From b83979d17427575b38f9d8b569020f0a6098c54e Mon Sep 17 00:00:00 2001 From: OpenShift CI Bot Date: Wed, 22 Jul 2026 09:57:47 +0000 Subject: [PATCH] fix(bootstrap): limit jq RepoDigests filter to first match When the release image has been pulled from multiple registries, podman inspect returns multiple RepoDigests with the same digest. The jq filter returned all matches as a multi-line string, which was assigned to RELEASE_IMAGE_DIGEST. Downstream consumers like crio-configure.sh then passed this invalid multi-line reference to podman run, causing "invalid reference format" errors that blocked bootkube.service and failed the entire cluster bootstrap. Wrap the jq filter with first() so only one RepoDigest is returned, regardless of how many registries have cached the image. Co-Authored-By: Claude Opus 4.6 --- .../bootstrap/files/usr/local/bin/release-image.sh.template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/data/bootstrap/files/usr/local/bin/release-image.sh.template b/data/data/bootstrap/files/usr/local/bin/release-image.sh.template index f652b43ca84..0dd068c6467 100755 --- a/data/data/bootstrap/files/usr/local/bin/release-image.sh.template +++ b/data/data/bootstrap/files/usr/local/bin/release-image.sh.template @@ -4,7 +4,7 @@ # Convert the release image pull spec to an "absolute" form if a digest is available # Multi Release Payloads have 2 RepoDigests, we need the one that matches the Digest. -if ! RELEASE_IMAGE_DIGEST=$( podman inspect {{.ReleaseImage}} --format json | jq -r '.[].Digest as $digest | .[].RepoDigests[] | select(contains($digest))' ) || [[ -z "${RELEASE_IMAGE_DIGEST}" ]]; then +if ! RELEASE_IMAGE_DIGEST=$( podman inspect {{.ReleaseImage}} --format json | jq -r 'first(.[].Digest as $digest | .[].RepoDigests[] | select(contains($digest)))' ) || [[ -z "${RELEASE_IMAGE_DIGEST}" ]]; then echo "Warning: Could not resolve release image to pull by digest" 2>&1 RELEASE_IMAGE_DIGEST="{{.ReleaseImage}}" fi