goharbor/harbor · error · lib/errors.Error

BAD_REQUEST

BAD_REQUEST

Error message

addition %s isn't supported for %s(manifest version 2)

What it means

The schema2 image processor supports a single addition, build_history; AbstractAddition rejects every other addition string that reaches the processor with BadRequest, with '(manifest version 2)' in the message. (Vulnerabilities are served by the scan machinery rather than this processor path.)

Source

Thrown at src/controller/artifact/processor/image/manifest_v2.go:89

	// if the author is null, try to get it from labels:
	// https://docs.docker.com/engine/reference/builder/#maintainer-deprecated
	// https://github.com/opencontainers/image-spec/blob/main/annotations.md#pre-defined-annotation-keys
	authorlist := []string{"org.opencontainers.image.authors", "maintainer"}
	if len(author) == 0 && len(config.Config.Labels) > 0 {
		for _, authorlabel := range authorlist {
			if val, ok := config.Config.Labels[string(authorlabel)]; ok && len(val) > 0 {
				author = val
				break
			}
		}
	}
	artifact.ExtraAttrs["author"] = author
	return nil
}

func (m *manifestV2Processor) AbstractAddition(ctx context.Context, artifact *artifact.Artifact, addition string) (*processor.Addition, error) {
	if addition != AdditionTypeBuildHistory {
		return nil, errors.New(nil).WithCode(errors.BadRequestCode).
			WithMessagef("addition %s isn't supported for %s(manifest version 2)", addition, ArtifactTypeImage)
	}

	mani, _, err := m.RegCli.PullManifest(artifact.RepositoryName, artifact.Digest)
	if err != nil {
		return nil, err
	}
	_, content, err := mani.Payload()
	if err != nil {
		return nil, err
	}
	config := &v1.Image{}
	if err = m.ManifestProcessor.UnmarshalConfig(ctx, artifact.RepositoryName, content, config); err != nil {
		return nil, err
	}
	content, err = json.Marshal(config.History)
	if err != nil {
		return nil, err

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Request only build_history for image artifacts
2. Get vulnerability data from the scan results endpoint, not a processor addition
3. Gate addition calls on the artifact type reported by the API

func imageAdditionSupported(addition string) bool {
    return addition == "build_history" // only v2 image addition
}

if _, err := m.AbstractAddition(ctx, art, addition); err != nil {
    if errors.IsErr(err, errors.BadRequestCode) && strings.Contains(err.Error(), "manifest version 2") {
        // addition != build_history on an image: skip, use scan endpoints for vulns
    }
}

When it happens

Trigger: GET .../artifacts/{ref}/additions/values (or any addition other than build_history) on a v2/OCI image manifest.

Common situations: UI or automation reusing chart-style 'values' calls against images; clients probing one addition name across all artifact types.

Related errors

• BAD_REQUEST
• BAD_REQUEST
• BAD_REQUEST
• BAD_REQUEST
• BAD_REQUEST

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/932438a631268ce6. Report an issue: GitHub.