sanitize oci tag

Author: QaidVoid

sbuild/src/ghcr.rs

@@ -214,7 +214,27 @@ pub fn ghcr_path(
     )
 }
 
+/// Sanitize a string for use as an OCI tag
+/// OCI tags only allow: [a-zA-Z0-9_.-]
+pub fn sanitize_oci_tag(s: &str) -> String {
+    s.chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || c == '_' || c == '.' || c == '-' {
+                c
+            } else {
+                '-'
+            }
+        })
+        .collect::<String>()
+        // Remove consecutive dashes
+        .split('-')
+        .filter(|s| !s.is_empty())
+        .collect::<Vec<_>>()
+        .join("-")
+}
+
 /// Generate GHCR tag from version and architecture
 pub fn ghcr_tag(version: &str, arch: &str) -> String {
-    format!("{}-{}", version, arch.to_lowercase())
+    let sanitized_version = sanitize_oci_tag(version);
+    format!("{}-{}", sanitized_version, arch.to_lowercase())
 }

sbuild/src/main.rs

@@ -21,7 +21,7 @@ use colored::Colorize;
 use sbuild::{
     builder::Builder,
     checksum,
-    ghcr::{GhcrClient, PackageAnnotations},
+    ghcr::{sanitize_oci_tag, GhcrClient, PackageAnnotations},
     signing::Signer,
     types::SoarEnv,
 };
@@ -607,7 +607,8 @@ async fn post_build_processing(
 
             // Get architecture
             let arch = format!("{}-{}", std::env::consts::ARCH, std::env::consts::OS);
-            let tag = format!("{}-{}", version, arch.to_lowercase());
+            // Sanitize version for OCI tag (removes invalid chars like @)
+            let tag = format!("{}-{}", sanitize_oci_tag(&version), arch.to_lowercase());
 
             // Get pkg_family and recipe_name from recipe URL
             let (pkg_family, recipe_name) = recipe_url