Offer alternative mirror for registry.suse.com

[prabhu]

We are getting 500 errors for registry.suse.com. We are also seeing images where nodejs20, npm20, gcc12 etc have simply vanished indicating possible issues with the package feeds. Do you offer any alternative registry mirrors? Also what is the best way to access the sha256 hashes for the images in your registry?

[prabhu]

Any ETA for the registry issues? Or could you share any alternative support channels to track the issue?

[msmeissn]

this is not monitored on the weekend.

[prabhu]

Any exceptions? It is unfortunately serving the old SP4 images with vulnerabilities for all unsuspecting users.

[msmeissn]

i emailed the respective team, lets see if someone can pick it up

[msmeissn]

bug was fixed, registry pieces are currently being repopulated. this can take some hours :/

[prabhu]

Thank you so much! Is there any plans to publish an RCA and actions to prevent this (SP5 - SP4 downgrade) from happening in the future?

[prabhu]

I noticed that a number of images were restored yesterday. Thank you so much! I have a suspicion that the hashes published on the website do not match the output from docker inspect command. I found this with a couple of openjdk-devel images. Happy to retest later this week once things are fully restored.

[dirkmueller]

We have written up a RCA and will publish this shortly. currently trying to determine the most appropriate place.

[dirkmueller]

Published here under #25 for now. We will find a more permanent spot and also consider the input to provide a redundancy mirror.