Merge pull request #31125 from thaJeztah/fix-TestPullFailsWithAlteredLayer

fix TestPullFailsWithAlteredLayer
Upstream-commit: 95a2aed95ef9381c9e0740643422edbe7684d5af
Component: engine

components/engine/integration-cli/docker_cli_by_digest_test.go

@@ -31,7 +31,10 @@ func setupImage(c *check.C) (digest.Digest, error) {
 func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) {
 	containerName := "busyboxbydigest"
 
-	dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox")
+	// new file is committed because this layer is used for detecting malicious
+	// changes. if this was committed as empty layer it would be skipped on pull
+	// and malicious changes would never be detected.
+	dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox", "touch", "anewfile")
 
 	// tag the image to upload it to the private registry
 	repoAndTag := repoName + ":" + tag