Fix an NPE when trying to pull a manifest without a legacy image via V1

test/registry/protocol_v1.py

@@ -15,6 +15,7 @@ class V1ProtocolSteps(Enum):
   PUT_TAG = 'put-tag'
   PUT_IMAGE_JSON = 'put-image-json'
   DELETE_TAG = 'delete-tag'
+  GET_TAG = 'get-tag'
   GET_LAYER = 'get-layer'
 
 
@@ -49,6 +50,9 @@ class V1Protocol(RegistryProtocol):
     V1ProtocolSteps.GET_LAYER: {
       Failures.GEO_BLOCKED: 403,
     },
+    V1ProtocolSteps.GET_TAG: {
+      Failures.UNKNOWN_TAG: 404,
+    },
   }
 
   def __init__(self, jwk):
@@ -99,11 +103,18 @@ class V1Protocol(RegistryProtocol):
     image_ids = self.conduct(session, 'GET', prefix + 'tags', headers=headers).json()
 
     for tag_name in tag_names:
+      # GET /v1/repositories/{namespace}/{repository}/tags/<tag_name>
+      image_id_data = self.conduct(session, 'GET', prefix + 'tags/' + tag_name,
+                                   headers=headers,
+                                   expected_status=(200, expected_failure,
+                                                    V1ProtocolSteps.GET_TAG))
+
       if tag_name not in image_ids:
         assert expected_failure == Failures.UNKNOWN_TAG
         return None
 
       tag_image_id = image_ids[tag_name]
+      assert image_id_data.json() == tag_image_id
 
       # Retrieve the ancestry of the tagged image.
       image_prefix = '/v1/images/%s/' % tag_image_id

test/registry/registry_tests.py

@@ -1803,3 +1803,22 @@ def test_push_pull_unicode_direct(pusher, puller, unicode_images, liveserver_ses
   # Pull the repository to verify.
   puller.pull(liveserver_session, 'devtable', 'newrepo', 'latest', unicode_images,
               credentials=credentials, options=options)
+
+
+def test_push_legacy_pull_not_allowed(v22_protocol, v1_protocol, remote_images, liveserver_session,
+                                      app_reloader, data_model):
+  """ Test: Push a V2 Schema 2 manifest and attempt to pull via V1 when there is no assigned legacy
+      image.
+  """
+  if data_model != 'oci_model':
+    return
+
+  credentials = ('devtable', 'password')
+
+  # Push a new repository.
+  v22_protocol.push(liveserver_session, 'devtable', 'newrepo', 'latest', remote_images,
+                    credentials=credentials)
+
+  # Attempt to pull. Should fail with a 404.
+  v1_protocol.pull(liveserver_session, 'devtable', 'newrepo', 'latest', remote_images,
+                   credentials=credentials, expected_failure=Failures.UNKNOWN_TAG)