *testing.T) {
 			Convey("imageIsSignature fails", func() {
 				// make image store ignore the wrong format of the input
 				ctlr.StoreController.DefaultStore = mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", nil
+						godigest.Digest, error,
+					) {
+						return "", "", nil
 					},
 					DeleteImageManifestFn: func(repo, reference string, dc bool) error {
 						return ErrTestError
@@ -5783,8 +5785,10 @@ func TestRepoDBWhenDeletingImages(t *testing.T) {
 
 			Convey("imageIsSignature fails", func() {
 				ctlr.StoreController.DefaultStore = mocks.MockedImageStore{
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", nil
+						godigest.Digest, error,
+					) {
+						return "", "", nil
 					},
 					DeleteImageManifestFn: func(repo, reference string, dc bool) error {
 						return nil
@@ -5807,8 +5811,10 @@ func TestRepoDBWhenDeletingImages(t *testing.T) {
 
 						return configBlob, nil
 					},
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", nil
+						godigest.Digest, error,
+					) {
+						return "", "", nil
 					},
 					DeleteImageManifestFn: func(repo, reference string, dc bool) error {
 						return nil
@@ -5835,8 +5841,10 @@ func TestRepoDBWhenDeletingImages(t *testing.T) {
 
 						return configBlob, nil
 					},
-					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest, error) {
+					PutImageManifestFn: func(repo, reference, mediaType string, body []byte) (godigest.Digest,
-						return "", ErrTestError
+						godigest.Digest, error,
+					) {
+						return "", "", ErrTestError
 					},
 					DeleteImageManifestFn: func(repo, reference string, dc bool) error {
 						return nil

pkg/extensions/sync/signatures.go

@@ -180,7 +180,7 @@ func (sig *signaturesCopier) syncCosignSignature(localRepo, remoteRepo, digestSt
 	}
 
 	// push manifest
-	_, err = imageStore.PutImageManifest(localRepo, cosignTag,
+	_, _, err = imageStore.PutImageManifest(localRepo, cosignTag,
 		ispec.MediaTypeImageManifest, cosignManifestBuf)
 	if err != nil {
 		sig.log.Error().Str("errorType", common.TypeOf(err)).
@@ -258,7 +258,7 @@ func (sig *signaturesCopier) syncORASRefs(localRepo, remoteRepo, digestStr strin
 			}
 		}
 
-		_, err = imageStore.PutImageManifest(localRepo, ref.Digest.String(),
+		_, _, err = imageStore.PutImageManifest(localRepo, ref.Digest.String(),
 			oras.MediaTypeArtifactManifest, body)
 		if err != nil {
 			sig.log.Error().Str("errorType", common.TypeOf(err)).
@@ -359,7 +359,7 @@ func (sig *signaturesCopier) syncOCIRefs(localRepo, remoteRepo, digestStr string
 			continue
 		}
 
-		digest, err := imageStore.PutImageManifest(localRepo, ref.Digest.String(),
+		digest, _, err := imageStore.PutImageManifest(localRepo, ref.Digest.String(),
 			ref.MediaType, OCIRefBody)
 		if err != nil {
 			sig.log.Error().Str("errorType", common.TypeOf(err)).

pkg/extensions/sync/sync_internal_test.go

@@ -698,7 +698,7 @@ func TestSyncInternal(t *testing.T) {
 
 				manifestDigest := godigest.FromBytes(manifestContent)
 
-				_, err = testImageStore.PutImageManifest(repo, manifestDigest.String(),
+				_, _, err = testImageStore.PutImageManifest(repo, manifestDigest.String(),
 					ispec.MediaTypeImageManifest, manifestContent)
 				So(err, ShouldBeNil)
 
@@ -715,7 +715,7 @@ func TestSyncInternal(t *testing.T) {
 			So(digest, ShouldNotBeNil)
 
 			// upload index image
-			_, err = testImageStore.PutImageManifest(repo, "latest", ispec.MediaTypeImageIndex, content)
+			_, _, err = testImageStore.PutImageManifest(repo, "latest", ispec.MediaTypeImageIndex, content)
 			So(err, ShouldBeNil)
 
 			err = pushSyncedLocalImage(repo, "latest", testRootDir, nil, imageStore, log)

pkg/extensions/sync/utils.go

@@ -337,7 +337,7 @@ func pushSyncedLocalImage(localRepo, reference, localCachePath string,
 			}
 		}
 
-		_, err = imageStore.PutImageManifest(localRepo, reference, mediaType, manifestBlob)
+		_, _, err = imageStore.PutImageManifest(localRepo, reference, mediaType, manifestBlob)
 		if err != nil {
 			log.Error().Str("errorType", common.TypeOf(err)).
 				Err(err).Msg("couldn't upload manifest")
@@ -393,7 +393,7 @@ func copyManifest(localRepo string, manifestContent []byte, reference string, re
 		return err
 	}
 
-	digest, err := imageStore.PutImageManifest(localRepo, reference,
+	digest, _, err := imageStore.PutImageManifest(localRepo, reference,
 		ispec.MediaTypeImageManifest, manifestContent)
 	if err != nil {
 		log.Error().Str("errorType", common.TypeOf(err)).

pkg/meta/update.go

@@ -115,7 +115,7 @@ func OnDeleteManifest(repo, reference, mediaType string, digest godigest.Digest,
 			log.Info().Msg("repodb: restoring image store")
 
 			// restore image store
-			_, err := imgStore.PutImageManifest(repo, reference, mediaType, manifestBlob)
+			_, _, err := imgStore.PutImageManifest(repo, reference, mediaType, manifestBlob)
 			if err != nil {
 				log.Error().Err(err).Msg("repodb: error while restoring image store, database is not consistent")
 			}

pkg/storage/common_test.go

@@ -71,7 +71,7 @@ func TestValidateManifest(t *testing.T) {
 			body, err := json.Marshal(manifest)
 			So(err, ShouldBeNil)
 
-			_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
+			_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
 			So(err, ShouldNotBeNil)
 		})
 
@@ -101,7 +101,7 @@ func TestValidateManifest(t *testing.T) {
 			body, err := json.Marshal(manifest)
 			So(err, ShouldBeNil)
 
-			_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
+			_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
 			So(err, ShouldNotBeNil)
 		})
 
@@ -130,7 +130,7 @@ func TestValidateManifest(t *testing.T) {
 			body, err := json.Marshal(manifest)
 			So(err, ShouldBeNil)
 
-			_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
+			_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, body)
 			So(err, ShouldBeNil)
 		})
 	})

pkg/storage/local/local.go

@@ -455,11 +455,11 @@ func (is *ImageStoreLocal) GetImageManifest(repo, reference string) ([]byte, god
 // PutImageManifest adds an image manifest to the repository.
 func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, //nolint: gocyclo
 	body []byte,
-) (godigest.Digest, error) {
+) (godigest.Digest, godigest.Digest, error) {
 	if err := is.InitRepo(repo); err != nil {
 		is.log.Debug().Err(err).Msg("init repo")
 
-		return "", err
+		return "", "", err
 	}
 
 	var lockLatency time.Time
@@ -469,7 +469,7 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 
 	digest, err := storage.ValidateManifest(is, repo, reference, mediaType, body, is.log)
 	if err != nil {
-		return digest, err
+		return digest, "", err
 	}
 
 	refIsDigest := true
@@ -477,7 +477,7 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 	mDigest, err := storage.GetAndValidateRequestDigest(body, reference, is.log)
 	if err != nil {
 		if errors.Is(err, zerr.ErrBadManifest) {
-			return mDigest, err
+			return mDigest, "", err
 		}
 
 		refIsDigest = false
@@ -485,7 +485,7 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 
 	index, err := storage.GetIndex(is, repo, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	// create a new descriptor
@@ -497,13 +497,32 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 		desc.Annotations = map[string]string{ispec.AnnotationRefName: reference}
 	}
 
+	var subjectDigest godigest.Digest
+
+	artifactType := ""
+
+	if mediaType == ispec.MediaTypeImageManifest {
+		var manifest ispec.Manifest
+
+		err := json.Unmarshal(body, &manifest)
+		if err != nil {
+			return "", "", err
+		}
+
+		if manifest.Subject != nil {
+			subjectDigest = manifest.Subject.Digest
+		}
+
+		artifactType = zcommon.GetManifestArtifactType(manifest)
+	}
+
 	updateIndex, oldDgst, err := storage.CheckIfIndexNeedsUpdate(&index, &desc, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	if !updateIndex {
-		return desc.Digest, nil
+		return desc.Digest, subjectDigest, nil
 	}
 
 	// write manifest to "blobs"
@@ -515,12 +534,12 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 	if err := is.writeFile(file, body); err != nil {
 		is.log.Error().Err(err).Str("file", file).Msg("unable to write")
 
-		return "", err
+		return "", "", err
 	}
 
 	err = storage.UpdateIndexWithPrunedImageManifests(is, &index, repo, desc, oldDgst, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	// now update "index.json"
@@ -532,45 +551,37 @@ func (is *ImageStoreLocal) PutImageManifest(repo, reference, mediaType string, /
 	if err := test.Error(err); err != nil {
 		is.log.Error().Err(err).Str("file", file).Msg("unable to marshal JSON")
 
-		return "", err
+		return "", "", err
 	}
 
-	if mediaType == ispec.MediaTypeImageManifest {
+	// update the descriptors artifact type in order to check for signatures when applying the linter
-		var manifest ispec.Manifest
+	desc.ArtifactType = artifactType
-
-		err := json.Unmarshal(body, &manifest)
-		if err != nil {
-			return "", err
-		}
-
-		desc.ArtifactType = zcommon.GetManifestArtifactType(manifest)
-	}
 
 	// apply linter only on images, not signatures or indexes
 	pass, err := storage.ApplyLinter(is, is.linter, repo, desc)
 	if !pass {
 		is.log.Error().Err(err).Str("repository", repo).Str("reference", reference).Msg("linter didn't pass")
 
-		return "", err
+		return "", "", err
 	}
 
 	err = is.writeFile(file, buf)
 	if err := test.Error(err); err != nil {
 		is.log.Error().Err(err).Str("file", file).Msg("unable to write")
 
-		return "", err
+		return "", "", err
 	}
 
 	if is.gc {
 		if err := is.garbageCollect(dir, repo); err != nil {
-			return "", err
+			return "", "", err
 		}
 	}
 
 	monitoring.SetStorageUsage(is.metrics, is.rootDir, repo)
 	monitoring.IncUploadCounter(is.metrics, repo)
 
-	return desc.Digest, nil
+	return desc.Digest, subjectDigest, nil
 }
 
 // DeleteImageManifest deletes the image manifest from the repository.

pkg/storage/local/local_test.go

@@ -123,7 +123,7 @@ func TestStorageFSAPIs(t *testing.T) {
 				panic(err)
 			}
 
-			_, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldNotBeNil)
 
 			err = os.Chmod(path.Join(imgStore.RootDir(), repoName, "index.json"), 0o755)
@@ -131,7 +131,7 @@ func TestStorageFSAPIs(t *testing.T) {
 				panic(err)
 			}
 
-			_, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			manifestPath := path.Join(imgStore.RootDir(), repoName, "blobs", digest.Algorithm().String(), digest.Encoded())
@@ -157,7 +157,7 @@ func TestStorageFSAPIs(t *testing.T) {
 				panic(err)
 			}
 
-			_, err = imgStore.PutImageManifest(repoName, "2.0", ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repoName, "2.0", ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldNotBeNil)
 			err = os.Chmod(path.Join(imgStore.RootDir(), repoName), 0o755)
 			if err != nil {
@@ -231,7 +231,7 @@ func TestGetOrasReferrers(t *testing.T) {
 		manBufLen := len(manBuf)
 		So(err, ShouldBeNil)
 		manDigest := godigest.FromBytes(manBuf)
-		_, err = imgStore.PutImageManifest("zot-test", manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
+		_, _, err = imgStore.PutImageManifest("zot-test", manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
 		So(err, ShouldBeNil)
 
 		So(err, ShouldBeNil)
@@ -399,7 +399,7 @@ func FuzzTestPutGetImageManifest(f *testing.F) {
 			t.Errorf("Error %v occurred while marshaling manifest", err)
 		}
 		mdigest := godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest(repoName, mdigest.String(), ispec.MediaTypeImageManifest, manifestBuf)
+		_, _, err = imgStore.PutImageManifest(repoName, mdigest.String(), ispec.MediaTypeImageManifest, manifestBuf)
 		if err != nil && errors.Is(err, zerr.ErrBadManifest) {
 			t.Errorf("the error that occurred is %v \n", err)
 		}
@@ -452,7 +452,7 @@ func FuzzTestPutDeleteImageManifest(f *testing.F) {
 			t.Errorf("Error %v occurred while marshaling manifest", err)
 		}
 		mdigest := godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest(repoName, mdigest.String(), ispec.MediaTypeImageManifest, manifestBuf)
+		_, _, err = imgStore.PutImageManifest(repoName, mdigest.String(), ispec.MediaTypeImageManifest, manifestBuf)
 		if err != nil && errors.Is(err, zerr.ErrBadManifest) {
 			t.Errorf("the error that occurred is %v \n", err)
 		}
@@ -1046,7 +1046,7 @@ func FuzzGetOrasReferrers(f *testing.F) {
 			t.Error(err)
 		}
 		manDigest := godigest.FromBytes(manBuf)
-		_, err = imgStore.PutImageManifest("zot-test", manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
+		_, _, err = imgStore.PutImageManifest("zot-test", manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
 		if err != nil {
 			t.Error(err)
 		}
@@ -1164,7 +1164,7 @@ func TestDedupeLinks(t *testing.T) {
 			manifestBuf, err := json.Marshal(manifest)
 			So(err, ShouldBeNil)
 			digest = godigest.FromBytes(manifestBuf)
-			_, err = imgStore.PutImageManifest("dedupe1", digest.String(),
+			_, _, err = imgStore.PutImageManifest("dedupe1", digest.String(),
 				ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
@@ -1224,7 +1224,7 @@ func TestDedupeLinks(t *testing.T) {
 			manifestBuf, err = json.Marshal(manifest)
 			So(err, ShouldBeNil)
 			digest = godigest.FromBytes(manifestBuf)
-			_, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			_, _, _, err = imgStore.GetImageManifest("dedupe2", digest.String())
@@ -1976,7 +1976,7 @@ func TestGarbageCollect(t *testing.T) {
 			So(err, ShouldBeNil)
 			digest := godigest.FromBytes(manifestBuf)
 
-			_, err = imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			hasBlob, _, err = imgStore.CheckBlob(repoName, bdigest)
@@ -2069,7 +2069,7 @@ func TestGarbageCollect(t *testing.T) {
 			So(err, ShouldBeNil)
 			digest := godigest.FromBytes(manifestBuf)
 
-			_, err = imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			hasBlob, _, err = imgStore.CheckBlob(repoName, odigest)
@@ -2153,7 +2153,7 @@ func TestGarbageCollect(t *testing.T) {
 			manifestBuf, err := json.Marshal(manifest)
 			So(err, ShouldBeNil)
 
-			_, err = imgStore.PutImageManifest(repo1Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repo1Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			hasBlob, _, err = imgStore.CheckBlob(repo1Name, tdigest)
@@ -2216,7 +2216,7 @@ func TestGarbageCollect(t *testing.T) {
 			manifestBuf, err = json.Marshal(manifest)
 			So(err, ShouldBeNil)
 
-			_, err = imgStore.PutImageManifest(repo2Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repo2Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			hasBlob, _, err = imgStore.CheckBlob(repo2Name, bdigest)
@@ -2273,7 +2273,7 @@ func TestGarbageCollect(t *testing.T) {
 			So(err, ShouldBeNil)
 			digest := godigest.FromBytes(manifestBuf)
 
-			_, err = imgStore.PutImageManifest(repo2Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
+			_, _, err = imgStore.PutImageManifest(repo2Name, tag, ispec.MediaTypeImageManifest, manifestBuf)
 			So(err, ShouldBeNil)
 
 			// original blob should exist
@@ -2436,7 +2436,7 @@ func TestGarbageCollectErrors(t *testing.T) {
 				So(err, ShouldBeNil)
 				digest = godigest.FromBytes(content)
 				So(digest, ShouldNotBeNil)
-				_, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
+				_, _, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
 				So(err, ShouldBeNil)
 
 				index.Manifests = append(index.Manifests, ispec.Descriptor{
@@ -2452,7 +2452,7 @@ func TestGarbageCollectErrors(t *testing.T) {
 			indexDigest := godigest.FromBytes(indexContent)
 			So(indexDigest, ShouldNotBeNil)
 
-			_, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageIndex, indexContent)
+			_, _, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageIndex, indexContent)
 			So(err, ShouldBeNil)
 
 			err = os.Chmod(imgStore.BlobPath(repoName, indexDigest), 0o000)
@@ -2502,7 +2502,7 @@ func TestGarbageCollectErrors(t *testing.T) {
 			digest = godigest.FromBytes(content)
 			So(digest, ShouldNotBeNil)
 
-			_, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
+			_, _, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
 			So(err, ShouldBeNil)
 
 			// trigger GetBlobContent error
@@ -2560,10 +2560,10 @@ func TestGarbageCollectErrors(t *testing.T) {
 			digest = godigest.FromBytes(content)
 			So(digest, ShouldNotBeNil)
 
-			_, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
+			_, _, err = imgStore.PutImageManifest(repoName, digest.String(), ispec.MediaTypeImageManifest, content)
 			So(err, ShouldBeNil)
 			// upload again same manifest so that we trigger manifest conflict
-			_, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, content)
+			_, _, err = imgStore.PutImageManifest(repoName, "1.0", ispec.MediaTypeImageManifest, content)
 			So(err, ShouldBeNil)
 
 			time.Sleep(500 * time.Millisecond)

pkg/storage/s3/s3.go

@@ -360,11 +360,11 @@ func (is *ObjectStorage) GetImageManifest(repo, reference string) ([]byte, godig
 // PutImageManifest adds an image manifest to the repository.
 func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //nolint: gocyclo
 	body []byte,
-) (godigest.Digest, error) {
+) (godigest.Digest, godigest.Digest, error) {
 	if err := is.InitRepo(repo); err != nil {
 		is.log.Debug().Err(err).Msg("init repo")
 
-		return "", err
+		return "", "", err
 	}
 
 	var lockLatency time.Time
@@ -374,7 +374,7 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 
 	dig, err := storage.ValidateManifest(is, repo, reference, mediaType, body, is.log)
 	if err != nil {
-		return dig, err
+		return dig, "", err
 	}
 
 	refIsDigest := true
@@ -382,7 +382,7 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 	mDigest, err := storage.GetAndValidateRequestDigest(body, reference, is.log)
 	if err != nil {
 		if errors.Is(err, zerr.ErrBadManifest) {
-			return mDigest, err
+			return mDigest, "", err
 		}
 
 		refIsDigest = false
@@ -390,7 +390,7 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 
 	index, err := storage.GetIndex(is, repo, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	// create a new descriptor
@@ -402,13 +402,32 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 		desc.Annotations = map[string]string{ispec.AnnotationRefName: reference}
 	}
 
+	var subjectDigest godigest.Digest
+
+	artifactType := ""
+
+	if mediaType == ispec.MediaTypeImageManifest {
+		var manifest ispec.Manifest
+
+		err := json.Unmarshal(body, &manifest)
+		if err != nil {
+			return "", "", err
+		}
+
+		if manifest.Subject != nil {
+			subjectDigest = manifest.Subject.Digest
+		}
+
+		artifactType = zcommon.GetManifestArtifactType(manifest)
+	}
+
 	updateIndex, oldDgst, err := storage.CheckIfIndexNeedsUpdate(&index, &desc, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	if !updateIndex {
-		return desc.Digest, nil
+		return desc.Digest, subjectDigest, nil
 	}
 
 	// write manifest to "blobs"
@@ -418,12 +437,12 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 	if err = is.store.PutContent(context.Background(), manifestPath, body); err != nil {
 		is.log.Error().Err(err).Str("file", manifestPath).Msg("unable to write")
 
-		return "", err
+		return "", "", err
 	}
 
 	err = storage.UpdateIndexWithPrunedImageManifests(is, &index, repo, desc, oldDgst, is.log)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 
 	// now update "index.json"
@@ -435,38 +454,30 @@ func (is *ObjectStorage) PutImageManifest(repo, reference, mediaType string, //n
 	if err != nil {
 		is.log.Error().Err(err).Str("file", indexPath).Msg("unable to marshal JSON")
 
-		return "", err
+		return "", "", err
 	}
 
-	if mediaType == ispec.MediaTypeImageManifest {
+	// update the descriptors artifact type in order to check for signatures when applying the linter
-		var manifest ispec.Manifest
+	desc.ArtifactType = artifactType
-
-		err := json.Unmarshal(body, &manifest)
-		if err != nil {
-			return "", err
-		}
-
-		desc.ArtifactType = zcommon.GetManifestArtifactType(manifest)
-	}
 
 	// apply linter only on images, not signatures
 	pass, err := storage.ApplyLinter(is, is.linter, repo, desc)
 	if !pass {
 		is.log.Error().Err(err).Str("repository", repo).Str("reference", reference).Msg("linter didn't pass")
 
-		return "", err
+		return "", "", err
 	}
 
 	if err = is.store.PutContent(context.Background(), indexPath, buf); err != nil {
 		is.log.Error().Err(err).Str("file", manifestPath).Msg("unable to write")
 
-		return "", err
+		return "", "", err
 	}
 
 	monitoring.SetStorageUsage(is.metrics, is.rootDir, repo)
 	monitoring.IncUploadCounter(is.metrics, repo)
 
-	return desc.Digest, nil
+	return desc.Digest, subjectDigest, nil
 }
 
 // DeleteImageManifest deletes the image manifest from the repository.

pkg/storage/s3/s3_test.go

@@ -520,7 +520,7 @@ func TestGetOrasAndOCIReferrers(t *testing.T) {
 		mbuflen := mbuf.Len()
 		mdigest := godigest.FromBytes(mblob)
 
-		d, err := imgStore.PutImageManifest(repo, "1.0", ispec.MediaTypeImageManifest, mbuf.Bytes())
+		d, _, err := imgStore.PutImageManifest(repo, "1.0", ispec.MediaTypeImageManifest, mbuf.Bytes())
 		So(d, ShouldEqual, mdigest)
 		So(err, ShouldBeNil)
 
@@ -572,7 +572,7 @@ func TestGetOrasAndOCIReferrers(t *testing.T) {
 			manBufLen := len(manBuf)
 			manDigest := godigest.FromBytes(manBuf)
 
-			_, err = imgStore.PutImageManifest(repo, manDigest.Encoded(), ispec.MediaTypeImageManifest, manBuf)
+			_, _, err = imgStore.PutImageManifest(repo, manDigest.Encoded(), ispec.MediaTypeImageManifest, manBuf)
 			So(err, ShouldBeNil)
 
 			index, err := imgStore.GetReferrers(repo, mdigest, []string{artifactType})
@@ -606,7 +606,7 @@ func TestGetOrasAndOCIReferrers(t *testing.T) {
 			manBufLen := len(manBuf)
 			manDigest := godigest.FromBytes(manBuf)
 
-			_, err = imgStore.PutImageManifest(repo, manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
+			_, _, err = imgStore.PutImageManifest(repo, manDigest.Encoded(), artifactspec.MediaTypeArtifactManifest, manBuf)
 			So(err, ShouldBeNil)
 
 			descriptors, err := imgStore.GetOrasReferrers(repo, mdigest, "signature-example")
@@ -876,7 +876,7 @@ func TestNegativeCasesObjectsStorage(t *testing.T) {
 			err = imgStore.DeleteImageManifest(testImage, "1.0", false)
 			So(err, ShouldNotBeNil)
 
-			_, err = imgStore.PutImageManifest(testImage, "1.0", "application/json", []byte{})
+			_, _, err = imgStore.PutImageManifest(testImage, "1.0", "application/json", []byte{})
 			So(err, ShouldNotBeNil)
 
 			_, err = imgStore.PutBlobChunkStreamed(testImage, upload, bytes.NewBuffer([]byte(testImage)))
@@ -1305,7 +1305,7 @@ func TestS3Dedupe(t *testing.T) {
 		manifestBuf, err := json.Marshal(manifest)
 		So(err, ShouldBeNil)
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe1", digest.String(),
+		_, _, err = imgStore.PutImageManifest("dedupe1", digest.String(),
 			ispec.MediaTypeImageManifest, manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -1379,7 +1379,7 @@ func TestS3Dedupe(t *testing.T) {
 		manifestBuf, err = json.Marshal(manifest)
 		So(err, ShouldBeNil)
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest,
+		_, _, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest,
 			manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -1514,7 +1514,7 @@ func TestS3Dedupe(t *testing.T) {
 			manifestBuf, err = json.Marshal(manifest)
 			So(err, ShouldBeNil)
 			digest = godigest.FromBytes(manifestBuf)
-			_, err = imgStore.PutImageManifest("dedupe3", "1.0", ispec.MediaTypeImageManifest,
+			_, _, err = imgStore.PutImageManifest("dedupe3", "1.0", ispec.MediaTypeImageManifest,
 				manifestBuf)
 			So(err, ShouldBeNil)
 
@@ -1662,7 +1662,7 @@ func TestS3Dedupe(t *testing.T) {
 		manifestBuf, err := json.Marshal(manifest)
 		So(err, ShouldBeNil)
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe1", digest.String(),
+		_, _, err = imgStore.PutImageManifest("dedupe1", digest.String(),
 			ispec.MediaTypeImageManifest, manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -1728,7 +1728,7 @@ func TestS3Dedupe(t *testing.T) {
 		manifestBuf, err = json.Marshal(manifest)
 		So(err, ShouldBeNil)
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest,
+		_, _, err = imgStore.PutImageManifest("dedupe2", "1.0", ispec.MediaTypeImageManifest,
 			manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -1891,7 +1891,7 @@ func TestRebuildDedupeIndex(t *testing.T) {
 		manifestBuf, err := json.Marshal(manifest)
 		So(err, ShouldBeNil)
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe1", digest.String(),
+		_, _, err = imgStore.PutImageManifest("dedupe1", digest.String(),
 			ispec.MediaTypeImageManifest, manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -1924,7 +1924,7 @@ func TestRebuildDedupeIndex(t *testing.T) {
 		So(clen, ShouldEqual, len(cblob))
 
 		digest = godigest.FromBytes(manifestBuf)
-		_, err = imgStore.PutImageManifest("dedupe2", digest.String(),
+		_, _, err = imgStore.PutImageManifest("dedupe2", digest.String(),
 			ispec.MediaTypeImageManifest, manifestBuf)
 		So(err, ShouldBeNil)
 
@@ -2970,7 +2970,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 		digest = godigest.FromBytes(content)
 		So(digest, ShouldNotBeNil)
 		m1content := content
-		_, err = imgStore.PutImageManifest("index", "test:1.0", ispec.MediaTypeImageManifest, content)
+		_, _, err = imgStore.PutImageManifest("index", "test:1.0", ispec.MediaTypeImageManifest, content)
 		So(err, ShouldBeNil)
 
 		// create another manifest but upload using its sha256 reference
@@ -3013,7 +3013,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 		So(digest, ShouldNotBeNil)
 		m2dgst := digest
 		m2size := len(content)
-		_, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
+		_, _, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
 		So(err, ShouldBeNil)
 
 		Convey("Image index", func() {
@@ -3053,7 +3053,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 			So(err, ShouldBeNil)
 			digest = godigest.FromBytes(content)
 			So(digest, ShouldNotBeNil)
-			_, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
+			_, _, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
 			So(err, ShouldBeNil)
 
 			var index ispec.Index
@@ -3076,7 +3076,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 			digest = godigest.FromBytes(content)
 			So(digest, ShouldNotBeNil)
 			index1dgst := digest
-			_, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageIndex, content)
+			_, _, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageIndex, content)
 			So(err, ShouldBeNil)
 			_, _, _, err = imgStore.GetImageManifest("index", "test:index1")
 			So(err, ShouldBeNil)
@@ -3119,7 +3119,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 			So(digest, ShouldNotBeNil)
 			m4dgst := digest
 			m4size := len(content)
-			_, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
+			_, _, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
 			So(err, ShouldBeNil)
 
 			index.SchemaVersion = 2
@@ -3140,7 +3140,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 			So(err, ShouldBeNil)
 			digest = godigest.FromBytes(content)
 			So(digest, ShouldNotBeNil)
-			_, err = imgStore.PutImageManifest("index", "test:index2", ispec.MediaTypeImageIndex, content)
+			_, _, err = imgStore.PutImageManifest("index", "test:index2", ispec.MediaTypeImageIndex, content)
 			So(err, ShouldBeNil)
 			_, _, _, err = imgStore.GetImageManifest("index", "test:index2")
 			So(err, ShouldBeNil)
@@ -3169,7 +3169,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 				So(err, ShouldBeNil)
 				digest = godigest.FromBytes(content)
 				So(digest, ShouldNotBeNil)
-				_, err = imgStore.PutImageManifest("index", "test:index3", ispec.MediaTypeImageIndex, content)
+				_, _, err = imgStore.PutImageManifest("index", "test:index3", ispec.MediaTypeImageIndex, content)
 				So(err, ShouldBeNil)
 				_, _, _, err = imgStore.GetImageManifest("index", "test:index3")
 				So(err, ShouldBeNil)
@@ -3190,7 +3190,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 				So(err, ShouldBeNil)
 				digest = godigest.FromBytes(content)
 				So(digest, ShouldNotBeNil)
-				_, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageIndex, content)
+				_, _, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageIndex, content)
 				So(err, ShouldBeNil)
 				_, _, _, err = imgStore.GetImageManifest("index", digest.String())
 				So(err, ShouldBeNil)
@@ -3267,7 +3267,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 				So(err, ShouldBeNil)
 				digest = godigest.FromBytes(content)
 				So(digest, ShouldNotBeNil)
-				_, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
+				_, _, err = imgStore.PutImageManifest("index", digest.String(), ispec.MediaTypeImageManifest, content)
 				So(err, ShouldBeNil)
 				_, _, _, err = imgStore.GetImageManifest("index", digest.String())
 				So(err, ShouldBeNil)
@@ -3285,7 +3285,7 @@ func TestS3ManifestImageIndex(t *testing.T) {
 				So(err, ShouldBeNil)
 				digest = godigest.FromBytes(content)
 				So(digest, ShouldNotBeNil)
-				_, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageIndex, content)
+				_, _, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageIndex, content)
 				So(err, ShouldBeNil)
 				_, _, _, err = imgStore.GetImageManifest("index", "test:index1")
 				So(err, ShouldBeNil)
@@ -3338,11 +3338,11 @@ func TestS3ManifestImageIndex(t *testing.T) {
 					So(err, ShouldBeNil)
 					digest = godigest.FromBytes(content)
 					So(digest, ShouldNotBeNil)
-					_, err = imgStore.PutImageManifest("index", "test:1.0", ispec.MediaTypeImageIndex, content)
+					_, _, err = imgStore.PutImageManifest("index", "test:1.0", ispec.MediaTypeImageIndex, content)
 					So(err, ShouldNotBeNil)
 
 					// previously an image index, try writing a manifest
-					_, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageManifest, m1content)
+					_, _, err = imgStore.PutImageManifest("index", "test:index1", ispec.MediaTypeImageManifest, m1content)
 					So(err, ShouldNotBeNil)
 				})
 			})

pkg/storage/scrub_test.go

@@ -70,7 +70,7 @@ func TestCheckAllBlobsIntegrity(t *testing.T) {
 
 		manifestBlob, err := json.Marshal(manifest)
 		So(err, ShouldBeNil)
-		manifestDigest, err := imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBlob)
+		manifestDigest, _, err := imgStore.PutImageManifest(repoName, tag, ispec.MediaTypeImageManifest, manifestBlob)
 		So(err, ShouldBeNil)
 
 		Convey("Blobs integrity not affected", func() {
@@ -255,7 +255,7 @@ func TestCheckAllBlobsIntegrity(t *testing.T) {
 
 			indexBlob, err := json.Marshal(index)
 			So(err, ShouldBeNil)
-			indexDigest, err := imgStore.PutImageManifest(repoName, "", ispec.MediaTypeImageIndex, indexBlob)
+			indexDigest, _, err := imgStore.PutImageManifest(repoName, "", ispec.MediaTypeImageIndex, indexBlob)
 			So(err, ShouldBeNil)
 
 			buff := bytes.NewBufferString("")

pkg/storage/storage.go

@@ -29,7 +29,7 @@ type ImageStore interface { //nolint:interfacebloat
 	GetNextRepository(repo string) (string, error)
 	GetImageTags(repo string) ([]string, error)
 	GetImageManifest(repo, reference string) ([]byte, godigest.Digest, string, error)
-	PutImageManifest(repo, reference, mediaType string, body []byte) (godigest.Digest, error)
+	PutImageManifest(repo, reference, mediaType string, body []byte) (godigest.Digest, godigest.Digest, error)
 	DeleteImageManifest(repo, reference string, detectCollision bool) error
 	BlobUploadPath(repo, uuid string) string
 	NewBlobUpload(repo string) (string, error)

pkg/storage/storage_test.go

@@ -280,19 +280,19 @@ func TestStorageAPIs(t *testing.T) {
 						So(err, ShouldBeNil)
 
 						Convey("Bad image manifest", func() {
-							_, err = imgStore.PutImageManifest("test", digest.String(), "application/json",
+							_, _, err = imgStore.PutImageManifest("test", digest.String(), "application/json",
 								manifestBuf)
 							So(err, ShouldNotBeNil)
 
-							_, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
+							_, _, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
 								[]byte{})
 							So(err, ShouldNotBeNil)
 
-							_, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
+							_, _, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
 								[]byte(`{"test":true}`))
 							So(err, ShouldNotBeNil)
 
-							_, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
+							_, _, err = imgStore.PutImageManifest("test", digest.String(), ispec.MediaTypeImageManifest,
 								manifestBuf)
 							So(err, ShouldNotBeNil)
 
@@ -340,20 +340,20 @@ func TestStorageAPIs(t *testing.T) {
 							badMb, err := json.Marshal(manifest)
 							So(err, ShouldBeNil)
 
-							_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, badMb)
+							_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, badMb)
 							So(err, ShouldNotBeNil)
 
-							_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+							_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
 							// same manifest for coverage
-							_, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+							_, _, err = imgStore.PutImageManifest("test", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
-							_, err = imgStore.PutImageManifest("test", "2.0", ispec.MediaTypeImageManifest, manifestBuf)
+							_, _, err = imgStore.PutImageManifest("test", "2.0", ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
-							_, err = imgStore.PutImageManifest("test", "3.0", ispec.MediaTypeImageManifest, manifestBuf)
+							_, _, err = imgStore.PutImageManifest("test", "3.0", ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
 							_, err = imgStore.GetImageTags("inexistent")
@@ -487,11 +487,11 @@ func TestStorageAPIs(t *testing.T) {
 						})
 
 						Convey("Bad image manifest", func() {
-							_, err = imgStore.PutImageManifest("test", digest.String(),
+							_, _, err = imgStore.PutImageManifest("test", digest.String(),
 								ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldNotBeNil)
 
-							_, err = imgStore.PutImageManifest("test", digest.String(),
+							_, _, err = imgStore.PutImageManifest("test", digest.String(),
 								ispec.MediaTypeImageManifest, []byte("bad json"))
 							So(err, ShouldNotBeNil)
 
@@ -526,12 +526,12 @@ func TestStorageAPIs(t *testing.T) {
 							manifestBuf, err = json.Marshal(manifest)
 							So(err, ShouldBeNil)
 							digest := godigest.FromBytes(manifestBuf)
-							_, err = imgStore.PutImageManifest("test", digest.String(),
+							_, _, err = imgStore.PutImageManifest("test", digest.String(),
 								ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
 							// same manifest for coverage
-							_, err = imgStore.PutImageManifest("test", digest.String(),
+							_, _, err = imgStore.PutImageManifest("test", digest.String(),
 								ispec.MediaTypeImageManifest, manifestBuf)
 							So(err, ShouldBeNil)
 
@@ -624,7 +624,7 @@ func TestStorageAPIs(t *testing.T) {
 					So(err, ShouldBeNil)
 
 					digest = godigest.FromBytes(manifestBuf)
-					_, err = imgStore.PutImageManifest("replace", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+					_, _, err = imgStore.PutImageManifest("replace", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 					So(err, ShouldBeNil)
 
 					_, _, _, err = imgStore.GetImageManifest("replace", digest.String())
@@ -675,7 +675,7 @@ func TestStorageAPIs(t *testing.T) {
 					manifestBuf, err = json.Marshal(manifest)
 					So(err, ShouldBeNil)
 					_ = godigest.FromBytes(manifestBuf)
-					_, err = imgStore.PutImageManifest("replace", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
+					_, _, err = imgStore.PutImageManifest("replace", "1.0", ispec.MediaTypeImageManifest, manifestBuf)
 					So(err, ShouldBeNil)
 				})
 
@@ -790,7 +790,7 @@ func TestMandatoryAnnotations(t *testing.T) {
 				So(err, ShouldBeNil)
 
 				Convey("Missing mandatory annotations", func() {
-					_, err = imgStore.PutImageManifest("test", "1.0.0", ispec.MediaTypeImageManifest, manifestBuf)
+					_, _, err = imgStore.PutImageManifest("test", "1.0.0", ispec.MediaTypeImageManifest, manifestBuf)
 					So(err, ShouldNotBeNil)
 				})
 
@@ -818,7 +818,7 @@ func TestMandatoryAnnotations(t *testing.T) {
 							}, cacheDriver)
 					}
 
-					_, err = imgStore.PutImageManifest("test", "1.0.0", ispec.MediaTypeImageManifest, manifestBuf)
+					_, _, err = imgStore.PutImageManifest("test", "1.0.0", ispec.MediaTypeImageManifest, manifestBuf)
 					So(err, ShouldNotBeNil)
 				})
 			})

pkg/test/common.go

@@ -346,7 +346,7 @@ func WriteImageToFileSystem(image Image, repoName string, storeController storag
 		return err
 	}
 
-	_, err = store.PutImageManifest(repoName, image.Reference, ispec.MediaTypeImageManifest, manifestBlob)
+	_, _, err = store.PutImageManifest(repoName, image.Reference, ispec.MediaTypeImageManifest, manifestBlob)
 	if err != nil {
 		return err
 	}
@@ -376,7 +376,7 @@ func WriteMultiArchImageToFileSystem(multiarchImage MultiarchImage, repoName str
 		return err
 	}
 
-	_, err = store.PutImageManifest(repoName, multiarchImage.Reference, ispec.MediaTypeImageIndex,
+	_, _, err = store.PutImageManifest(repoName, multiarchImage.Reference, ispec.MediaTypeImageIndex,
 		indexBlob)
 
 	return err

pkg/test/common_test.go

@@ -1349,8 +1349,8 @@ func TestWriteImageToFileSystem(t *testing.T) {
 			storage.StoreController{
 				DefaultStore: mocks.MockedImageStore{
 					PutImageManifestFn: func(repo, reference, mediaType string, body []byte,
-					) (godigest.Digest, error) {
+					) (godigest.Digest, godigest.Digest, error) {
-						return "", ErrTestError
+						return "", "", ErrTestError
 					},
 				},
 			})

pkg/test/mocks/image_store_mock.go

@@ -12,15 +12,16 @@ import (
 )
 
 type MockedImageStore struct {
-	DirExistsFn            func(d string) bool
+	DirExistsFn         func(d string) bool
-	RootDirFn              func() string
+	RootDirFn           func() string
-	InitRepoFn             func(name string) error
+	InitRepoFn          func(name string) error
-	ValidateRepoFn         func(name string) (bool, error)
+	ValidateRepoFn      func(name string) (bool, error)
-	GetRepositoriesFn      func() ([]string, error)
+	GetRepositoriesFn   func() ([]string, error)
-	GetNextRepositoryFn    func(repo string) (string, error)
+	GetNextRepositoryFn func(repo string) (string, error)
-	GetImageTagsFn         func(repo string) ([]string, error)
+	GetImageTagsFn      func(repo string) ([]string, error)
-	GetImageManifestFn     func(repo string, reference string) ([]byte, godigest.Digest, string, error)
+	GetImageManifestFn  func(repo string, reference string) ([]byte, godigest.Digest, string, error)
-	PutImageManifestFn     func(repo string, reference string, mediaType string, body []byte) (godigest.Digest, error)
+	PutImageManifestFn  func(repo string, reference string, mediaType string, body []byte) (godigest.Digest,
+		godigest.Digest, error)
 	DeleteImageManifestFn  func(repo string, reference string, detectCollision bool) error
 	BlobUploadPathFn       func(repo string, uuid string) string
 	NewBlobUploadFn        func(repo string) (string, error)
@@ -124,12 +125,12 @@ func (is MockedImageStore) PutImageManifest(
 	reference string,
 	mediaType string,
 	body []byte,
-) (godigest.Digest, error) {
+) (godigest.Digest, godigest.Digest, error) {
 	if is.PutImageManifestFn != nil {
 		return is.PutImageManifestFn(repo, reference, mediaType, body)
 	}
 
-	return "", nil
+	return "", "", nil
 }
 
 func (is MockedImageStore) GetImageTags(name string) ([]string, error) {