Throwaway: measure pulling Kinoite from the mirror vs quay.io; fix tag+digest refs in vendor-images.sh

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/vendor-images.sh

@@ -18,17 +18,21 @@ mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
 export CONTAINERS_REGISTRIES_CONF=/dev/null
 
 for ref in "$@"; do
-  dest="docker://$mirror/${ref%@*}"
+  src="docker://$ref"
+  dest="docker://$mirror/$ref"
+  opts=(--multi-arch system)
   if [[ $ref == *@sha256:* ]]; then
     # Pinned by digest: copy the whole index unchanged, so the digest the
-    # build asks for exists on the mirror.
+    # build asks for exists on the mirror. skopeo refuses a reference with
+    # both a tag and a digest, so read by digest and write by tag.
+    name=${ref%@*}
+    src="docker://${name%:*}@${ref#*@}"
+    dest="docker://$mirror/$name"
     opts=(--multi-arch all --preserve-digests)
-  else
-    opts=(--multi-arch system)
   fi
   echo "::group::$ref"
   # Layers already on the mirror aren't downloaded again.
-  skopeo copy --retry-times 5 "${opts[@]}" "docker://$ref" "$dest" ||
+  skopeo copy --retry-times 5 "${opts[@]}" "$src" "$dest" ||
     echo "::warning::couldn't vendor $ref; builds get the mirror's last copy, or upstream's"
   echo "::endgroup::"
 done

.forgejo/workflows/mirror-oom-test.yml

@@ -0,0 +1,61 @@
+name: "Throwaway: memory of pulling Kinoite from the mirror vs quay.io"
+
+# Run 4 of build.yml had buildah OOM-killed right after pulling
+# kinoite:44 from the forge's mirror/. This measures each process's peak RSS
+# (VmHWM) for the pull and for creating a container from the result, from
+# the mirror and then from quay.io directly. Delete the branch afterwards.
+on:
+  push:
+    branches: [mirror-oom-test]
+
+env:
+  REGISTRY: forge.quinefoundation.com
+  KINOITE: quay.io/fedora-ostree-desktops/kinoite:44
+
+jobs:
+  measure:
+    runs-on: runner-x86-linux
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to the registry
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+      - name: Vendor the digest-pinned images (the fixed script)
+        run: |
+          mapfile -t pinned < <(yq -r '.images[] | select(.name != "kinoite") | "\(.image):\(.tag)@\(.digest)"' image-versions.yml)
+          .forgejo/vendor-images.sh "${pinned[@]}"
+
+      - name: Measure
+        run: |
+          measure() {
+            "$@" & pid=$!; peak=0
+            while kill -0 "$pid" 2>/dev/null; do
+              h=$(awk '/VmHWM/ {print $2}' "/proc/$pid/status" 2>/dev/null)
+              [ -n "$h" ] && [ "$h" -gt "$peak" ] && peak=$h
+              sleep 0.2
+            done
+            wait "$pid"; rc=$?
+            echo "PEAK $((peak / 1024)) MiB, exit $rc: $*"
+          }
+          from() { c=$(buildah from --pull=never "$KINOITE") && buildah rm "$c" >/dev/null; }
+          free -m
+          buildah rmi -f "$KINOITE" || true
+          echo "== from the mirror"
+          measure buildah pull -q "$KINOITE"
+          podman images --digests "$KINOITE"
+          measure from
+          buildah rmi -f "$KINOITE"
+          echo "== from quay.io directly"
+          export CONTAINERS_REGISTRIES_CONF=/dev/null
+          measure buildah pull -q "$KINOITE"
+          podman images --digests "$KINOITE"
+          measure from
+
+      - name: Log out
+        if: always()
+        run: podman logout "$REGISTRY" || true