Support Docker OCI images

Docker Distribution v2.7.0 shipped with OCI support, but our container
registry client was not updated to handle the manifest format in the
HTTP `Accept` header.  As a result, API calls to retrieve a manifest
would return with an error, "OCI manifest found, but accept header does
not support OCI manifests". This would result in blank fields in the
container registry page and prevent tags from being deleted.

To fix this, we just need to add
`application/vnd.oci.image.manifest.v1+json` to the `Accept` header and
configure Faraday to parse the response as JSON. The response structure
is the same as the standard Docker Distribution V2 manifest.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/58685

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/12877

changelogs/unreleased/sh-support-docker-oci-images.yml

+---
+title: Support Docker OCI images
+merge_request: 31127
+author:
+type: fixed

lib/container_registry/client.rb

@@ -7,7 +7,9 @@ module ContainerRegistry
   class Client
     attr_accessor :uri
 
-    MANIFEST_VERSION = 'application/vnd.docker.distribution.manifest.v2+json'.freeze
+    DOCKER_DISTRIBUTION_MANIFEST_V2_TYPE = 'application/vnd.docker.distribution.manifest.v2+json'
+    OCI_MANIFEST_V1_TYPE = 'application/vnd.oci.image.manifest.v1+json'
+    ACCEPTED_TYPES = [DOCKER_DISTRIBUTION_MANIFEST_V2_TYPE, OCI_MANIFEST_V1_TYPE].freeze
 
     # Taken from: FaradayMiddleware::FollowRedirects
     REDIRECT_CODES = Set.new [301, 302, 303, 307]
@@ -60,12 +62,13 @@ module ContainerRegistry
     end
 
     def accept_manifest(conn)
-      conn.headers['Accept'] = MANIFEST_VERSION
+      conn.headers['Accept'] = ACCEPTED_TYPES
 
       conn.response :json, content_type: 'application/json'
       conn.response :json, content_type: 'application/vnd.docker.distribution.manifest.v1+prettyjws'
       conn.response :json, content_type: 'application/vnd.docker.distribution.manifest.v1+json'
-      conn.response :json, content_type: 'application/vnd.docker.distribution.manifest.v2+json'
+      conn.response :json, content_type: DOCKER_DISTRIBUTION_MANIFEST_V2_TYPE
+      conn.response :json, content_type: OCI_MANIFEST_V1_TYPE
     end
 
     def response_body(response, allow_redirect: false)

spec/lib/container_registry/client_spec.rb

@@ -6,6 +6,42 @@ describe ContainerRegistry::Client do
   let(:options) { { token: token } }
   let(:client) { described_class.new("http://container-registry", options) }
 
+  shared_examples '#repository_manifest' do |manifest_type|
+    let(:manifest) do
+      {
+        "schemaVersion" => 2,
+        "config" => {
+          "mediaType" => manifest_type,
+          "digest" =>
+          "sha256:4a3ef0786dd241be6000311e1503869b320be433b9cba84cfafeb512d1720c95",
+          "size" => 6608
+        },
+        "layers" => [
+          {
+            "mediaType" => manifest_type,
+            "digest" =>
+            "sha256:83ef92b73cf4595aa7fe214ec6747228283d585f373d8f6bc08d66bebab531b7",
+            "size" => 2828661
+          }
+        ]
+ }
+    end
+
+    it 'GET /v2/:name/manifests/mytag' do
+      stub_request(:get, "http://container-registry/v2/group/test/manifests/mytag")
+        .with(headers: {
+                'Accept' => described_class::ACCEPTED_TYPES.join(', '),
+                'Authorization' => "bearer #{token}"
+              })
+        .to_return(status: 200, body: manifest.to_json, headers: { content_type: manifest_type })
+
+      expect(client.repository_manifest('group/test', 'mytag')).to eq(manifest)
+    end
+  end
+
+  it_behaves_like '#repository_manifest', described_class::DOCKER_DISTRIBUTION_MANIFEST_V2_TYPE
+  it_behaves_like '#repository_manifest', described_class::OCI_MANIFEST_V1_TYPE
+
   describe '#blob' do
     it 'GET /v2/:name/blobs/:digest' do
       stub_request(:get, "http://container-registry/v2/group/test/blobs/sha256:0123456789012345")

spec/lib/container_registry/tag_spec.rb

@@ -9,7 +9,7 @@ describe ContainerRegistry::Tag do
   end
 
   let(:headers) do
-    { 'Accept' => 'application/vnd.docker.distribution.manifest.v2+json' }
+    { 'Accept' => ContainerRegistry::Client::ACCEPTED_TYPES.join(', ') }
   end
 
   let(:tag) { described_class.new(repository, 'tag') }

spec/models/container_repository_spec.rb

@@ -16,7 +16,7 @@ describe ContainerRepository do
                                    host_port: 'registry.gitlab')
 
     stub_request(:get, 'http://registry.gitlab/v2/group/test/my_image/tags/list')
-      .with(headers: { 'Accept' => 'application/vnd.docker.distribution.manifest.v2+json' })
+      .with(headers: { 'Accept' => ContainerRegistry::Client::ACCEPTED_TYPES.join(', ') })
       .to_return(
         status: 200,
         body: JSON.dump(tags: ['test_tag']),