[GH-ISSUE #16548] feat: Please make version tags resolve to the same manifest index as latest and main, or include a stable version label #17953

New Issue

GiteaMirror · 2026-04-19T23:51:17-05:00

GiteaMirror commented

2026-04-19 23:51:17 -05:00

Originally created by @nicholasmerlino on GitHub (Aug 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16548

Check Existing Issues

I have searched the existing issues and discussions.

Problem Description

We mirror your image from GHCR and need to name artifacts by the real version (SemVer), not floating tags. For a given release, latest/main resolve to a different multi-arch index digest than the version tag (e.g., vX.Y.Z). Because GHCR’s package-versions API maps digest → tags only for that exact object, looking up the latest digest returns only latest/main, not the SemVer tag—even when they represent the same release. This happens because an OCI image index is just a list of platform manifests and can be rebuilt, yielding a different top-level digest while the per-platform images remain identical.

Desired Solution you'd like

Retag the same index: Point vX.Y.Z, latest, and main at the same manifest index digest for a release. Then GHCR’s versions API will return the version tag when we query by digest.

Alternatives Considered

Commit→tag mapping: Read org.opencontainers.image.revision/source from the image config and look up which Git tag points to that commit via the GitHub API. This works but requires extra API calls and relies on those labels being present.
Platform content comparison: Compare a canonical platform manifest (e.g., linux/amd64) for latest vs. recent SemVer tags; if config and layer digests match, treat them as the same release. This is correct per OCI, but it’s heavier and still doesn’t give the name without the tag existing on the same object.
Time-window correlation: Heuristically match GHCR package version timestamps with GitHub Releases. Feasible, but brittle; explicit tagging or labels are preferable.

Additional Context

GHCR exposes container packages and their versions/tags via the Packages REST API (package_type=container), which we use to map digest ↔ tags. When latest and vX.Y.Z are different indices, the digest lookup for latest can’t see the SemVer tag.
OCI annotations define org.opencontainers.image.version, source, and revision keys commonly emitted by docker/metadata-action, which make the version (or commit) machine-discoverable.
The image index being a distinct object from per-platform manifests explains why two indexes for the same release can legitimately have different digests. Aligning tags or adding labels resolves this for consumers who pin by digest but need a human-readable version.

Originally created by @nicholasmerlino on GitHub (Aug 12, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/16548 ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description We mirror your image from GHCR and need to name artifacts by the real version (SemVer), not floating tags. For a given release, latest/main resolve to a different multi-arch index digest than the version tag (e.g., vX.Y.Z). Because GHCR’s package-versions API maps digest → tags only for that exact object, looking up the latest digest returns only latest/main, not the SemVer tag—even when they represent the same release. This happens because an OCI image index is just a list of platform manifests and can be rebuilt, yielding a different top-level digest while the per-platform images remain identical. ### Desired Solution you'd like Retag the same index: Point vX.Y.Z, latest, and main at the same manifest index digest for a release. Then GHCR’s versions API will return the version tag when we query by digest. ### Alternatives Considered Commit→tag mapping: Read org.opencontainers.image.revision/source from the image config and look up which Git tag points to that commit via the GitHub API. This works but requires extra API calls and relies on those labels being present. Platform content comparison: Compare a canonical platform manifest (e.g., linux/amd64) for latest vs. recent SemVer tags; if config and layer digests match, treat them as the same release. This is correct per OCI, but it’s heavier and still doesn’t give the name without the tag existing on the same object. Time-window correlation: Heuristically match GHCR package version timestamps with GitHub Releases. Feasible, but brittle; explicit tagging or labels are preferable. ### Additional Context GHCR exposes container packages and their versions/tags via the Packages REST API (package_type=container), which we use to map digest ↔ tags. When latest and vX.Y.Z are different indices, the digest lookup for latest can’t see the SemVer tag. OCI annotations define org.opencontainers.image.version, source, and revision keys commonly emitted by docker/metadata-action, which make the version (or commit) machine-discoverable. The image index being a distinct object from per-platform manifests explains why two indexes for the same release can legitimately have different digests. Aligning tags or adding labels resolves this for consumers who pin by digest but need a human-readable version.

GiteaMirror closed this issue

2026-04-19 23:51:17 -05:00

GiteaMirror commented

2026-04-19 23:51:19 -05:00

@tjbck commented on GitHub (Aug 13, 2025):

PR welcome.

@tjbck commented on GitHub (Aug 13, 2025): PR welcome.

GiteaMirror referenced this issue

2026-04-20 05:30:02 -05:00

[PR #17953] [CLOSED] build(deps): bump opentelemetry-instrumentation-aiohttp-client from 0.57b0 to 0.58b0 #24620

GiteaMirror referenced this issue

2026-04-25 12:39:21 -05:00