Evan JarrettandClaude Opus 5 1b917686b2 appview: support OCI manifest DELETE ...

DELETE /v2/<name>/manifests/<ref> answered UNSUPPORTED before ever
reaching the ATProto-backed stores: distribution v3.1.1's DeleteManifest
handler short-circuits unless app.deleteEnabled is set, which comes from
storage.delete.enabled. Set it (mirrored in the test harness). The
companion storage.EnableDelete option it appends only affects
distribution's built-in store, which RoutingRepository replaces, so it is
a no-op for us.

With the route reachable, make the stores do the right thing:

  - ManifestStore.Delete purges the hold's per-layer, scan and image
    config records on a detached context, since the DELETE handler
    returns immediately and cancels the request context.
  - TagStore.Untag resolves the digest before deleting the tag record,
    then deletes the manifest if that was its last tag and it is not a
    manifest list child, matching the web UI's delete-tag behavior so
    deleting an only-tagged image doesn't orphan the manifest.
  - cleanupUntaggedManifest becomes package-level over *RegistryContext
    so both stores share one implementation.
  - purgeOnHold moves out of handlers into pkg/appview/holdpurge so the
    storage layer can call it: handlers already depends on storage via
    middleware, so storage to handlers would be an import cycle.
  - ProxyBlobStore.Delete returns distribution.ErrUnsupported, so the
    always-registered blob DELETE route gives a clean OCI UNSUPPORTED
    error instead of a generic 500. Layer bytes are reclaimed by the
    hold's refcounted GC.

The cascade's still-tagged re-check pages through the tag records rather
than reading a single capped page. Tags for all of a user's repositories
share one collection, so one page is a per-account budget: past ~100 tags
a live tag fell off the end and the manifest was deleted while still
referenced. Incomplete enumeration now skips the delete, since an
orphaned manifest is recoverable and a deleted live one is not.

This also makes the over-quota delete grant added in 6e426dc load-bearing:
it hands out pull,delete tokens, which could not do anything while
distribution rejected every DELETE.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-09 20:54:50 -05:00

..

purge.go

appview: support OCI manifest DELETE

2026-08-09 20:54:50 -05:00