Podman pull by tag AND sha256 hash skips tagging the pulled image

[ratijas]

Not sure if this is an intentional behavior.

When pulling an image, if both tag AND sha256 hash are present, tag gets ignored: image won't be tagged, it would appear as in the image ls output.

❯ podman pull docker.io/library/httpd:2.4.66-trixie@sha256:b89c19a390514d6767e8c62f29375d0577190be448f63b24f5f11d6b03f7bf18
Trying to pull docker.io/library/httpd@sha256:b89c19a390514d6767e8c62f29375d0577190be448f63b24f5f11d6b03f7bf18...
Getting image source signatures
Copying blob 996228ca33ab done   |
Copying blob 0c8d55a45c0d done   |
Copying blob 4f4fb700ef54 skipped: already exists
Copying blob fe1db8dd446f done   |
Copying blob 30973b009bab done   |
Copying blob 85b0d820aa56 done   |
Copying config d2825031e9 done   |
Writing manifest to image destination
d2825031e94c68c5437ae2f479a1e2e1b2e0a26990c506e17deee19590546735
❯ podman image ls
REPOSITORY                                  TAG                       IMAGE ID      CREATED       SIZE
docker.io/library/httpd                     <none>                    d2825031e94c  8 days ago    120 MB

Why is podman not making any attempts at verifying that the tag matches the sha256? Why does it skip tagging?

It bothers me because it is inconvenient to deal with. I do want the security of sha hashes, but I also want to see human-readable versions numbers alongside long meaningless blobs of hash.

[Luap99]

containers/buildah#1407 (comment)
containers/container-libs#225

should contain the import details about the problem of that syntax and its history

[ratijas]

oof, that's a lot of background. Thank you. I guess I'll stick to tags for my simple use cases for now.

[ratijas]

Shouldn't podman then complain about an unsupported combination? Both docker 29.2.0 and podman 5.6.2 CLI silently accept the combined syntax, which doesn't make much sense.

[Luap99]

which well is what certain users want... so we cannot just break them?

[ratijas]

I can see that. I meant more like print("hey, you specified both tag and digest. this is not supported by podman. tag will be discarded.") and proceed with your day