images: mirror digest-pinned indexes byte for byte

[mpuig]

Problem

A Dockerfile that pins its base image by digest almost always pins the multi-arch index digest — it's the digest docker pull and Docker Hub print. MirrorBaseImage resolves that reference to the platform image and pushes it under the index digest, which the local registry correctly refuses:

push to local registry: PUT …/v2/library/python/manifests/sha256:9b4929a7…:
unexpected status code 400 Bad Request: digest mismatch:
expected sha256:9b4929a7…, got sha256:1e58d36e…

Because the mirror failure is only a WARN, the build proceeds and fails later with an unrelated error (create builder instance: image is required on v0.3.0), so the root cause is invisible in the API response. Net effect: every digest-pinned FROM is unbuildable — and supply-chain-pinned Dockerfiles are exactly the ones that hit it.

Reproduced on v0.3.0 on a GitHub-hosted ubuntu runner with FROM python:3.13-alpine@sha256:9b4929a7…; journal evidence above.

Fix

An index named by digest is mirrored as the index itself (remote.WriteIndex — children first, then the index manifest), so the destination stores content whose digest is exactly the one the caller pinned.

Unchanged behavior:

• tag references still mirror only the platform-resolved image (the storage-saving path);
• a digest reference naming a plain (single-platform) manifest already round-trips and is untouched.

The push logic moves into pushMirrored so the property is testable against in-memory registries (pkg/registry, as in imagepush/manager_test.go): the new tests pin a random two-manifest index by digest, mirror it, and prove the pinned digest resolves at the destination — which is the assertion the old code could not pass.

Testing

• go test ./lib/images/ green (new + existing tests)
• go build ./... green

Found while building barista on hypeman; happy to adjust if you'd rather handle index-pinned refs differently (e.g. refusing them loudly instead of mirroring all platforms).

---

Note

Medium Risk
Changes how mirrored images are written to the local registry (index vs platform image). Tag-based mirroring is unchanged; digest-pinned indexes now copy all platforms.

Overview
Fixes MirrorBaseImage so a digest that names a multi-arch index is mirrored as that index (remote.WriteIndex), matching the digest Dockerfiles typically pin. Previously the platform-resolved image was pushed under the index digest, which registries reject as a digest mismatch — so digest-pinned FROM lines could not build.

Tag references still mirror only the requested platform image (storage-saving path). Single-platform digest refs are unchanged.

Push logic is extracted to pushMirrored and covered with in-memory registry tests for index-by-digest preservation, tag-as-image, and multi-platform tag resolution.

^{Reviewed by Cursor Bugbot for commit eb23dca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

thanks for putting up this PR! it's just missing some test coverage but looks good otherwise

[mpuig]

Thanks! Added test coverage in eb23dca8: TestPushMirroredByTagResolvesMultiPlatformIndexToRequestedPlatform builds a two-platform index (linux/amd64 + linux/arm64), fetches the tag with WithPlatform(linux/arm64), and asserts the mirror arrives as that arm64 image — not the whole index, and not the amd64 sibling. The prior single-platform test couldn't distinguish those cases.

[mpuig]

@chruffins the requested test coverage is in eb23dca8 and the review thread is resolved — CI is green. Could you take another look and re-approve when you get a chance? I can't re-request the review myself from the fork. Thanks!