glance api v2 cannot check image checksum

[YaoZheng_ZTE]

Issue:

I cannot create an image by Glance V2 API, specifying parameter "checksum".
the checksum is important for user, will can be used to check the integrity of the image.
but now, the glance V2 API in create image interface cannot specifying parameter "checksum", and can not check the 'checksum'.

[wangxiyuan (wangxiyuan)]

Glance v2 use signing verification now:

http://review.openstack.org/#/c/183137

[Kairat Kushaev (kkushaev)]

Glance does have out-of-the box parameter 'checksum'. I guess that's why you cannot create the custom parameter with the same name. Just execute glance image-show <image ID> and you will see the checksum here:
+------------------+--------------------------------------+
| Property | Value |
+------------------+--------------------------------------+
| checksum | eb9139e4942121f22bbc2afc0400b2a4 |
| container_format | ami |
| created_at | 2015-12-10T10:52:43Z |
| disk_format | ami |
| id | b3eb6179-43f6-4956-8ed3-010e03bccd83 |
| kernel_id | 1f9fb6bc-b3b0-47d7-8160-633a88a893e9 |
| min_disk | 0 |
| min_ram | 0 |
| name | cirros-0.3.4-x86_64-uec |
| owner | c838177f128c4defa5fe6a6d5b1da48c |
| protected | False |
| ramdisk_id | 349095ef-002e-4001-b033-1fe21ac1ad44 |
| size | 25165824 |
| status | active |
| tags | [] |
| updated_at | 2015-12-10T10:52:44Z |
| virtual_size | None |
| visibility | public |
+------------------+--------------------------------------+
Does it satisfy your goals?
If not please re-open an issue and provide more details about, we will try to help you.
Now I am marking this as Invalid.

[Stuart McLaren (stuart-mclaren)]

I've changed this back to 'new'.

Looking at https://wiki.openstack.org/wiki/Glance-v2-v1-client-compatability

I think the issue is that if you already know the checksum of your image there is no way to supply that in advance when using v2.

It would be possible to implement this client side so that this command:

 $ glance image-create --checksum 123abc --file /tmp/myimage

would error if the checksum calculated by the server didn't match the one provided by the client.

Would that be an ok fix? (Or is your concern something else?)

[YaoZheng_ZTE (zheng-yao1)]

Hi stuart-maclaren:
   I totally agree with you! the "checksum" is important for user. but now, the V2 has no way to supply the parameter.
   and the V2 api process does not provide a mechanism for verifying checksum.

[wangxiyuan (wangxiyuan)]

In v1, if the image's checksum is not equal to the checksum which users provide, the image will be killed.

But in v2. we create an image with two steps: create a queued image, then upload the data.

At client view, when use
  $ glance image-create --checksum 123abc --file /tmp/myimage
the image should be killed to keep the same with v1.

But if a user take two steps to do image-create. Maybe there is a problems:
image-upload should support checksum input. if the checksum is a wrong one. should the image be killed? At least IMO, the queued image should not be deleted. If so, it will be different from v1.

Maybe we should be cautious to introduce checksum into v2.

[Niall Bunting (niall-bunting)]

The fact that we have two steps in v2. Would make it easier to implement checksum checking? As in the first step we could set the checksum then when adding the data we would then check that checksum.

However your comment brings up an interesting conflict between the versions. If you set a checksum when creating the image in v1. However do glance image-upload using v2 the checksum is ignored and overwritten.

Should v2 be overwriting checksums if it already exists?

[YaoZheng_ZTE (zheng-yao1)]

Changed in glance:
status: New → Confirmed
assignee: nobody → YaoZheng_ZTE (zheng-yao1)