From 11daf5068a36d8e4ba7c346c1ceb34eae35ceeee Mon Sep 17 00:00:00 2001
From: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
Date: Fri, 19 Jun 2026 13:25:11 +0200
Subject: [PATCH] test/apiv2: cover the manifest-create images query param

The libpod manifest-create endpoint takes an "images" query parameter that
fills the new list at creation time, but 15-manifest.at never tested it.
Add cases that create a list with images= on both the v4
(/manifests/{name}, 201) and v3 (/manifests/create, 200) endpoints and
check the image ends up in the list.

Also drop the stale "required: true" from the images query parameter in the
swagger docs - the handler treats it as optional, and the existing create
tests (which omit it) already show that.

Fixes: #22258

Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
---
 pkg/api/server/register_manifest.go |  1 -
 test/apiv2/15-manifest.at           | 34 +++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/pkg/api/server/register_manifest.go b/pkg/api/server/register_manifest.go
index b907ae88fa..57334689b0 100644
--- a/pkg/api/server/register_manifest.go
+++ b/pkg/api/server/register_manifest.go
@@ -120,7 +120,6 @@ func (s *APIServer) registerManifestHandlers(r *mux.Router) error {
 	// - in: query
 	//   name: images
 	//   type: string
-	//   required: true
 	//   description: |
 	//     One or more names of an image or a manifest list. Repeat parameter as needed.
 	//
diff --git a/test/apiv2/15-manifest.at b/test/apiv2/15-manifest.at
index 7d39b2fb03..f166d7196f 100644
--- a/test/apiv2/15-manifest.at
+++ b/test/apiv2/15-manifest.at
@@ -29,6 +29,40 @@ RUN >file2
 EOF
 )
 
+# Create manifest lists and populate them at creation time via the `images`
+# query parameter. This path was previously untested (#22258). `images` may be
+# repeated to add more than one image.
+t POST "/v4.0.0/libpod/manifests/withimage?images=containers-storage:$id_abc_image" 201 \
+    .Id~[0-9a-f]\\{64\\}
+id_withimage=$(jq -r '.Id' <<<"$output")
+t GET /v4.0.0/libpod/manifests/$id_withimage/json 200 \
+    .manifests[0].digest~sha256:[0-9a-f]\\{64\\} \
+    '.manifests | length'=1
+
+# The same parameter is honored by the < 4.0.0 create endpoint, where the
+# success status is 200 instead of 201.
+t POST "/v3.4.0/libpod/manifests/create?name=withimage3&images=containers-storage:$id_xyz_image" 200 \
+    .Id~[0-9a-f]\\{64\\}
+id_withimage3=$(jq -r '.Id' <<<"$output")
+t GET /v4.0.0/libpod/manifests/$id_withimage3/json 200 \
+    .manifests[0].digest~sha256:[0-9a-f]\\{64\\} \
+    '.manifests | length'=1
+
+# Repeating the `images` parameter adds multiple images to the list in a single
+# create call.
+t POST "/v4.0.0/libpod/manifests/withimages?images=containers-storage:$id_abc_image&images=containers-storage:$id_xyz_image" 201 \
+    .Id~[0-9a-f]\\{64\\}
+id_withimages=$(jq -r '.Id' <<<"$output")
+t GET /v4.0.0/libpod/manifests/$id_withimages/json 200 \
+    .manifests[0].digest~sha256:[0-9a-f]\\{64\\} \
+    '.manifests | length'=2
+
+# `images` is optional: the create calls at the top of this file omit it and
+# still succeed, even though the API used to document it as required (#22258).
+t DELETE /v4.0.0/libpod/manifests/$id_withimage 200
+t DELETE /v4.0.0/libpod/manifests/$id_withimages 200
+t DELETE /v4.0.0/libpod/manifests/$id_withimage3 200
+
 # manifest add --annotation tests
 t POST /v3.4.0/libpod/manifests/$id_abc/add images="[\"containers-storage:$id_abc_image\"]" 200
 t PUT /v4.0.0/libpod/manifests/$id_xyz operation='update' images="[\"containers-storage:$id_xyz_image\"]" annotations="{\"foo\":\"bar\"}" annotation="[\"hoge=fuga\"]" 400 \