Amazon ECR
Copying api:2.4.0 into a destination repository where 2.4.0 , with Also update the destination's :latest .
| Part of the graph | artifactStatus | What the run does |
|---|---|---|
Image indexsha256:3f9a1c0e7b22 | Copied | |
linux/amd64 imagesha256:8c41d7e09a5f | Copied | |
linux/arm64 imagesha256:b2076fa3d1c8 | Copied | |
SBOMsha256:51e8b9c2f430 | Copied | |
Signature on the SBOMsha256:d93a04e6b175 | Copied | |
Provenance attestationsha256:6af2c815e0d9 | Copied | |
Legacy Cosign signature tagsha256-3f9a1c0e7b22.sig | Not found: a tag, not a referrer |
6 copied. After the write, Douklar reads the root digest and every descriptor back and compares them with the source.
Switch a referrer's status to try an archived one. The rules are Douklar's; the repository, the tag and the digests are samples. The console moves :latest only when you tick it; the CLI moves it only with --ecr-update-latest.
- What moves
- Selected tags with their full OCI referrer graph: indexes, SBOMs, attestations
- Your choices
- Pick tags, rename the repository on the way, and move
latestonly if you ask
How it moves
- Copies selected tags with
oras cp --recursive, pinned to ORAS v1.3.4. - Checks the root digest and that the descriptor sets are equal after every tag write.
- Reports a destination tag conflict with what is left there, for you to resolve.
douklar check runconfirms that destination repositories hold the expected versions, which suits CI.
Limits
- Copies into an existing repository; it does not create repositories or change lifecycle, scan or policy settings.
- Archived or activating referrers are refused instead of restored.
- Legacy Cosign
sha256-*.sig/.att/.sbomtags are not discovered or copied. - Signature trust is not checked: an equal graph is not a trust decision.
For continuous replication of new pushes, native ECR replication is the better tool.