fix(ci): verify GHCR mirror platform digests

Author: terion-labs

.github/scripts/mirror-dhi-image.sh

@@ -1,16 +1,17 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-if [ "$#" -ne 5 ]; then
-  echo "usage: $0 <name> <source-ref> <target-ref> <expected-index-digest> <required-arches>" >&2
+if [ "$#" -ne 6 ]; then
+  echo "usage: $0 <name> <source-ref> <target-ref> <expected-source-index-digest> <expected-target-index-digest|auto> <required-arches>" >&2
   exit 2
 fi
 
 name="$1"
 source_ref="$2"
 target_ref="$3"
-expected_digest="$4"
-required_arches_csv="$5"
+expected_source_digest="$4"
+expected_target_digest="$5"
+required_arches_csv="$6"
 
 tmpdir="$(mktemp -d)"
 trap 'rm -rf "$tmpdir"' EXIT
@@ -25,8 +26,8 @@ target_raw="$tmpdir/target.json"
 echo "::group::inspect source ${name}"
 skopeo inspect --raw "docker://${source_ref}" >"$source_raw"
 source_digest="$(digest_file "$source_raw")"
-if [ "$source_digest" != "$expected_digest" ]; then
-  echo "source digest mismatch for ${name}: expected ${expected_digest}, got ${source_digest}" >&2
+if [ "$source_digest" != "$expected_source_digest" ]; then
+  echo "source digest mismatch for ${name}: expected ${expected_source_digest}, got ${source_digest}" >&2
   exit 1
 fi
 
@@ -46,14 +47,15 @@ echo "source ${name} digest ${source_digest} contains ${required_arches_csv}"
 echo "::endgroup::"
 
 echo "::group::copy ${name}"
-skopeo copy --retry-times 3 --all --preserve-digests "docker://${source_ref}" "docker://${target_ref}"
+skopeo copy --retry-times 3 --all "docker://${source_ref}" "docker://${target_ref}"
 echo "::endgroup::"
 
 echo "::group::verify target ${name}"
 skopeo inspect --raw "docker://${target_ref}" >"$target_raw"
 target_digest="$(digest_file "$target_raw")"
-if [ "$target_digest" != "$expected_digest" ]; then
-  echo "target digest mismatch for ${name}: expected ${expected_digest}, got ${target_digest}" >&2
+echo "target ${name} index digest ${target_digest}"
+if [ "$expected_target_digest" != "auto" ] && [ "$target_digest" != "$expected_target_digest" ]; then
+  echo "target digest mismatch for ${name}: expected ${expected_target_digest}, got ${target_digest}" >&2
   exit 1
 fi
 

.github/workflows/mirror-hardened-images.yml

@@ -29,13 +29,15 @@ jobs:
             source: dhi.io/oauth2-proxy@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e
             target: ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13
             package: terrarium-dhi-oauth2-proxy
-            digest: sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e
+            source_digest: sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e
+            target_digest: auto
             arches: amd64,arm64
           - name: postgres
             source: dhi.io/postgres@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714
             target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips
             package: terrarium-dhi-postgres
-            digest: sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714
+            source_digest: sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714
+            target_digest: auto
             arches: amd64,arm64
     env:
       REGISTRY_AUTH_FILE: /tmp/terrarium-containers-auth.json
@@ -83,7 +85,8 @@ jobs:
           "${{ matrix.name }}"
           "${{ matrix.source }}"
           "${{ matrix.target }}"
-          "${{ matrix.digest }}"
+          "${{ matrix.source_digest }}"
+          "${{ matrix.target_digest }}"
           "${{ matrix.arches }}"
 
       - name: Make GHCR package public when permitted

ansible/roles/idp_zitadel/defaults/main.yml

@@ -15,7 +15,7 @@ terrarium_docker_hardened_images: auto
 terrarium_docker_hardened_image_mirrors: true
 terrarium_zitadel_postgres_image: ""
 terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714"
-terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714"
+terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips"
 terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
 terrarium_zitadel_pat_expiration: "2099-01-01T00:00:00Z"
 terrarium_zitadel_project_name: Terrarium

ansible/roles/oauth2_proxy/defaults/main.yml

@@ -5,7 +5,7 @@ terrarium_docker_hardened_images: auto
 terrarium_docker_hardened_image_mirrors: true
 terrarium_oauth2_proxy_image: ""
 terrarium_oauth2_proxy_image_hardened: "dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
-terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
+terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13"
 terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
 terrarium_oauth2_proxy_uid: "65532"
 terrarium_oauth2_proxy_gid: "65532"

ansible/site.yml

@@ -54,11 +54,11 @@
     terrarium_docker_hardened_image_mirrors: true
     terrarium_oauth2_proxy_image: ""
     terrarium_oauth2_proxy_image_hardened: "dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
-    terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
+    terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13"
     terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
     terrarium_zitadel_postgres_image: ""
     terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714"
-    terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714"
+    terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips"
     terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
     terrarium_email: ""
     terrarium_acme_email: "{{ terrarium_email }}"

docs/getting-started/installation.md

@@ -96,7 +96,7 @@ Terrarium also verifies the most failure-prone integrations while you configure
 
 ## Container Image Sources
 
-Terrarium pins the oauth2-proxy and local ZITADEL Postgres images by digest. The default source order is:
+Terrarium pins the upstream oauth2-proxy and local ZITADEL Postgres image sources by digest. The default source order is:
 
 - upstream Docker Hardened Images from `dhi.io` when Docker registry credentials exist on the host
 - Terrarium's GHCR mirror of those same DHI multi-arch indexes when upstream DHI credentials are not present

scripts/terrarium-traefik-sync.ts

@@ -14,7 +14,7 @@ const ROUTE_AUTH_DIR = "/var/lib/terrarium/oauth2-proxy-routes";
 const ROUTE_AUTH_COMPOSE_PATH = `${ROUTE_AUTH_DIR}/docker-compose.yml`;
 const ROUTE_AUTH_BASE_PORT = 4181;
 const DEFAULT_OAUTH2_PROXY_IMAGE =
-  "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
+  "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13";
 const OAUTH2_PROXY_UID = 65532;
 const OAUTH2_PROXY_GID = 65532;
 const ROUTE_AUTH_READY_ATTEMPTS = 12;

tests/ansible-bootstrap-cert.test.ts

@@ -6,7 +6,7 @@ const repoRoot = join(import.meta.dir, "..");
 const POSTGRES_DHI_IMAGE =
   "dhi.io/postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714";
 const POSTGRES_MIRROR_IMAGE =
-  "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips@sha256:ae0f0ac1f942ff7898bb217e599cc488b5c7a2611a0957daae44c00584a59714";
+  "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips";
 const POSTGRES_FALLBACK_IMAGE =
   "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308";
 

tests/hardened-image-mirror.test.ts

@@ -24,17 +24,21 @@ describe("Docker Hardened Image mirror workflow", () => {
     expect(workflow).toContain(`dhi.io/oauth2-proxy@${OAUTH2_PROXY_DIGEST}`);
     expect(workflow).not.toContain(`dhi.io/oauth2-proxy:7.15.2-debian13@${OAUTH2_PROXY_DIGEST}`);
     expect(workflow).toContain(`ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13`);
-    expect(workflow).toContain(`digest: ${OAUTH2_PROXY_DIGEST}`);
+    expect(workflow).toContain(`source_digest: ${OAUTH2_PROXY_DIGEST}`);
     expect(workflow).toContain(`dhi.io/postgres@${POSTGRES_DIGEST}`);
     expect(workflow).not.toContain(`dhi.io/postgres:17.9-alpine3.22-fips@${POSTGRES_DIGEST}`);
     expect(workflow).toContain(`ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22-fips`);
-    expect(workflow).toContain(`digest: ${POSTGRES_DIGEST}`);
+    expect(workflow).toContain(`source_digest: ${POSTGRES_DIGEST}`);
+    expect(workflow.match(/target_digest: auto/g)).toHaveLength(2);
     expect(workflow.match(/arches: amd64,arm64/g)).toHaveLength(2);
 
     expect(script).toContain("skopeo inspect --raw");
-    expect(script).toContain("skopeo copy --retry-times 3 --all --preserve-digests");
+    expect(script).toContain("skopeo copy --retry-times 3 --all");
+    expect(script).not.toContain("--preserve-digests");
     expect(script).toContain("sha256sum");
     expect(script).toContain("target digest mismatch");
+    expect(script).toContain("source_arch_digest");
+    expect(script).toContain("target_arch_digest");
     expect(script).toContain('(.platform.os // "") == "linux"');
     expect(script).toContain('(.platform.architecture // "") == $arch');
   });

tests/oauth2-proxy-template.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, test } from "bun:test";
 const OAUTH2_PROXY_DHI_IMAGE =
   "dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
 const OAUTH2_PROXY_MIRROR_IMAGE =
-  "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
+  "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13";
 const OAUTH2_PROXY_FALLBACK_IMAGE =
   "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd";