From d08ca5c2b65d442f37424957e53d81f96356d12c Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Mon, 14 Sep 2015 09:20:11 -0800
Subject: [PATCH] =?UTF-8?q?Make=20sure=20tags=20and=20digests=20don?=
 =?UTF-8?q?=E2=80=99t=20collide?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tags and digests are kept in the same storage. We want to make sure that they are completely separated - tags are something users set and digests can only be set by pull-by-digest code path.

Reverts #14664

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 graph/export.go                        |  6 ++++++
 graph/tags.go                          |  9 +--------
 integration-cli/docker_cli_tag_test.go | 19 +++++++++++++++++++
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/graph/export.go b/graph/export.go
index d5fc5342e0..7f7e972053 100644
--- a/graph/export.go
+++ b/graph/export.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/distribution/digest"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/parsers"
 	"github.com/docker/docker/registry"
@@ -59,6 +60,11 @@ func (s *TagStore) ImageExport(names []string, outStream io.Writer) error {
 				// This is a named image like 'busybox:latest'
 				repoName, repoTag := parsers.ParseRepositoryTag(name)
 
+				// Skip digests on save
+				if _, err := digest.ParseDigest(repoTag); err == nil {
+					repoTag = ""
+				}
+
 				// check this length, because a lookup of a truncated has will not have a tag
 				// and will not need to be added to this map
 				if len(repoTag) > 0 {
diff --git a/graph/tags.go b/graph/tags.go
index 873d4120e3..a0349e67b9 100644
--- a/graph/tags.go
+++ b/graph/tags.go
@@ -277,14 +277,7 @@ func (store *TagStore) setLoad(repoName, tag, imageName string, force bool, out
 		return err
 	}
 	if err := tags.ValidateTagName(tag); err != nil {
-		if _, formatError := err.(tags.ErrTagInvalidFormat); !formatError {
-			return err
-		}
-		if _, dErr := digest.ParseDigest(tag); dErr != nil {
-			// Still return the tag validation error.
-			// It's more likely to be a user generated issue.
-			return err
-		}
+		return err
 	}
 	if err := store.reload(); err != nil {
 		return err
diff --git a/integration-cli/docker_cli_tag_test.go b/integration-cli/docker_cli_tag_test.go
index 544e41ab3f..a3e1e0a2e8 100644
--- a/integration-cli/docker_cli_tag_test.go
+++ b/integration-cli/docker_cli_tag_test.go
@@ -152,3 +152,22 @@ func (s *DockerSuite) TestTagOfficialNames(c *check.C) {
 		deleteImages("fooo/bar:latest")
 	}
 }
+
+// ensure tags can not match digests
+func (s *DockerSuite) TestTagMatchesDigest(c *check.C) {
+	testRequires(c, DaemonIsLinux)
+	if err := pullImageIfNotExist("busybox:latest"); err != nil {
+		c.Fatal("couldn't find the busybox:latest image locally and failed to pull it")
+	}
+	digest := "busybox@sha256:abcdef76720241213f5303bda7704ec4c2ef75613173910a56fb1b6e20251507"
+	// test setting tag fails
+	_, _, err := dockerCmdWithError("tag", "-f", "busybox:latest", digest)
+	if err == nil {
+		c.Fatal("digest tag a name should have failed")
+	}
+	// check that no new image matches the digest
+	_, _, err = dockerCmdWithError("inspect", digest)
+	if err == nil {
+		c.Fatal("inspecting by digest should have failed")
+	}
+}