v0.41.16: BB-19 OCI image index manifest case

Register `OCI image index manifest` (plan-20261001 BB-19): push linux/amd64
and linux/arm64 single-platform manifests with oras --artifact-platform
(verified through their configs), PUT an OCI index referencing both
(201), and read it back with the index media type, exactly the two pushed
digests and their platforms. oci_oras_push gains an optional platform.
Marks BB-18 done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bJDjze83ToyPysYzmxxWS
Signed-off-by: Eli Ma <eli@patch.sh>

Author: genedna

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mega2"
-version = "0.41.15"
+version = "0.41.16"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 description = "Monorepo engine and Git hosting server for AI agents: trunk-based storage, Git Smart HTTP, Git LFS, OCI registry, and Agent Session Capture"

Cargo.toml

@@ -395,7 +395,7 @@ CASE='OCI ping'   # 换成要跑的 case 名
 docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml --profile interop exec -T -e MEGA2_SMOKE_CASE="$CASE" interop-smoke bash /repo/scripts/oci_client_smoke_storage_only.sh 2>&1 | tee target/tmp/bb-oci-case.log
 ```
 
-已登记 case：`OCI ping`、`OCI oras push and pull`、`OCI reject unauthenticated push`、`OCI chunked blob upload`、`OCI cross-repo blob mount`、`OCI manifest HEAD and conditional GET`、`OCI blob range`、`OCI tags list pagination`。
+已登记 case：`OCI ping`、`OCI oras push and pull`、`OCI reject unauthenticated push`、`OCI chunked blob upload`、`OCI cross-repo blob mount`、`OCI manifest HEAD and conditional GET`、`OCI blob range`、`OCI tags list pagination`、`OCI image index manifest`。
 
 不设 `MEGA2_SMOKE_CASE` 时整跑全部默认栈 case；opt-in case（auth-none）只经 `scripts/bb_optin_run.sh none oci_client_smoke_storage_only.sh '<case>' <log>` 运行。
 

docs/deploy-trunk.md

@@ -1370,7 +1370,7 @@
 ### Task BB-18: OCI tags list pagination
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.15；Codex R2 PASS（P2 已修）；C 组 2023 测试通过；待 D 组 `docker` job）  
+**Lifecycle / Acceptance:** `done` / `complete`（v0.41.15；C 组 2023 测试通过；D 组 docker run 36955654543 success）  
 **Description:** 在 `scripts/oci_client_smoke_storage_only.sh` 注册 case `OCI tags list pagination`。同一仓库推送 3 个 tag 后分页读取。 唯一行为轴：tags/list 分页。  
 **Out of scope:** 其它 case（各自成卡）；改 `src/**`（产品缺陷按 ADR-BB-08 立 `FIX-BB-*`）；改既有 smoke 脚本（GC-BB-06）；以 cargo IT 作 VER（GC-BB-04）。  
 **Current evidence:**
@@ -1420,7 +1420,7 @@
 ### Task BB-19: OCI image index manifest
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `pending` / （空）  
+**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.16；Codex R2 PASS；C 组 2023 测试通过；待 D 组 `docker` job）  
 **Description:** 在 `scripts/oci_client_smoke_storage_only.sh` 注册 case `OCI image index manifest`。推送两个单平台 manifest 后 PUT 引用二者的 OCI index。 唯一行为轴：OCI index 推送。  
 **Out of scope:** 其它 case（各自成卡）；改 `src/**`（产品缺陷按 ADR-BB-08 立 `FIX-BB-*`）；改既有 smoke 脚本（GC-BB-06）；以 cargo IT 作 VER（GC-BB-04）。  
 **Current evidence:**

docs/plan/plan-20261001.md

@@ -194,15 +194,16 @@ case_oci_cross_repo_mount() {
     [ -n "$(oci_header "$d/h" docker-upload-uuid)" ] || { echo "fallback session without Docker-Upload-UUID" >&2; return 1; }
 }
 
-# oci_oras_push <repo:tag> <dir>: push one small file with oras; prints the
-# manifest digest reported by the push (its single `Digest:` line).
+# oci_oras_push <repo:tag> <dir> [<os/arch>]: push one small file with oras
+# (as a single-platform manifest when <os/arch> is given); prints the manifest
+# digest reported by the push (its single `Digest:` line).
 oci_oras_push() {
-    local ref="$REGISTRY/$1" dir="$2"
+    local ref="$REGISTRY/$1" dir="$2" platform="${3:-}"
     mkdir -p "$dir"
     export DOCKER_CONFIG="$dir/docker"
     printf 'bb %s %s\n' "$1" "$RUN_ID" > "$dir/payload.txt"
     printf '%s' "$TOKEN" | oci_run "$dir/login.out" oras login --plain-http -u bb --password-stdin "$REGISTRY" || return 1
-    (cd "$dir" && oci_run "$dir/push.out" oras push --plain-http "$ref" payload.txt) || return 1
+    (cd "$dir" && oci_run "$dir/push.out" oras push --plain-http ${platform:+--artifact-platform "$platform"} "$ref" payload.txt) || return 1
     local pushed
     pushed=$(rg -o '^Digest: (sha256:[0-9a-f]{64})$' -r '$1' "$dir/push.out")
     [ "$(printf '%s\n' "$pushed" | grep -c '^sha256:')" = 1 ] \
@@ -270,6 +271,46 @@ case_oci_tags_pagination() {
     [ "$(jq -r '.errors[0].code' "$d/bad.json")" = PAGINATION_NUMBER_INVALID ] || { echo "n=abc error code mismatch" >&2; return 1; }
 }
 
+# --- BB-19 OCI image index manifest -------------------------------------
+case_oci_image_index() {
+    local d="$WORK/index" repo="bb-$RUN_ID/index" d1 d2 s1 s2 code ct arch
+    oci_case_begin
+    d1=$(oci_oras_push "$repo:amd64" "$d/amd64" linux/amd64)
+    d2=$(oci_oras_push "$repo:arm64" "$d/arm64" linux/arm64)
+    for arch in amd64 arm64; do
+        oci_run "$d/config-$arch.json" oras manifest fetch-config --plain-http "$REGISTRY/$repo:$arch"
+        [ "$(jq -c '{os, architecture}' "$d/config-$arch.json")" = "{\"os\":\"linux\",\"architecture\":\"$arch\"}" ] \
+            || { echo "the $arch manifest is not a linux/$arch single-platform manifest" >&2; return 1; }
+    done
+    oci_run "$d/desc1.json" oras manifest fetch --plain-http --descriptor "$REGISTRY/$repo:amd64"
+    oci_run "$d/desc2.json" oras manifest fetch --plain-http --descriptor "$REGISTRY/$repo:arm64"
+    [ "$(jq -r .digest "$d/desc1.json")" = "$d1" ] && [ "$(jq -r .digest "$d/desc2.json")" = "$d2" ] \
+        || { echo "fetched descriptors differ from the pushed digests" >&2; return 1; }
+    s1=$(jq -r .size "$d/desc1.json")
+    s2=$(jq -r .size "$d/desc2.json")
+    jq -n --arg d1 "$d1" --argjson s1 "$s1" --arg d2 "$d2" --argjson s2 "$s2" '{
+        schemaVersion: 2,
+        mediaType: "application/vnd.oci.image.index.v1+json",
+        manifests: [
+          {mediaType: "application/vnd.oci.image.manifest.v1+json", digest: $d1, size: $s1, platform: {architecture: "amd64", os: "linux"}},
+          {mediaType: "application/vnd.oci.image.manifest.v1+json", digest: $d2, size: $s2, platform: {architecture: "arm64", os: "linux"}}
+        ]}' > "$d/index.json"
+    code=$(oci_curl -u "bb:$TOKEN" -X PUT -o /dev/null -w '%{http_code}' \
+        -H 'Content-Type: application/vnd.oci.image.index.v1+json' --data-binary @"$d/index.json" \
+        "$MEGA2_BASE_URL/v2/$repo/manifests/index")
+    [ "$code" = 201 ] || { echo "index PUT returned $code" >&2; return 1; }
+    code=$(oci_curl -H 'Accept: application/vnd.oci.image.index.v1+json' -D "$d/h" -o "$d/got.json" -w '%{http_code}' \
+        "$MEGA2_BASE_URL/v2/$repo/manifests/index")
+    [ "$code" = 200 ] || { echo "index GET returned $code" >&2; return 1; }
+    ct=$(oci_header "$d/h" content-type)
+    [ "$ct" = "application/vnd.oci.image.index.v1+json" ] || { echo "index Content-Type is '$ct'" >&2; return 1; }
+    [ "$(jq '.manifests | length' "$d/got.json")" = 2 ] || { echo "index does not list 2 manifests" >&2; return 1; }
+    [ "$(jq -c '[.manifests[].digest]' "$d/got.json")" = "$(jq -cn --arg a "$d1" --arg b "$d2" '[$a, $b]')" ] \
+        || { echo "index manifests are not the two pushed manifests" >&2; return 1; }
+    [ "$(jq -c '[.manifests[].platform | "\(.os)/\(.architecture)"]' "$d/got.json")" = '["linux/amd64","linux/arm64"]' ] \
+        || { echo "index platforms are not linux/amd64 and linux/arm64" >&2; return 1; }
+}
+
 run_case "OCI ping" case_oci_ping
 run_case "OCI oras push and pull" case_oci_oras_push_pull
 run_case "OCI reject unauthenticated push" case_oci_reject_unauth_push
@@ -278,5 +319,6 @@ run_case "OCI cross-repo blob mount" case_oci_cross_repo_mount
 run_case "OCI manifest HEAD and conditional GET" case_oci_manifest_head_304
 run_case "OCI blob range" case_oci_blob_range
 run_case "OCI tags list pagination" case_oci_tags_pagination
+run_case "OCI image index manifest" case_oci_image_index
 
 finish