Repository navigation
Consider ignoring image name annotations by default (default mode cannot be satisfied otherwise) #266
Description
Hi,
Thanks for your work on diffoci!
Please correct me if I'm wrong, but it seems to me that it is not currently possible to use diffoci to verify reproducibility of an image with the default (non --semantic) mode, given the following "paradox":
- It's not possible to store (and therefore compare) two images with the same name.
- It's not possible to have two images with a different name without introducing unavoidable differences in the image name annotations (which
diffociwill complain about).
I'm aware this is more of a Docker issue/limitation, but it's a bit paradoxical to not be able to fully satisfy diffoci from a technical point of view. The --semantic (a.k.a non-strict) mode allows a successful test, but it ignores too many attributes to be a fair representation of reproducibility IMHO. For instance, I was able to fix/normalize timestamps and file ordering (which are ignored with this mode), the unavoidable difference in image name annotations is the only remaining attribute that diffoci reports on my side.
As far as I can tell, the image name annotations are specific to metadata handling in container tooling, and do not affect the actual filesystem contents of the image. As a matter of fact, they do not appear to be part of the hashed object when generating the image digest, as a difference in image name annotations between my two images does not prevent digest equality.
As such, I'd like to suggest ignoring image name annotations by default (not only with --semantic). Assuming that the above observations are correct, it feels a bit weird not being able to satisfy diffoci in non-strict mode for something that is currently unavoidable & cannot be fixed or work around (as opposed to other attributes ignored by the --semantic mode) and that doesn't even go in the way of reproducibility (as far as I can tell).
Alternatively a dedicated flag specifically for image name annotation (whether it is to ignore it or take it into consideration) could eventually be added, rather than bundling it with other attributes in the --semantic flag.
Thanks again for your your work on diffoci and for your consideration!
Activity
AkihiroSuda commentedon Apr 20, 2026
We already have
--ignore-image-nameAntiz96 commentedon Apr 20, 2026
Oopsie... I missed that somehow, sorry 🫣
I guess one could still argue that the fact that it's technically not possible to get a successful run of
diffociby default is a bit "unusual" though. The difference between the "image name" attribute and the other attributes listed in the above--ignore-*options is that this one cannot be addressed currently (as far as I know). That means that one basically have to always run with--ignore-image-name(or eventually accept that differences in image name annotations will always be reported while knowing that nothing can de done about it).That being said, once again, I'm aware that the underlying limitation about not being able to store two images with the same name with
docker/podman(or rename one without introducing unavoidable non-deterministic data in the image name annotations) is not something thatdiffocican do much about at its level. I would totally understand if this ticket gets closed as an "upstream" issue. I'll just use--ignore-image-namefor now 😄cen1 commentedon Sep 29, 2026
I think I am +1 to make
--ignore-image-namethe default, with an option to enable it and some explicit documentation explaining the rationale.The only negative I see is that this breaks existing behavior and there is a chance someone out there relies on the current default in their scripts/pipelines etc. The change could warrant a minor bump to 0.2.