pub fn compute_digest(
source_identity: &str,
warm_identity: Option<&str>,
defaults: &TemplateDefaultsSpec,
labels: &HashMap<String, String>,
) -> StringExpand description
Deterministic content digest for a template entry (sha256:<hex>).
Inputs are content identities, never file metadata, so an identical
rebuild reproduces the digest: source_identity (the rootfs cache file
stem for image builds — it encodes the layer content key and the injected
vm-agent key — or the promoted ORIGIN snapshot id), warm_identity (a
content tag like prewarmed:<geometry> or promoted — never a freshly
minted snapshot id, which would randomize the digest per build), and the
canonicalized defaults and labels. Field-tagged and NUL-separated so
adjacent inputs cannot alias.