tests: Pin ubi9/podman by tag rather than digest

The digest pinned in the previous commit is the manifest list's, but
the install path copies bound images out of host containers-storage
with `podman image push`, and the host only holds the per-arch
manifest. containers-storage then refuses the copy with "Digest of
source image's manifest would not match destination reference".

The 9.8-1793032728 tag carries a registry.access.redhat.com
signature for that exact identity, so pulling it by tag satisfies the
default sigstoreSigned policy and needs no digest. That also lets the
logically bound install test go back to matching repository:tag.

Assisted-by: https://github.com/cgwalters/cgwalters#llms

Author: cgwalters

Justfile

@@ -67,7 +67,7 @@ testimage_label := "bootc.testimage=1"
 # replaced it has no sigstore signature for the registry.access.redhat.com
 # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
 # Keep in sync with hack/lbi.
-lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a"
+lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728"
 fedora-coreos := "quay.io/fedora/fedora-coreos:testing-devel"
 generic_buildargs := ""
 _extra_src_args := if extra_src != "" { "-v " + extra_src + ":/run/extra-src:ro --security-opt=label=disable" } else { "" }

hack/lbi/podman.image

@@ -2,4 +2,4 @@
 # Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that
 # replaced it has no sigstore signature for the registry.access.redhat.com
 # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
-Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a
+Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728

hack/provision-packit.sh

@@ -93,7 +93,7 @@ if [[ -n "${BOOTC_source_image_archive:-}" ]]; then
 fi
 
 # Keep these in sync with what's used in hack/lbi; ubi9/podman is pinned, see hack/lbi/podman.image
-podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a
+podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728
 
 # Run system-reinstall-bootc
 # TODO make it more scriptable instead of expect + send

tmt/tests/booted/test-logically-bound-install.nu

@@ -12,7 +12,7 @@ use tap.nu
 let expected_images = [
     "quay.io/curl/curl:latest",
     "quay.io/curl/curl-base:latest",
-    "registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a" # this image is signed; 9.8-1793032728, see hack/lbi/podman.image
+    "registry.access.redhat.com/ubi9/podman:9.8-1793032728" # this image is signed; pinned, see hack/lbi/podman.image
 ]
 
 def validate_images [images: list<string>] {
@@ -24,17 +24,14 @@ def validate_images [images: list<string>] {
 
 # This test checks that bootc actually populated the bootc storage with the LBI images
 def test_logically_bound_images_in_storage [] {
+    # Use podman to list the images in the bootc storage
+    let images = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images --format {{.Repository}}:{{.Tag}} | split row "\n"
+
     # Debug print
     print "IMAGES:"
     podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage images
 
-    # Look up each reference rather than listing repository:tag, since
-    # some are pinned by digest.
-    for expected in $expected_images {
-        print $"Checking ($expected)"
-        let r = podman --storage-opt=additionalimagestore=/usr/lib/bootc/storage image exists $expected | complete
-        assert equal $r.exit_code 0 $"($expected) not found in bootc storage"
-    }
+    validate_images $images
 }
 
 # This test makes sure that bootc itself knows how to list the LBI images in the bootc storage

tmt/tests/lbi/usr/share/containers/systemd/podman.image

@@ -2,4 +2,4 @@
 # Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that
 # replaced it has no sigstore signature for the registry.access.redhat.com
 # :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
-Image=registry.access.redhat.com/ubi9/podman@sha256:2cfaa8360cb9416af369f0dc0474875cf476b6b846e5ce5027d58db9f0054a2a
+Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728