Add `sha256` prefix to the `org.opencontainers.image.base.digest` annotations field in the image manifest.
Metadata
Current evaluation
Add sha256 prefix to org.opencontainers.image.base.digest annotation and base-digest metadata. An open PR (#1401) addresses this.
Suggested action: keep open
Reason: The issue is valid and actionable — the code in rockcraft/models/project.py line 440-441 uses base_digest.hex() without the sha256: prefix, which is inconsistent with other digest fields. PR #1401 is already open to fix this, so the issue should remain open until that PR is merged.
Evaluated by: mr-cal-bot
Impact:
35
Quick Win:
27
Complexity:
10
Confidence:
85
Actionability:
85
Issue body
### What needs to get done
Add `sha256` prefix to the `org.opencontainers.image.base.digest` annotations field in the image manifest.
Here is an example of an image manifest generated by rockcraft:
```
{
"schemaVersion": 2,
"config": {
"mediaType": "application/vnd.oci.image.config.v1+json",
"digest": "sha256:ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
"size": 3
},
"layers": [
{
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
"digest": "sha256:24e08b276317a479704dc53c0e47753b3422695950853fc22446ec76faf6e8d0",
"size": 9320708
},
{
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
"digest": "sha256:b4406d6046b42bf82b11d80e8c19acd2818ef44524bf64e3e7b4f330114af508",
"size": 430
}
],
"annotations": {
"org.opencontainers.image.base.digest": "19d5218d4475ed6af714d9ea9aeff3ce57fcf90e93b062a587f5d183eddeddd9",
"org.opencontainers.image.created": "...",
"org.opencontainers.image.description": "...",
"org.opencontainers.image.ref.name": "...",
"org.opencontainers.image.title": "...",
"org.opencontainers.image.version": "..."
}
}
```
### Why it needs to get done
It is inconsistent with the other digest fields in the image manifest like `config.digest` and `layers[i].digest`. It also makes the digest somewhat ambiguous due to the lack of the hashing algorithm when using it to look up the referenced image base.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b |
Impact:
35
Quick Win:
27
Complexity:
10
Confidence:
85
Actionability:
85
|
keep open | Add sha256 prefix to org.opencontainers.image.base.digest annotation and base-digest metadata. An open PR (#1401) addresses this. | |
| ~deepseek/deepseek-pro-latest |
Impact:
35
Quick Win:
25
Complexity:
15
Confidence:
85
Actionability:
85
|
needs triage | Request to prefix sha256: to org.opencontainers.image.base.digest annotation and base-digest metadata field; currently emitted as bare hex via base_digest.hex() in project.py. | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
22
Complexity:
10
Confidence:
85
Actionability:
80
|
keep open | Add sha256: prefix to org.opencontainers.image.base.digest annotation and base-digest metadata field in rockcraft image manifest generation. | |
| qwen/qwen3.8-27b |
Impact:
25
Quick Win:
19
Staleness:
72
Complexity:
25
Confidence:
78
Support Request:
5
|
needs triage | Request to add sha256: prefix to org.opencontainers.image.base.digest annotation and base-digest in metadata.yaml for consistency with other digest fields. Code at project.py:441 still uses base_digest.hex() without prefix. No labels, no maintainer response in 431 days. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
85
Complexity:
15
Confidence:
80
Support Request:
10
|
needs triage | Request to add sha256 prefix to org.opencontainers.image.base.digest annotation for manifest consistency. Currently unlabelled with no maintainer response in over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
15
Confidence:
85
Support Request:
10
|
needs triage | External contributor requests adding the sha256 prefix to the org.opencontainers.image.base.digest annotation for OCI spec consistency. Unlabelled and inactive for over a year with no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
20
Confidence:
75
Support Request:
10
|
needs triage | Request to add sha256 prefix to OCI base digest annotation for spec consistency. Unlabelled with no maintainer response in over a year. Requires triage to evaluate current relevance and implementation scope. |
Update history
| Date | Change |
|---|---|
| updated |
Related work
-
Likely Fixed By:
rockcraft#1401
(confidence 85%)
Open PR that prefixes base digest with sha256: in both the OCI annotation and /.rock/metadata.yaml, with updated tests.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1401 fix: prefix base digest with sha256 in OCI annotation and rock metadata | rockcraft | open | Prefixes base-image digests with sha256: in the OCI annotation and /.rock/metadata.yaml; tests are updated and the PR awaits maintainer review. |