[FEAT] Support explicit digest in mod list

[qlonik]

Is this a new feature request?

• I have searched the existing issues

Name of mod

mod-scripts (general)

Wanted change

Add support for specifying digests in the list of mods, e.g.:

DOCKER_MODS=ghcr.io/linuxserver/mods:universal-calibre-v7.12.0@sha256:e8aad70cc71c65587e28711ab16a0ffa1bbcb707b462a6313b721f7622529be3|ghcr.io/linuxserver/mods:lazylibrarian-ffmpeg@sha256:5083d9f2bdfcb27edf65a55e7c05d0ae8ce309d02d5f0cdc83bfe8e95c942dd4

Reason for change

This provides extra enforcement of the mod version.

I have renovate bot manage these sha256 digests for me: https://github.com/qlonik/musical-parakeet/blob/90396d3c0287656ad87c97e522a6d483f83ccf37/kubernetes/main/apps/default/lazylibrarian/app/helmrelease.yaml#L47-L60, so it is not a very big burden. I suspect other people might not have a setup like this, but it would be helpful to support explicit digests.

Proposed code change

No. It seems that either get_blob_sha needs to change or the call before this function needs to check for presence of sha256 in tag.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[TheRedCyclops]

implementing this or explicit version numbers would be great

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[asardaes]

+1 and hoping this is not closed due to inactivity

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[thespad]

I'll have a look at this, it may be possible but it's going to require a bunch of changes to how we currently handle mods

[thespad]

OK so I have this working with one minor caveat. If you look at the debug logs you'll see something like:

[mod-init] (DEBUG) Mod SHA is sha256:7c6b7fa8184ac3c2f023fbbf318f5edb0987d5b1960fd5bc8be45b34fa844941
[mod-init] Installing linuxserver/mods:universal-tshoot@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

Because you're using the manfiest SHA to identify the image to pull, but we use the layer SHA to validate the mod. It's all working, it's just potentially confusing because of the different hashes.

[thespad]

If you want to test it out, then download https://github.com/linuxserver/docker-mods/blob/mod-scripts-sha/docker-mods.v3 and mount it into the container at /docker-mods (make sure it's executable) then try and add mods by SHA.

Note that this will currently only support the full:

linuxserver/mods:universal-tshoot@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

format and not the shorter form:

linuxserver/mods@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

[asardaes]

First of all, thanks for taking a look at this. If I understand correctly, the limitation you mention about the shorter form would be problematic with images published to ghcr.io if they overwrite the tag, right? For example this mod has a moving main tag, so every new publication untags the previous one and leaves only the short form reachable.

[thespad]

The true secret of the manifest hash format is that the tag doesn't actually do anything.

linuxserver/mods:universal-tshoot@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

is the same as

linuxserver/mods@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

is the same as

linuxserver/mods:foo@sha256:d31f2d4a88a0c5d98f6bf7f4725e228959b6d22dcd14d44c7a755521f007cd98

But from a "parsing out tags to use the correct bits in the API calls to the registry" perspective, it's significantly easier if we can always assume a tag is present.

[asardaes]

Do you think this would work? Trying to first split by @ and adjusting the subsequent logic based on that:

IFS="@" read -ra DOCKER_MOD_WITH_SHA <<<"$DOCKER_MOD"

if [[ "${DOCKER_MOD_WITH_SHA[1]}" =~ sha256: ]]; then
    TAGSHA="${DOCKER_MOD_WITH_SHA[1]}"
fi

TAG="${DOCKER_MOD_WITH_SHA[0]#*:}"
if [[ "${TAG}" == "${DOCKER_MOD_WITH_SHA[0]}" ]]; then
    TAG="latest"
fi

[thespad]

The short answer is I know roughly what needs to be done but it's a fair chunk of work to properly test and fix all the many stupid edge cases we have to deal with and it's the Christmas break so I can't be arsed to do it right now.

Once I've got some time and motivation in a couple of weeks I'll fix it up but in the meantime there's a version that works as long as the long-form image format is used.

[thespad]

I lied, I had time this afternoon #998

[asardaes]

Thanks, worked for me running in podman. BTW, I'd suggest leaving CURL_NOISE_LEVEL="-vs" when debugging curl, that way the download stats output (which can mess up the formatting of other logs) is suppressed.