Crane

A container registry driven through crane, the registry client of go-containerregistry: tags resolved to digests, images and indexes described, images mirrored in by digest, digests given tags, and a file read out of an artifact's layer, every outcome a swamp record. One model type, @dataverket/crane/registry. digest resolves references to digests and records, per tag, the digest it held last time and since when it has been the current one, so a quarantine can wait for a base image to stay unchanged. describe records an image or an index: media type, platforms, created time, labels, annotations, layers and size. copy brings an upstream image pinned by digest under /, at its source registry and whole path, where a registry mirror asks for it, leaves one already there with that digest unchanged, and checks the digest after. tag points a tag at a digest already in a repository and records the digest the tag held before, for a promotion that is a retag. blob reads one file out of an artifact's tar+gzip layer, such as release.json out of a Flux artifact, and records it as text and as JSON. Two workflows: @dataverket/mirror-image resolves upstream tags to digests and copies every image under the namespace, asserting each; and @dataverket/base-image-watch, read-only and made to run daily, records the digest of every watched upstream tag. A skill, crane, says which to run for what. A credential comes from a vault, reaches crane on stdin into a docker config that exists for one run only, and is never an argument; without one crane uses the container config of the user running swamp. crane runs as a subprocess with argv arrays, never through a shell. Written against crane 0.22.1.