Support digest pinning #892

New Issue

2026-07-26T20:42:26Z

sixsmith commented

2026-07-26 20:42:26 +00:00

Problem
Recipes reference images by tag (e.g. nginx:1.25), which can be mutable (the same tag can point to a different image over time).
This can break reproducibility: If an upstream image is changed between two deploys, the same recipe/version would then pull different images. It's also a supply-chain risk: an upstream image maintainer can push a backdoored image to an other wise trusted tag, which gets pulled silently on next deploy/upgrade.

Proposed Solution

abra app upgrade should suport be an upgrade path - pinning upgrading an image to a specific digest
abra should resolve and record digests for image tags
recipes should reference images in compose.yml by image digest
Image manifests should be preferred over specific image tags, to maintain support for multiarch

Comments
At a high level, I'd like to leave tags intact as the "interface" for abra CLI users and for digests to be an under-the-hood detail. Opening this issue for discussion before implementation.

**Problem** Recipes reference images by tag (e.g. nginx:1.25), which can be mutable (the same tag can point to a different image over time). This can break reproducibility: If an upstream image is changed between two deploys, the same recipe/version would then pull different images. It's also a supply-chain risk: an upstream image maintainer can push a backdoored image to an other wise trusted tag, which gets pulled silently on next deploy/upgrade. **Proposed Solution** * `abra app upgrade` should suport be an upgrade path - pinning upgrading an image to a specific digest * `abra` should resolve and record digests for image tags * recipes should reference images in `compose.yml` by image digest * Image manifests should be preferred over specific image tags, to maintain support for multiarch **Comments** At a high level, I'd like to leave tags intact as the "interface" for `abra` CLI users and for digests to be an under-the-hood detail. Opening this issue for discussion before implementation.

sixsmith added the enhancement security labels 2026-07-26 20:42:26 +00:00

decentral1se commented

2026-07-27 07:41:04 +00:00

I was there, Gandalf. I was there, 5 years ago.

toolshed/organising#67

I fully agree! We never got there.

I am not sure about the "under-the-hood" aspect. The recipe config is a site of hacking for most recipe maintainers, where people want to have a high level of control. I think we'd probably want to make abra have more convenience commands for upgrading / inspecting digests per-image or with a specific upgrade/rollback interface.

This would need to be introduced gradually and be backwards compatible. Tricky business. It might even require some decision making.

I was there, Gandalf. I was there, 5 years ago. > https://git.coopcloud.tech/toolshed/organising/issues/67 I fully agree! We never got there. I am not sure about the "under-the-hood" aspect. The recipe config is a site of hacking for most recipe maintainers, where people want to have a high level of control. I think we'd probably want to make `abra` have more convenience commands for upgrading / inspecting digests per-image or with a specific upgrade/rollback interface. This would need to be introduced gradually and be backwards compatible. Tricky business. It might even require some decision making.

sixsmith commented

2026-07-28 06:01:36 +00:00

Hah! Didn't know that history. The justifications offered there still apply today, imo.

under-the-hood

I should clarify that abra recipe upgrade should keep showing tags as options in the picker, instead of more mysterious digests. It should write the corresponding digest to the composefile, though.

This would need to be introduced gradually and be backwards compatible.

Agree to the gradual bit (I'm thinking a boolean flag --pindigests that defaults false, plus making sure other subcommands can handle either tags or digests). So pinning would be initiated by a manual upgrade process. This should let each recipe make its own decision about when to pin.

Side note, we'd have to consider that renovatebot might open PRs that clobber digests back into tags.

Hah! Didn't know that history. The justifications offered there still apply today, imo. > under-the-hood I should clarify that `abra recipe upgrade` should keep showing tags as options in the picker, instead of more mysterious digests. It should write the corresponding digest to the composefile, though. > This would need to be introduced gradually and be backwards compatible. Agree to the gradual bit (I'm thinking a boolean flag `--pindigests` that defaults false, plus making sure other subcommands can handle either tags or digests). So pinning would be initiated by a manual upgrade process. This should let each recipe make its own decision about when to pin. Side note, we'd have to consider that renovatebot might open PRs that clobber digests back into tags.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: toolshed/abra#892