From 84a777f9a3eac1abb061ef48aab7ced7abd24990 Mon Sep 17 00:00:00 2001 From: ab-ghosh Date: Mon, 29 Jun 2026 22:21:04 +0530 Subject: [PATCH] fix: resolve manifest list digest instead of platform-specific digest The get_image_sha() function was using .manifests[0].digest which returns the first platform entry (amd64) instead of the manifest list digest. This causes the operator CSV to pin task images (buildah, s2i, skopeo, ubi-minimal) to amd64-only digests, breaking ARM64 and multi-arch clusters with exec format error. Fix by computing sha256 of the raw manifest list content, which produces the manifest list digest that container runtimes use to resolve the correct platform at pull time. Signed-off-by: ab-ghosh --- hack/openshift/update-image-sha.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hack/openshift/update-image-sha.sh b/hack/openshift/update-image-sha.sh index 8afef970ad..3e045286e3 100755 --- a/hack/openshift/update-image-sha.sh +++ b/hack/openshift/update-image-sha.sh @@ -26,10 +26,10 @@ find_latest_version() { echo "$version" } -# Get SHA digest for an image:tag -get_image_sha() { +# Get manifest list digest for an image:tag (multi-arch) +get_manifest_list_digest() { local image_url=$1 - skopeo inspect --raw docker://${image_url} | jq -r '.manifests[0].digest // .digest' + skopeo inspect --no-tags docker://${image_url} | jq -r '.Digest' } # Update image SHA in YAML files @@ -59,7 +59,7 @@ main() { echo " Latest version: $latest_version" image_url="${image_registry}:${latest_version}" - image_sha=$(get_image_sha "$image_url") + image_sha=$(get_manifest_list_digest "$image_url") echo " SHA: $image_sha" update_yaml_files "$image_registry" "$image_sha"