Module image_ref 

Whether an image reference is pinned by a digest — the one place that decides.

Ungated, like guidance, and for a reason of the same shape: the rule is about a string somebody wrote in a config file, not about which backends were compiled in. roteiro config reports an unpinned reference in a build with no sandbox at all, and a second copy of the check written for that purpose is how one of the two ends up laxer than the other. Whether an image reference is pinned by a digest — the one place that decides.

Ungated, like crate::guidance and crate::sandbox_store, and for a reason of the same shape: the rule is about a string somebody wrote in a config file, not about which backends were compiled in. roteiro config has to be able to report an unpinned reference in a build with no sandbox at all — it is the command an operator runs precisely because a key is not doing what they expected — and a second copy of the check living in the roteiro crate for that purpose is how one of the two ends up laxer than the other. There is one function; [crate::boxlite::pinned_digest] wraps it into the backend’s error type and adds nothing.

Why a tag is refused at all

Not reproducibility. ADR-0020 retires that argument for builders, because a build’s answer depends on a toolchain no digest pins. The reason is that the image is the boundary: it is where somebody else’s code executes, and a tag is a mutable pointer to it. Whoever controls the tag can replace what runs, with no version change and no notice, and the run would go on reporting success. You may choose your own boundary; you may not choose one that can be swapped under you.

…and why “a tag is refused” is not the whole of what this module says

That argument is correct and it covers one of the four ways a reference fails the check. The other three belong to people who have already pinned: a sha512 digest, an @ naming no algorithm, a @sha256: whose value is the abbreviated form a registry UI displayed. Telling any of them “that is a tag” describes something they did not write, and handing them the mutable-pointer argument answers a question they did not ask. Each defect therefore carries its own sentence and its own guidance — see PinDefect, which records what that cost before it was fixed.

@rto:0014 @rto:0020

Structs

NotPinned

An image reference that is not pinned by a sha256 digest, and why not.

Enums

PinDefect

What is actually wrong with a reference that is not a digest pin.

Constants

CHECK_THE_WHOLE_DIGEST

For a reference that says @sha256: and then gets the value wrong.

PIN_IT

Why a mutable pointer will not do, and how to get the digest instead.

SHA256_IS_THE_PIN

For a reference already pinned, by an algorithm this does not read.

Functions

pinned_digest

The digest reference is pinned to, or a refusal naming what to fix.