Ensure all layers are here when tagging

Signed-off-by: apostasie <[email protected]>

Author: apostasie

pkg/cmd/image/tag.go

@@ -25,6 +25,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/imagewalker"
+	"github.com/containerd/nerdctl/v2/pkg/imgutil"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
 
@@ -59,17 +60,23 @@ func Tag(ctx context.Context, client *containerd.Client, options types.ImageTagO
 	}
 	defer done(ctx)
 
-	image, err := imageService.Get(ctx, srcName)
+	img, err := imageService.Get(ctx, srcName)
 	if err != nil {
 		return err
 	}
-	image.Name = target.String()
-	if _, err = imageService.Create(ctx, image); err != nil {
+	img.Name = target.String()
+
+	err = imgutil.EnsureAllContent(ctx, client, srcName, img.Target, "", options.GOptions)
+	if err != nil {
+		return err
+	}
+
+	if _, err = imageService.Create(ctx, img); err != nil {
 		if errdefs.IsAlreadyExists(err) {
-			if err = imageService.Delete(ctx, image.Name); err != nil {
+			if err = imageService.Delete(ctx, img.Name); err != nil {
 				return err
 			}
-			if _, err = imageService.Create(ctx, image); err != nil {
+			if _, err = imageService.Create(ctx, img); err != nil {
 				return err
 			}
 		} else {

pkg/imgutil/imgutil.go

@@ -44,6 +44,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/idutil/imagewalker"
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/dockerconfigresolver"
 	"github.com/containerd/nerdctl/v2/pkg/imgutil/pull"
+	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 )
 
 // EnsuredImage contains the image existed in containerd and its metadata.
@@ -102,6 +103,52 @@ func GetExistingImage(ctx context.Context, client *containerd.Client, snapshotte
 	return res, nil
 }
 
+func EnsureAllContent(ctx context.Context, client *containerd.Client, rawRef string, target ocispec.Descriptor, platform string, options types.GlobalCommandOptions) error {
+	named, err := distributionref.ParseDockerRef(rawRef)
+	if err != nil {
+		return err
+	}
+	refDomain := distributionref.Domain(named)
+	var platformComparer platforms.MatchComparer
+	if platform != "" {
+		parsed, err := platforms.Parse(platform)
+		if err != nil {
+			return err
+		}
+		platformComparer = platformutil.NewMatchComparerFromOCISpecPlatformSlice([]ocispec.Platform{parsed})
+	} else {
+		platformComparer = platforms.Default()
+	}
+
+	_, _, _, missing, err := images.Check(ctx, client.ContentStore(), target, platformComparer)
+	if err != nil {
+		return err
+	}
+
+	if len(missing) > 0 {
+		// Get a resolver
+		var dOpts []dockerconfigresolver.Opt
+		if options.InsecureRegistry {
+			log.G(ctx).Warnf("skipping verifying HTTPS certs for %q", refDomain)
+			dOpts = append(dOpts, dockerconfigresolver.WithSkipVerifyCerts(true))
+		}
+		dOpts = append(dOpts, dockerconfigresolver.WithHostsDirs(options.HostsDir))
+		resolver, err := dockerconfigresolver.New(ctx, refDomain, dOpts...)
+		if err != nil {
+			return err
+		}
+
+		opts := []containerd.RemoteOpt{
+			containerd.WithResolver(resolver),
+			containerd.WithPlatformMatcher(platformComparer),
+		}
+		_, err = client.Fetch(ctx, rawRef, opts...)
+		return err
+	}
+
+	return nil
+}
+
 // EnsureImage ensures the image.
 //
 // # When insecure is set, skips verifying certs, and also falls back to HTTP when the registry does not speak HTTPS