Fix mediaType in config for track bundle

[mmorhun]

User description

A command like

ec track bundle --freshen --bundle <bundle> --input oci:<trust-bundle>

produces and OCI image with the following manifest:

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.unknown.config.v1+json",
    "size": 467,
    "digest": "sha256:b1d034b3d9773504ede9ca5008933b290824fdf3ce2b52067f72f614fee8f517"
  },
  "layers": [
    {
      "mediaType": "application/vnd.cncf.openpolicyagent.data.layer.v1+json",
      "size": 397,
      "digest": "sha256:515c2845b43250e4b4eaea11d56a36cfae19db779030c5d8a040d21859a8f911",
      "annotations": {
        "org.opencontainers.image.title": "data/data/trusted_tekton_tasks.yml"
      }
    }
  ]
}

Note, config.mediaType is application/vnd.unknown.config.v1+json which cause many tools (podman, docker, scopeo, etc.) to refuse to work with such a bundle, e.g.

$ skopeo inspect docker://quay.io/redhat-user-workloads/mmorhun-tenant/main-component@sha256:39d176ed46745dd18f817ecb538ad6b93c16856a3719604cc75bf4646c508548
FATA[0001] unsupported image-specific operation on artifact with type "application/vnd.unknown.config.v1+json" 

With the fix applied:

$ skopeo inspect --no-tags docker://quay.io/redhat-user-workloads/mmorhun-tenant/main-component@sha256:88af899480338819ab2e9591ecb0e9abb5285a3da061441fb1d925d68c95562e
{
    "Name": "quay.io/redhat-user-workloads/mmorhun-tenant/main-component",
    "Digest": "sha256:88af899480338819ab2e9591ecb0e9abb5285a3da061441fb1d925d68c95562e",
    "RepoTags": [],
    "Created": "0001-01-01T00:00:00Z",
    "DockerVersion": "",
    "Labels": null,
    "Architecture": "",
    "Os": "",
    "Layers": [
        "sha256:dac62e1353dc29da1111368f28b0f3cbcffd945b1eb7a6b8b8be1969d56a54c3"
    ],
    "LayersData": [
        {
            "MIMEType": "application/vnd.cncf.openpolicyagent.data.layer.v1+json",
            "Digest": "sha256:dac62e1353dc29da1111368f28b0f3cbcffd945b1eb7a6b8b8be1969d56a54c3",
            "Size": 149,
            "Annotations": {
                "org.opencontainers.image.title": "data/data/trusted_tekton_tasks.yml"
            }
        }
    ],
    "Env": null
}

and the manifest is the following:

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "size": 487,
    "digest": "sha256:86ecabfecfb19ef534a32f7591ead91f1659fce2772b5a1d28c2fbee6bf5892b"
  },
  "layers": [
    {
      "mediaType": "application/vnd.cncf.openpolicyagent.data.layer.v1+json",
      "size": 149,
      "digest": "sha256:dac62e1353dc29da1111368f28b0f3cbcffd945b1eb7a6b8b8be1969d56a54c3",
      "annotations": {
        "org.opencontainers.image.title": "data/data/trusted_tekton_tasks.yml"
      }
    }
  ]
}

---

PR Type

Bug fix

---

Description

• Replace incorrect application/vnd.unknown.config.v1+json with standard OCI config mediaType

• Use types.OCIConfigJSON constant for proper OCI image compatibility

• Fix affects track bundle creation in both main code and tests

---

Diagram Walkthrough

flowchart LR
  A["unknownConfig constant<br/>vnd.unknown.config.v1+json"] -->|removed| B["types.OCIConfigJSON<br/>vnd.oci.image.config.v1+json"]
  B -->|enables| C["OCI tool compatibility<br/>skopeo, podman, docker"]

Loading

File Walkthrough

	Relevant files
Bug fix	image.go Replace unknown config mediaType with OCI standard              acceptance/image/image.go Removed unknownConfig constant definition Updated createAndPushPolicyBundle to use types.OCIConfigJSON instead of unknownConfig +1/-2      oci.go Replace unknown config mediaType with OCI standard              internal/tracker/oci.go Removed unknownConfig constant definition Updated PushImage function to use types.OCIConfigJSON instead of unknownConfig +1/-2
Tests	oci_test.go Update test to use correct OCI config mediaType                    internal/tracker/oci_test.go Updated TestPullImage test to use types.OCIConfigJSON instead of unknownConfig +1/-1

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

No code suggestions found for the PR.

[simonbaird]

Seems reasonable to me.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	55.36% <100.00%> (ø)
generative	18.59% <0.00%> (ø)
integration	27.61% <100.00%> (ø)
unit	68.34% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/tracker/oci.go	82.45% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robnester-rh]

/ok-to-test