Reuse cached OCI configs during pull

[Suzu1Dev]

Follow-up to #393, extending cache reuse from layers to the image config.

Depends on #393. This branch includes its layer-cache commit; the config-only change is c1116df.

Repeated pulls download the image config during platform selection even when its blob already exists locally. Read cached config bytes after checking the manifest's digest and size, retain the platform checks, and defer the config source read during publication until the blob is missing.

Local registry tests cover single images and indexes with and without declared platforms. The first pull makes one config GET; a second pull succeeds with the config endpoint configured to return 404 and makes no additional config GET. Missing configs still require the source, and corrupt configs or platform mismatches still fail. Pulls still fetch manifests from the registry.

Validation on macOS arm64:

• make oci-lint
• GOFLAGS=-count=1 make oci-test
• make elfuse-oci and ./build/elfuse-oci --help

---

Summary by cubic

Reuses cached OCI image configs during pulls so repeated pulls no longer download the config blob when it already exists locally.

• Platform checks now read verified cached config bytes instead of fetching from the registry.
• Config source reads are deferred during publication until the blob is confirmed missing from the store.
• Added verifiedBlobBytes to validate cached blobs against the manifest digest and size; corrupt or size-mismatched configs are rejected.
• Tests cover cache reuse with the config endpoint returning 404, platform checks on cached configs, and cached config integrity.

^{Written for commit c1116df. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 4 files

_{You’re at about 93% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/oci/pull_test.go">

<violation number="1" location="cmd/oci/pull_test.go:169">
P3: The error assertion accepts either "image platform" or "no image for platform" for every mode, but in "image" and "declared-index" modes only "image platform" is reachable (the child is always declared as the requested platform). A selectivity/regression bug that makes the declared path fall through to "no image for platform" — or skips the cached config check — would still pass. Pin the expected message per mode: "no image for platform" for "platformless-index", "image platform" for the other two.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The error assertion accepts either "image platform" or "no image for platform" for every mode, but in "image" and "declared-index" modes only "image platform" is reachable (the child is always declared as the requested platform). A selectivity/regression bug that makes the declared path fall through to "no image for platform" — or skips the cached config check — would still pass. Pin the expected message per mode: "no image for platform" for "platformless-index", "image platform" for the other two.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cmd/oci/pull_test.go, line 169:

<comment>The error assertion accepts either "image platform" or "no image for platform" for every mode, but in "image" and "declared-index" modes only "image platform" is reachable (the child is always declared as the requested platform). A selectivity/regression bug that makes the declared path fall through to "no image for platform" — or skips the cached config check — would still pass. Pin the expected message per mode: "no image for platform" for "platformless-index", "image platform" for the other two.</comment>

<file context>
@@ -43,6 +47,190 @@ func imageDigest(t *testing.T, img v1.Image) v1.Hash {
+				pushBlob(t, s, r.desc.MediaType, r.body)
+				r.blocked.Store(true)
+				err := r.pull(t, s)
+				if err == nil || (!strings.Contains(err.Error(), "image platform") && !strings.Contains(err.Error(), "no image for platform")) {
+					t.Errorf("cached platform mismatch error = %v", err)
+				}
</file context>

[jserv]

Merge commits into #393 and avoid stacked pull requests.