#!/bin/bash
set -euo pipefail

IMAGE_REPO="cozystack/cozystack/s3manager"
TAG="v0.5.0"
PINNED_DIGEST="sha256:33c2b810f542c53ad2a04f544749542dbf2a47f072b254cbcd5facc5ecc83bf4"

token() {
  curl -s "https://ghcr.io/token?service=ghcr.io&scope=repository:${IMAGE_REPO}:pull" | jq -r .token
}

DIGEST=$(curl -sI -H "Authorization: Bearer $(token)" -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" | tr -d '\r' | awk -F': ' '/^Docker-Content-Digest:/ {print $2}')
echo "Pinned: $PINNED_DIGEST"
echo "Tag digest: $DIGEST"
test "$DIGEST" = "$PINNED_DIGEST" || { echo "Digest mismatch"; exit 1; }

curl -s -H "Authorization: Bearer $(token)" -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" | jq -r '.manifests[].platform | "\(.os)/\(.architecture)"'

#!/usr/bin/env bash
set -euo pipefail

IMAGE_REPO="cozystack/cozystack/s3manager"
TAG="v0.5.0"
PINNED_DIGEST="sha256:33c2b810f542c53ad2a04f544749542dbf2a47f072b254cbcd5facc5ecc83bf4"

# Retrieve registry token
TOKEN=$(curl -s "https://ghcr.io/token?service=ghcr.io&scope=repository:${IMAGE_REPO}:pull" | jq -r .token)

# Fetch digest from response headers
DIGEST=$(curl -s -D - -o /dev/null \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" \
  | grep -i '^Docker-Content-Digest:' | awk '{print $2}')

echo "Pinned: ${PINNED_DIGEST}"
echo "Tag digest: ${DIGEST}"
test "${DIGEST}" = "${PINNED_DIGEST}" || { echo "Digest mismatch"; exit 1; }

# List supported platforms
curl -s \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" \
  | jq -r '.manifests[].platform | "\(.os)/\(.architecture)"'

#!/usr/bin/env bash
set -euo pipefail

IMAGE_REPO="cozystack/cozystack/s3manager"
TAG="v0.5.0"
PINNED_DIGEST="sha256:33c2b810f542c53ad2a04f544749542dbf2a47f072b254cbcd5facc5ecc83bf4"

# Retrieve registry token
TOKEN=$(curl -s "https://ghcr.io/token?service=ghcr.io&scope=repository:${IMAGE_REPO}:pull" | jq -r .token)

# Fetch and clean digest from headers
DIGEST=$(curl -s -D - -o /dev/null \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" \
  | grep -i '^Docker-Content-Digest:' \
  | awk '{print $2}' \
  | tr -d '\r')

echo "Pinned digest: ${PINNED_DIGEST}"
echo "Registry digest: ${DIGEST}"
[ "${DIGEST}" = "${PINNED_DIGEST}" ] && echo "Digest matches" || { echo "Digest mismatch"; exit 1; }

echo "Supported platforms:"
curl -s \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://ghcr.io/v2/${IMAGE_REPO}/manifests/${TAG}" \
  | jq -r '.manifests[].platform | "\(.os)/\(.architecture)"'

#!/bin/bash
set -euo pipefail
repo="cozystack/cozystack/cozystack-controller"
tag="v0.36.0-alpha.1"
expected="sha256:a9edc1ac27b6a2315cb48984c1af3f48e8596b6f37c1327b2174a6743225b28f"

token="$(curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull" | jq -r .token)"
digest="$(
  curl -fsSLI -H "Authorization: Bearer ${token}" \
    -H 'Accept: application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json' \
    "https://ghcr.io/v2/${repo}/manifests/${tag}" | tr -d '\r' | awk -F': ' '/Docker-Content-Digest/ {print $2}' | tail -1
)"
echo "Resolved digest: ${digest}"
test "${digest}" = "${expected}" && echo "OK: digest matches" || { echo "MISMATCH"; exit 1; }

#!/bin/bash
set -euo pipefail

repo="cozystack/cozystack/cozystack-controller"
tag="v0.36.0-alpha.1"
expected="sha256:a9edc1ac27b6a2315cb48984c1af3f48e8596b6f37c1327b2174a6743225b28f"

# Fetch an OCI token for GHCR
token="$(curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull" | jq -r .token)"

# Retrieve the manifest JSON for the specified tag
manifest="$(curl -fsSL \
  -H "Authorization: Bearer ${token}" \
  -H "Accept: application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json" \
  "https://ghcr.io/v2/${repo}/manifests/${tag}")"

# Extract the digest: if it's a single manifest, use .config.digest; if it's an index, pick linux/amd64
digest="$(printf '%s\n' "$manifest" | jq -r '
  if .config? then
    .config.digest
  elif .manifests? then
    .manifests[] | select(.platform.os=="linux" and .platform.architecture=="amd64") | .digest
  else
    empty
  end
')"

echo "Resolved digest: $digest"
if [ "$digest" = "$expected" ]; then
  echo "OK: digest matches"
else
  echo "MISMATCH: expected $expected"
  exit 1
fi

#!/bin/bash
set -euo pipefail

repo="cozystack/cozystack/kubevirt-csi-driver"
expect_028="sha256:c35987e8b37ad3b34a9a32fe6e80eee77b4c57b99090ca5cdbc3d16c25edb3b9"

get_digest() {
  local ref="$1"
  local tok
  tok=$(curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull" | jq -r .token)
  curl -fsSLI \
    -H "Authorization: Bearer ${tok}" \
    -H "Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json" \
    "https://ghcr.io/v2/${repo}/manifests/${ref}" \
    | awk -F': ' '/Docker-Content-Digest/ {print $2}' | tr -d $'\r'
}

got_028=$(get_digest "0.28.0")
echo "0.28.0 -> ${got_028}"
test "${got_028}" = "${expect_028}" || { echo "Mismatch for 0.28.0"; exit 1; }

#!/bin/bash
set -euo pipefail

repo="cozystack/cozystack/kubevirt-csi-driver"
tok=$(curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull" | jq -r .token)
manifest_json=$(curl -fsSL \
  -H "Authorization: Bearer ${tok}" \
  -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
  "https://ghcr.io/v2/${repo}/manifests/0.28.0")
echo "$manifest_json" | jq -r '.config.digest'