From 45a4c04ffe47a1b3b9e9a7f09179daaa93963deb Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 31 Aug 2026 23:29:55 +0500 Subject: [PATCH] chore(image): give the rust recipe its own immutable alias #315 changed what the image contains and left every alias where it was, so the build refused: b18 already exists and points at the promoted image, with the previous recipe digest recorded on it. That refusal is the immutability contract working. An alias names one set of bytes, and reusing it for a different recipe would make the estate's audit describe an image that no longer exists under that name. All four aliases advance together -- container b18 to b19, container integration b11 to b12, integration b14 to b15, standard b15 to b16 -- so a later rebuild of any variant does not hit the same refusal one at a time. The two pinned fingerprints move with them. --- config/golden-image-container-integration.yaml | 2 +- config/golden-image-container.yaml | 2 +- config/golden-image-integration.yaml | 2 +- config/golden-image.yaml | 2 +- internal/imagebuild/orchestrator_test.go | 2 +- internal/imagemanifest/manifest_test.go | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/golden-image-container-integration.yaml b/config/golden-image-container-integration.yaml index 71a35a8..15b42de 100644 --- a/config/golden-image-container-integration.yaml +++ b/config/golden-image-container-integration.yaml @@ -2,7 +2,7 @@ schema_version: 1 image: type: container - alias: nddev-u24-amd64-ctr-docker-runner-2.336.0-r20260801-b11 + alias: nddev-u24-amd64-ctr-docker-runner-2.336.0-r20260801-b12 current_alias: nddev-ubuntu-24.04-amd64-container-docker-current previous_alias: nddev-ubuntu-24.04-amd64-container-docker-previous source_alias: nddev-source-ubuntu-24.04-amd64-container-r20260801 diff --git a/config/golden-image-container.yaml b/config/golden-image-container.yaml index 4fcd1de..8730eb7 100644 --- a/config/golden-image-container.yaml +++ b/config/golden-image-container.yaml @@ -2,7 +2,7 @@ schema_version: 1 image: type: container - alias: nddev-ubuntu-24.04-amd64-container-runner-2.336.0-r20260801-b18 + alias: nddev-ubuntu-24.04-amd64-container-runner-2.336.0-r20260801-b19 current_alias: nddev-ubuntu-24.04-amd64-container-current previous_alias: nddev-ubuntu-24.04-amd64-container-previous source_alias: nddev-source-ubuntu-24.04-amd64-container-r20260801 diff --git a/config/golden-image-integration.yaml b/config/golden-image-integration.yaml index 582cf73..b4f603b 100644 --- a/config/golden-image-integration.yaml +++ b/config/golden-image-integration.yaml @@ -1,7 +1,7 @@ schema_version: 1 image: - alias: nddev-ubuntu-24.04-amd64-docker-runner-2.336.0-r20260801-b14 + alias: nddev-ubuntu-24.04-amd64-docker-runner-2.336.0-r20260801-b15 current_alias: nddev-ubuntu-24.04-amd64-docker-current previous_alias: nddev-ubuntu-24.04-amd64-docker-previous source_alias: nddev-source-ubuntu-24.04-amd64-r20260801 diff --git a/config/golden-image.yaml b/config/golden-image.yaml index 28cb180..fe989fe 100644 --- a/config/golden-image.yaml +++ b/config/golden-image.yaml @@ -1,7 +1,7 @@ schema_version: 1 image: - alias: nddev-ubuntu-24.04-amd64-runner-2.336.0-r20260801-b15 + alias: nddev-ubuntu-24.04-amd64-runner-2.336.0-r20260801-b16 current_alias: nddev-ubuntu-24.04-amd64-current previous_alias: nddev-ubuntu-24.04-amd64-previous source_alias: nddev-source-ubuntu-24.04-amd64-r20260801 diff --git a/internal/imagebuild/orchestrator_test.go b/internal/imagebuild/orchestrator_test.go index 41017f8..397aebe 100644 --- a/internal/imagebuild/orchestrator_test.go +++ b/internal/imagebuild/orchestrator_test.go @@ -164,7 +164,7 @@ func TestRecipeFingerprintIsDeterministic(t *testing.T) { // alias is part of the recipe, so a manifest whose contents changed under an // unchanged alias would otherwise ask the builder to produce different bytes // for a name that is already promoted. - if first != "sha256:43872591ca0e452ea67560b23710650e34ba02b301ba26a35a72ddf1ac195e69" { + if first != "sha256:3d89d31c7c5a423238a6888b2b4c4d894f22fcb91e0d6ea76fd689d0c5a09b9b" { t.Fatalf("deployed standard recipe fingerprint drifted: %q", first) } smoke, err := SmokeFingerprint(plan) diff --git a/internal/imagemanifest/manifest_test.go b/internal/imagemanifest/manifest_test.go index 385c5be..52bea66 100644 --- a/internal/imagemanifest/manifest_test.go +++ b/internal/imagemanifest/manifest_test.go @@ -42,7 +42,7 @@ func TestRepositoryManifestIsValidAndPinned(t *testing.T) { if !strings.HasPrefix(fingerprint, "sha256:") || len(fingerprint) != len("sha256:")+64 { t.Fatalf("unexpected fingerprint %q", fingerprint) } - if fingerprint != "sha256:5642f1d18e9c8d0b8dc2d1a6e768fe5e5d834636946af61e39cc4666d1385329" { + if fingerprint != "sha256:02591ff082938633b0435312ef80f7a397021f80fe155fa62ece7cc6026e8e70" { t.Fatalf("standard manifest fingerprint drifted: %q", fingerprint) } }