main: return different exit code when an input is not found

This is a proof of concept that shows how we could do a different
exit code in skopeo when an input is not found. The use case is
`osbuild` which uses skopeo to inspect images and it would be
nice to differenciate between an image that is not found and
general skopeo errors (or errors like network issues etc).

I picked exit code (2) for not found because it is also the value
of ENOENT but that is arbitrary and I'm happy to switch to any
other value (we could do `44` as `404` :-) - happy about ideas).

Man page and a test are added.

P.S. I also found that for local images that are not found `ErrNotAnImage`
is returned so the docstring of `storage.ErrNotAnImage` may need
updating (I'm happy to do this separtely if desired).

To reproduce:
```
$ skopeo inspect containers-storage:010101010101
FATA[0000] Error parsing image name "containers-storage:010101010101": reference "[overlay@/media/space/home/egon/.local/share/containers/storage+/run/user/1000/containers]docker.io/library/010101010101:latest" does not resolve to an image ID: identifier is not an image
```

For references (from storage/errors.go):
```
ErrNotAnImage = errors.New("identifier is not an image")
```

Signed-off-by: Michael Vogt <[email protected]>

cmd/skopeo/main.go

@@ -129,6 +129,10 @@ func main() {
 	}
 	rootCmd, _ := createApp()
 	if err := rootCmd.Execute(); err != nil {
+		if isNotFoundImageError(err) {
+			logrus.Error(err)
+			logrus.Exit(2)
+		}
 		logrus.Fatal(err)
 	}
 }

cmd/skopeo/proxy.go

@@ -73,7 +73,6 @@ import (
 
 	"github.com/containers/image/v5/image"
 	"github.com/containers/image/v5/manifest"
-	ocilayout "github.com/containers/image/v5/oci/layout"
 	"github.com/containers/image/v5/pkg/blobinfocache"
 	"github.com/containers/image/v5/transports"
 	"github.com/containers/image/v5/transports/alltransports"
@@ -229,15 +228,6 @@ func isDockerManifestUnknownError(err error) bool {
 	return ec.ErrorCode() == dockerdistributionapi.ErrorCodeManifestUnknown
 }
 
-// isNotFoundImageError heuristically attempts to determine whether an error
-// is saying the remote source couldn't find the image (as opposed to an
-// authentication error, an I/O error etc.)
-// TODO drive this into containers/image properly
-func isNotFoundImageError(err error) bool {
-	return isDockerManifestUnknownError(err) ||
-		errors.Is(err, ocilayout.ImageNotFoundError{})
-}
-
 func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (retReplyBuf replyBuf, retErr error) {
 	h.lock.Lock()
 	defer h.lock.Unlock()

cmd/skopeo/utils.go

@@ -12,9 +12,11 @@ import (
 	"github.com/containers/common/pkg/retry"
 	"github.com/containers/image/v5/directory"
 	"github.com/containers/image/v5/manifest"
+	ocilayout "github.com/containers/image/v5/oci/layout"
 	"github.com/containers/image/v5/pkg/compression"
 	"github.com/containers/image/v5/transports/alltransports"
 	"github.com/containers/image/v5/types"
+	"github.com/containers/storage"
 	imgspecv1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -406,3 +408,13 @@ func promptForPassphrase(privateKeyFile string, stdin, stdout *os.File) (string,
 	fmt.Fprintf(stdout, "\n")
 	return string(passphrase), nil
 }
+
+// isNotFoundImageError heuristically attempts to determine whether an error
+// is saying the remote source couldn't find the image (as opposed to an
+// authentication error, an I/O error etc.)
+// TODO drive this into containers/image properly
+func isNotFoundImageError(err error) bool {
+	return isDockerManifestUnknownError(err) ||
+		errors.Is(err, storage.ErrNotAnImage) ||
+		errors.Is(err, ocilayout.ImageNotFoundError{})
+}

docs/skopeo.1.md

@@ -123,6 +123,13 @@ Print the version number
   Default directory containing registry configuration, if **--registries.d** is not specified.
   The contents of this directory are documented in [containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md).
 
+## EXIT STATUS
+`skopeo` exists with status 0 if the operation was successfully. Error result
+in a non-zero exit code. If the input image cannot be found an exit status of
+2 is returned. Note that this is best effort and for remote registries the
+status often cannot be reliably reported.
+
+
 ## SEE ALSO
 skopeo-login(1), docker-login(1), containers-auth.json(5), containers-storage.conf(5), containers-policy.json(5), containers-transports(5)
 

systemtest/010-inspect.bats

@@ -129,4 +129,11 @@ END_EXPECT
     expect_output --from="$repo_tags" "" "inspect --no-tags was expected to return empty RepoTags[]"
 }
 
+@test "inspect: image unknown" {
+    # non existing image
+    run_skopeo 2 inspect containers-storage:non-existing-tag
+    expect_output --substring "identifier is not an image" \
+		  "skopeo inspect containers-storage:010101010101"
+}
+
 # vim: filetype=sh

systemtest/060-delete.bats

@@ -24,7 +24,7 @@ function setup() {
     run_skopeo delete --tls-verify=false $localimg
 
     # make sure image is removed from registry
-    expected_rc=1
+    expected_rc=2
     run_skopeo $expected_rc inspect --tls-verify=false $localimg
 }