container/build: write the pushed digest to plan data

Miroslav Vadkertirequested to merge
container-build-digestfile into main

With ENABLE_PUSH, /container/build now passes --digestfile to buildah manifest push and writes the digest of the pushed manifest list to $TMT_PLAN_DATA/target-image.digest. The test logs the digest too.

A finish step can sign that exact digest. Today csb-community/csb-image-mode resolves TARGET_IMAGE from the registry after the push, and a parallel run may have moved the tag by then. The cosign signing MR there will read this file and fail when it is missing.

Tags from IMAGE_TAGS don't touch the file. It always holds the digest of TARGET_IMAGE.

A local buildah manifest push --digestfile to an oci: directory wrote the same digest as the sha256 of the pushed index. The CI job runs without ENABLE_PUSH, so it does not cover this line.

Commits

  • d20e3f6a (container/build: write the pushed digest to plan data)

Generated-by: Claude Code

Edited by Miroslav Vadkerti

Merge request reports