From 38b3bfcb5efae111bdedb7c558292203f15f5d03 Mon Sep 17 00:00:00 2001 From: Maksim An Date: Fri, 14 Aug 2026 19:24:40 -0700 Subject: [PATCH] fix leaked layer reader which results in deadlock go-containerregistry has a pull limiter and uncompressed layer reader has to be closed. Signed-off-by: Maksim An --- internal/tools/securitypolicy/helpers/helpers.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/tools/securitypolicy/helpers/helpers.go b/internal/tools/securitypolicy/helpers/helpers.go index 90b7fb6c2f..5a66e93fb7 100644 --- a/internal/tools/securitypolicy/helpers/helpers.go +++ b/internal/tools/securitypolicy/helpers/helpers.go @@ -47,8 +47,8 @@ func ComputeLayerHashes(img v1.Image) ([]string, error) { if err != nil { return nil, err } - hashString, err := tar2ext4.ConvertAndComputeRootDigest(r) + _ = r.Close() // release the go-containerregistry pullLimiter if err != nil { return nil, err }