oci: Handle io.github.containers.DeltaUrl in index

If the magical io.github.containers.DeltaUrl label is set in the
index, then try to download this to use as the delta manifest for the
image. This allows servers to store deltas outside the registry
itself. The label is propagated to the xa.delta-url metadata in the
generated "fake summary" for the remote, and read back on pull.

Note that the delta manifest layers descriptor will need to have a
"urls" key where it references the blobs if the blobs are also not
stored on the registry.

If the specified manifest doesn't exist or doesn't apply to the target
image we fall back to resolving via the _deltaindex tag.

app/flatpak-builtins-build-import-bundle.c

@@ -121,7 +121,7 @@ import_oci (OstreeRepo *repo, GFile *file,
  return NULL;
  }
 
- commit_checksum = flatpak_pull_from_oci (repo, registry, NULL, oci_digest, manifest, image_config,
+ commit_checksum = flatpak_pull_from_oci (repo, registry, NULL, oci_digest, NULL, manifest, image_config,
  NULL, target_ref, FLATPAK_PULL_FLAGS_NONE, NULL, NULL, cancellable, error);
  if (commit_checksum == NULL)
  return NULL;

common/flatpak-dir.c

@@ -5116,6 +5116,7 @@ flatpak_dir_mirror_oci (FlatpakDir *self,
  VarRefInfoRef latest_rev_info;
  VarMetadataRef metadata;
  const char *oci_repository = NULL;
+ const char *delta_url = NULL;
  const char *rev;
  gboolean res;
 
@@ -5138,6 +5139,7 @@ flatpak_dir_mirror_oci (FlatpakDir *self,
 
  metadata = var_ref_info_get_metadata (latest_rev_info);
  oci_repository = var_metadata_lookup_string (metadata, "xa.oci-repository", NULL);
+ delta_url = var_metadata_lookup_string (metadata, "xa.delta-url", NULL);
 
  oci_digest = g_strconcat ("sha256:", rev, NULL);
 
@@ -5149,7 +5151,7 @@ flatpak_dir_mirror_oci (FlatpakDir *self,
 
  g_debug ("Mirroring OCI image %s", oci_digest);
 
- res = flatpak_mirror_image_from_oci (dst_registry, registry, oci_repository, oci_digest, state->remote_name, ref, self->repo, oci_pull_progress_cb,
+ res = flatpak_mirror_image_from_oci (dst_registry, registry, oci_repository, oci_digest, state->remote_name, ref, delta_url, self->repo, oci_pull_progress_cb,
  progress, cancellable, error);
 
  if (!res)
@@ -5176,6 +5178,7 @@ flatpak_dir_pull_oci (FlatpakDir *self,
  g_autoptr(FlatpakOciImage) image_config = NULL;
  g_autofree char *full_ref = NULL;
  const char *oci_repository = NULL;
+ const char *delta_url = NULL;
  g_autofree char *oci_digest = NULL;
  g_autofree char *checksum = NULL;
  VarRefInfoRef latest_rev_info;
@@ -5196,6 +5199,7 @@ flatpak_dir_pull_oci (FlatpakDir *self,
 
  metadata = var_ref_info_get_metadata (latest_rev_info);
  oci_repository = var_metadata_lookup_string (metadata, "xa.oci-repository", NULL);
+ delta_url = var_metadata_lookup_string (metadata, "xa.delta-url", NULL);
 
  oci_digest = g_strconcat ("sha256:", opt_rev != NULL ? opt_rev : latest_rev, NULL);
 
@@ -5231,7 +5235,7 @@ flatpak_dir_pull_oci (FlatpakDir *self,
 
  g_debug ("Pulling OCI image %s", oci_digest);
 
- checksum = flatpak_pull_from_oci (repo, registry, oci_repository, oci_digest, FLATPAK_OCI_MANIFEST (versioned), image_config,
+ checksum = flatpak_pull_from_oci (repo, registry, oci_repository, oci_digest, delta_url, FLATPAK_OCI_MANIFEST (versioned), image_config,
  state->remote_name, ref, flatpak_flags, oci_pull_progress_cb, progress, cancellable, error);
 
  if (checksum == NULL)

common/flatpak-oci-registry-private.h

@@ -135,6 +135,7 @@ char * flatpak_oci_registry_apply_delta_to_blob (FlatpakOciRegi
 FlatpakOciManifest * flatpak_oci_registry_find_delta_manifest (FlatpakOciRegistry *registry,
  const char *oci_repository,
  const char *for_digest,
+ const char *delta_manifest_uri,
  GCancellable *cancellable);
 
 struct archive *flatpak_oci_layer_writer_get_archive (FlatpakOciLayerWriter *self);

common/flatpak-oci-registry.c

@@ -2001,6 +2001,7 @@ FlatpakOciManifest *
 flatpak_oci_registry_find_delta_manifest (FlatpakOciRegistry *registry,
  const char *oci_repository,
  const char *for_digest,
+ const char *delta_manifest_url,
  GCancellable *cancellable)
 {
  g_autoptr(FlatpakOciVersioned) deltaindexv = NULL;
@@ -2011,6 +2012,36 @@ flatpak_oci_registry_find_delta_manifest (FlatpakOciRegistry *registry,
  return NULL; /* Don't find deltas if we can't apply them */
 #endif
 
+ if (delta_manifest_url != NULL)
+ {
+ g_autoptr(SoupURI) soup_uri = soup_uri_new_with_base (registry->base_uri, delta_manifest_url);
+ g_autofree char *uri_s = soup_uri_to_string (soup_uri, FALSE);
+
+ g_autoptr(GBytes) bytes = flatpak_load_uri (registry->soup_session,
+ uri_s, FLATPAK_HTTP_FLAGS_ACCEPT_OCI,
+ registry->token,
+ NULL, NULL, NULL,
+ cancellable, NULL);
+ if (bytes != NULL)
+ {
+ g_autoptr(FlatpakOciVersioned) versioned =
+ flatpak_oci_versioned_from_json (bytes, FLATPAK_OCI_MEDIA_TYPE_IMAGE_MANIFEST, NULL);
+
+ if (versioned != NULL && G_TYPE_CHECK_INSTANCE_TYPE (versioned, FLATPAK_TYPE_OCI_MANIFEST))
+ {
+ g_autoptr(FlatpakOciManifest) delta_manifest = (FlatpakOciManifest *)g_steal_pointer (&versioned);
+
+ /* We resolved using a mutable location (not via digest), so ensure its still valid for this target */
+ if (delta_manifest->annotations)
+ {
+ const char *target = g_hash_table_lookup (delta_manifest->annotations, "io.github.containers.delta.target");
+ if (g_strcmp0 (target, for_digest) == 0)
+ return g_steal_pointer (&delta_manifest);
+ }
+ }
+ }
+ }
+
  deltaindexv = flatpak_oci_registry_load_versioned (registry, oci_repository, "_deltaindex",
  NULL, NULL, cancellable, NULL);
  if (deltaindexv == NULL)
@@ -2857,6 +2888,7 @@ flatpak_oci_index_make_summary (GFile *index,
  const char *fake_commit;
  guint64 installed_size = 0;
  guint64 download_size = 0;
+ const char *delta_url;
  const char *installed_size_str;
  const char *download_size_str;
  const char *token_type_base64;
@@ -2896,6 +2928,11 @@ flatpak_oci_index_make_summary (GFile *index,
  g_variant_builder_add (ref_metadata_builder, "{sv}", "xa.oci-repository",
  g_variant_new_string (info->repository));
 
+ delta_url = get_image_metadata (image, "io.github.containers.DeltaUrl");
+ if (delta_url)
+ g_variant_builder_add (ref_metadata_builder, "{sv}", "xa.delta-url",
+ g_variant_new_string (delta_url));
+
  g_variant_builder_add_value (refs_builder,
  g_variant_new ("(s(t@ay@a{sv}))", ref,
  (guint64) 0,

common/flatpak-utils-private.h

@@ -535,6 +535,7 @@ char * flatpak_pull_from_oci (OstreeRepo *repo,
  FlatpakOciRegistry *registry,
  const char *oci_repository,
  const char *digest,
+ const char *delta_url,
  FlatpakOciManifest *manifest,
  FlatpakOciImage *image_config,
  const char *remote,
@@ -551,6 +552,7 @@ gboolean flatpak_mirror_image_from_oci (FlatpakOciRegistry *dst_registry,
  const char *digest,
  const char *remote,
  const char *ref,
+ const char *delta_url,
  OstreeRepo *repo,
  FlatpakOciPullProgress progress_cb,
  gpointer progress_data,

common/flatpak-utils.c

@@ -5630,6 +5630,7 @@ flatpak_mirror_image_from_oci (FlatpakOciRegistry *dst_registry,
  const char *digest,
  const char *remote,
  const char *ref,
+ const char *delta_url,
  OstreeRepo *repo,
  FlatpakOciPullProgress progress_cb,
  gpointer progress_user_data,
@@ -5687,7 +5688,7 @@ flatpak_mirror_image_from_oci (FlatpakOciRegistry *dst_registry,
  (old_state == OSTREE_REPO_COMMIT_STATE_NORMAL) &&
  ostree_repo_read_commit (repo, old_checksum, &old_root, NULL, NULL, NULL))
  {
- delta_manifest = flatpak_oci_registry_find_delta_manifest (registry, oci_repository, digest, cancellable);
+ delta_manifest = flatpak_oci_registry_find_delta_manifest (registry, oci_repository, digest, delta_url, cancellable);
  if (delta_manifest)
  {
  VarMetadataRef commit_metadata = var_commit_get_metadata (var_commit_from_gvariant (old_commit));
@@ -5774,6 +5775,7 @@ flatpak_pull_from_oci (OstreeRepo *repo,
  FlatpakOciRegistry *registry,
  const char *oci_repository,
  const char *digest,
+ const char *delta_url,
  FlatpakOciManifest *manifest,
  FlatpakOciImage *image_config,
  const char *remote,
@@ -5856,7 +5858,7 @@ flatpak_pull_from_oci (OstreeRepo *repo,
  (old_state == OSTREE_REPO_COMMIT_STATE_NORMAL) &&
  ostree_repo_read_commit (repo, old_checksum, &old_root, NULL, NULL, NULL))
  {
- delta_manifest = flatpak_oci_registry_find_delta_manifest (registry, oci_repository, digest, cancellable);
+ delta_manifest = flatpak_oci_registry_find_delta_manifest (registry, oci_repository, digest, delta_url, cancellable);
  if (delta_manifest)
  {
  VarMetadataRef commit_metadata = var_commit_get_metadata (var_commit_from_gvariant (old_commit));

system-helper/flatpak-system-helper.c

@@ -605,7 +605,7 @@ handle_deploy (FlatpakSystemHelper *object,
  return TRUE;
  }
 
- checksum = flatpak_pull_from_oci (flatpak_dir_get_repo (system), registry, NULL, desc->parent.digest, FLATPAK_OCI_MANIFEST (versioned), image_config,
+ checksum = flatpak_pull_from_oci (flatpak_dir_get_repo (system), registry, NULL, desc->parent.digest, NULL, FLATPAK_OCI_MANIFEST (versioned), image_config,
  arg_origin, arg_ref, FLATPAK_PULL_FLAGS_NONE, NULL, NULL, NULL, &error);
  if (checksum == NULL)
  {