addressing more comments

registry/extension/oras/artifactservice.go

@@ -28,6 +28,7 @@ type referrersHandler struct {
 }
 
 const createAnnotationName = "io.cncf.oras.artifact.created"
+const createAnnotationTimestampFormat = time.RFC3339
 
 func (h *referrersHandler) Referrers(ctx context.Context, revision digest.Digest, artifactType string) ([]artifactv1.Descriptor, error) {
 	dcontext.GetLogger(ctx).Debug("(*manifestStore).Referrers")
@@ -91,8 +92,8 @@ func (h *referrersHandler) Referrers(ctx context.Context, revision digest.Digest
 
 	// sort the list of descriptors that contain the created annotation
 	sort.Slice(referrersSorted, func(i, j int) bool {
-		firstElem, _ := time.Parse(time.RFC3339, referrersSorted[i].Annotations[createAnnotationName])
-		secondElem, _ := time.Parse(time.RFC3339, referrersSorted[j].Annotations[createAnnotationName])
+		firstElem, _ := time.Parse(createAnnotationTimestampFormat, referrersSorted[i].Annotations[createAnnotationName])
+		secondElem, _ := time.Parse(createAnnotationTimestampFormat, referrersSorted[j].Annotations[createAnnotationName])
 		// most recent artifact first
 		return firstElem.After(secondElem)
 	})

registry/extension/oras/referrers.go

@@ -40,7 +40,13 @@ func (h *referrersHandler) getReferrers(w http.ResponseWriter, r *http.Request)
 	nextToken := r.FormValue("nextToken")
 	nextTokenMap := make(map[string]string)
 	if nextToken != "" {
-		nextTokenList := strings.Split(nextToken, ",")
+		// base64 decode nextToken to string
+		nextTokenDecoded, err := base64.RawURLEncoding.DecodeString(nextToken)
+		if err != nil {
+			h.extContext.Errors = append(h.extContext.Errors, v2.ErrorCodeMalformedNextToken.WithDetail("nextToken base64 decoding failed"))
+			return
+		}
+		nextTokenList := strings.Split(string(nextTokenDecoded), ",")
 		for _, token := range nextTokenList {
 			_, err := digest.Parse(token)
 			if err != nil {
@@ -96,7 +102,7 @@ func (h *referrersHandler) getReferrers(w http.ResponseWriter, r *http.Request)
 			referrers = referrers[startIndex:]
 		} else {
 			referrers = referrers[startIndex:(startIndex + nPage)]
-			// generate string list of digests for nextToken
+			// nextToken is a base64 encoded comma-seperated string of the digests of the last three referrers in the response
 			var nextDgsts []string
 			for i := nPage - 1; i >= nPage-minPageSize; i-- {
 				nextDgsts = append(nextDgsts, referrers[i].Digest.String())
@@ -127,12 +133,12 @@ func generateLinkHeader(repoName, subjectDigest, artifactType string, lastDigest
 	url := fmt.Sprintf("/v2/%s/_oras/artifacts/referrers?digest=%s&nextToken=%s",
 		repoName,
 		subjectDigest,
-		strings.Join(lastDigests, ","))
+		base64.RawURLEncoding.EncodeToString([]byte(strings.Join(lastDigests, ","))))
 	if artifactType != "" {
 		url = fmt.Sprintf("%s&artifactType=%s", url, artifactType)
 	}
 	if nPage > 0 {
 		url = fmt.Sprintf("%s&n=%d", url, nPage)
 	}
-	return base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("<%s>; rel=\"next\"", url)))
+	return fmt.Sprintf("<%s>; rel=\"next\"", url)
 }

registry/handlers/api_test.go

@@ -1298,6 +1298,8 @@ func testReferrersPagination(t *testing.T, env *testEnv,
 
 	// generates expected nextToken based on oldest 3 digests returned
 	expectedNextToken := fmt.Sprintf("%s,%s,%s", expectedDigests[digestIndexOrder[3]], expectedDigests[digestIndexOrder[2]], expectedDigests[digestIndexOrder[1]])
+	// base64 encode expected next token
+	expectedNextToken = base64.RawURLEncoding.EncodeToString([]byte(expectedNextToken))
 	// check Link has correct query parameters and return nextToken link
 	linkURL := checkReferrersLink(t, link, nPage, expectedNextToken, subjectManifestName)
 	// use nextToken link to generate absolute URL for next page request
@@ -1509,13 +1511,8 @@ func TestReferrers(t *testing.T) {
 }
 
 func checkReferrersLink(t *testing.T, urlStr string, numEntries int, nextToken string, subjectName string) url.URL {
-	decodedURLBytes, err := base64.URLEncoding.DecodeString(urlStr)
-	decodedURL := string(decodedURLBytes)
-	if err != nil {
-		t.Fatalf("Base64 decoding failed for nextToken: %v", err)
-	}
 	re := regexp.MustCompile("<(/v2/" + subjectName + "/_oras/artifacts/referrers.*)>; rel=\"next\"")
-	matches := re.FindStringSubmatch(decodedURL)
+	matches := re.FindStringSubmatch(urlStr)
 
 	if len(matches) != 2 {
 		t.Fatalf("Referrer link address response was incorrect")