fix(lock): pin SDK image URI to locked manifest digest

twoliter/src/cmd/build.rs

@@ -6,6 +6,7 @@ use crate::project::{self, Locked};
 use crate::tools::install_tools;
 use anyhow::{Context, Result};
 use clap::Parser;
+use oci_cli_wrapper::ImageTool;
 use std::path::PathBuf;
 use tempfile::TempDir;
 
@@ -67,7 +68,10 @@ impl BuildKit {
             optional_envs.push(("BUILDSYS_LOOKASIDE_CACHE", lookaside_cache))
         }
 
-        CargoMake::new(&project.sdk_image().project_image_uri().to_string())?
+        let image_tool = ImageTool::from_builtin_krane();
+        let sdk_uri = project.sdk_image_uri(&image_tool).await?;
+
+        CargoMake::new(&sdk_uri)?
             .env("TWOLITER_TOOLS_DIR", toolsdir.display().to_string())
             .env("BUILDSYS_ARCH", &self.arch)
             .env("BUILDSYS_KIT", &self.kit)
@@ -142,7 +146,10 @@ impl BuildVariant {
             ))
         }
 
-        CargoMake::new(&project.sdk_image().project_image_uri().to_string())?
+        let image_tool = ImageTool::from_builtin_krane();
+        let sdk_uri = project.sdk_image_uri(&image_tool).await?;
+
+        CargoMake::new(&sdk_uri)?
             .env("TWOLITER_TOOLS_DIR", toolsdir.display().to_string())
             .env("BUILDSYS_ARCH", &self.arch)
             .env("BUILDSYS_VARIANT", &self.variant)

twoliter/src/cmd/build_clean.rs

@@ -20,7 +20,10 @@ impl BuildClean {
         tools::install_tools(&toolsdir).await?;
         let makefile_path = toolsdir.join("Makefile.toml");
 
-        CargoMake::new(&project.sdk_image().project_image_uri().to_string())?
+        // `clean` does not run anything inside the SDK, so skip the registry lookup.
+        let sdk_uri = project.sdk_image().project_image_uri().to_string();
+
+        CargoMake::new(&sdk_uri)?
             .env("TWOLITER_TOOLS_DIR", toolsdir.display().to_string())
             .makefile(makefile_path)
             .project_dir(project.project_dir())

twoliter/src/cmd/make.rs

@@ -4,6 +4,7 @@ use crate::project::{self, Locked, SDKLocked, Unlocked};
 use crate::tools::install_tools;
 use anyhow::Result;
 use clap::Parser;
+use oci_cli_wrapper::ImageTool;
 use std::path::PathBuf;
 
 // Most subcommands do not require kits and thus do not need to resolve and verify them against the
@@ -79,19 +80,22 @@ impl Make {
         target_allows_kit_verification_skip && project_has_explicit_sdk_dep
     }
 
-    /// Returns the locked SDK image for the project.
+    /// Returns the digest-pinned SDK image URI for the project.
     ///
     /// Fetches kits if needed.
     async fn lock_and_fetch(&self, project: &project::Project<Unlocked>) -> Result<String> {
-        Ok(if self.can_skip_kit_verification(project) {
-            project.load_lock::<SDKLocked>().await?.sdk_image()
+        let image_tool = ImageTool::from_builtin_krane();
+        if self.can_skip_kit_verification(project) {
+            project
+                .load_lock::<SDKLocked>()
+                .await?
+                .sdk_image_uri(&image_tool)
+                .await
         } else {
             let project = project.load_lock::<Locked>().await?;
             project.fetch(self.arch.as_str()).await?;
-            project.sdk_image()
+            project.sdk_image_uri(&image_tool).await
         }
-        .project_image_uri()
-        .to_string())
     }
 }
 
@@ -221,7 +225,8 @@ mod test {
             .await
             .unwrap();
         let project = project.load_lock::<SDKLocked>().await.unwrap();
-        let sdk_source = project.sdk_image().project_image_uri().to_string();
+        let image_tool = ImageTool::from_builtin_krane();
+        let sdk_source = project.sdk_image_uri(&image_tool).await.unwrap();
 
         if delete_verifier_tags {
             // Clean up tags so that the build fails

twoliter/src/cmd/publish_kit.rs

@@ -3,6 +3,7 @@ use crate::project::{self, Locked};
 use crate::tools::install_tools;
 use anyhow::Result;
 use clap::Parser;
+use oci_cli_wrapper::ImageTool;
 use std::path::PathBuf;
 
 /// Group all publish commands
@@ -48,7 +49,10 @@ impl PublishKit {
             Some(kit_repo) => kit_repo,
             None => &self.kit_name,
         };
-        CargoMake::new(project.sdk_image().project_image_uri().to_string().as_str())?
+        let image_tool = ImageTool::from_builtin_krane();
+        let sdk_uri = project.sdk_image_uri(&image_tool).await?;
+
+        CargoMake::new(&sdk_uri)?
             .env("TWOLITER_TOOLS_DIR", toolsdir.display().to_string())
             .env("BUILDSYS_KIT", &self.kit_name)
             .env("BUILDSYS_VERSION_IMAGE", project.release_version())