{"record":{"id":"932438a631268ce6","repo":"goharbor/harbor","slug":"bad-request-932438","errorCode":"BAD_REQUEST","errorMessage":"addition %s isn't supported for %s(manifest version 2)","messagePattern":"addition (.+?) isn't supported for (.+?)\\(manifest version 2\\)","errorType":"validation","errorClass":"lib/errors.Error","httpStatus":400,"severity":"error","filePath":"src/controller/artifact/processor/image/manifest_v2.go","lineNumber":89,"sourceCode":"\t// if the author is null, try to get it from labels:\n\t// https://docs.docker.com/engine/reference/builder/#maintainer-deprecated\n\t// https://github.com/opencontainers/image-spec/blob/main/annotations.md#pre-defined-annotation-keys\n\tauthorlist := []string{\"org.opencontainers.image.authors\", \"maintainer\"}\n\tif len(author) == 0 && len(config.Config.Labels) > 0 {\n\t\tfor _, authorlabel := range authorlist {\n\t\t\tif val, ok := config.Config.Labels[string(authorlabel)]; ok && len(val) > 0 {\n\t\t\t\tauthor = val\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\tartifact.ExtraAttrs[\"author\"] = author\n\treturn nil\n}\n\nfunc (m *manifestV2Processor) AbstractAddition(ctx context.Context, artifact *artifact.Artifact, addition string) (*processor.Addition, error) {\n\tif addition != AdditionTypeBuildHistory {\n\t\treturn nil, errors.New(nil).WithCode(errors.BadRequestCode).\n\t\t\tWithMessagef(\"addition %s isn't supported for %s(manifest version 2)\", addition, ArtifactTypeImage)\n\t}\n\n\tmani, _, err := m.RegCli.PullManifest(artifact.RepositoryName, artifact.Digest)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\t_, content, err := mani.Payload()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tconfig := &v1.Image{}\n\tif err = m.ManifestProcessor.UnmarshalConfig(ctx, artifact.RepositoryName, content, config); err != nil {\n\t\treturn nil, err\n\t}\n\tcontent, err = json.Marshal(config.History)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/controller/artifact/processor/image/manifest_v2.go#L71-L107","documentation":"The schema2 image processor supports a single addition, build_history; AbstractAddition rejects every other addition string that reaches the processor with BadRequest, with '(manifest version 2)' in the message. (Vulnerabilities are served by the scan machinery rather than this processor path.)","triggerScenarios":"GET .../artifacts/{ref}/additions/values (or any addition other than build_history) on a v2/OCI image manifest.","commonSituations":"UI or automation reusing chart-style 'values' calls against images; clients probing one addition name across all artifact types.","solutions":["Request only build_history for image artifacts","Get vulnerability data from the scan results endpoint, not a processor addition","Gate addition calls on the artifact type reported by the API"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func imageAdditionSupported(addition string) bool {\n    return addition == \"build_history\" // only v2 image addition\n}","tryCatchPattern":"if _, err := m.AbstractAddition(ctx, art, addition); err != nil {\n    if errors.IsErr(err, errors.BadRequestCode) && strings.Contains(err.Error(), \"manifest version 2\") {\n        // addition != build_history on an image: skip, use scan endpoints for vulns\n    }\n}","preventionTips":["Request only build_history for images","Use the vulnerability scan API for security data on images","Do not reuse chart addition names against image artifacts"],"tags":["go","harbor","image","additions","bad-request","manifest-v2"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}