fix(release): accept normalized PostgreSQL digest refs (#536)

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

release/scripts/check_postgresql_advisory_policy.py

@@ -71,7 +71,15 @@ def image_evidence(report: Any, report_name: str, target_key: str) -> tuple[str,
     if SHA256_DIGEST.fullmatch(digest) is None:
         fail(f"{report_name} image target must use a sha256 digest")
     repo_digests = target.get("repoDigests")
-    if not isinstance(repo_digests, list) or user_input not in repo_digests:
+    if (
+        not isinstance(repo_digests, list)
+        or not any(
+            isinstance(repo_digest, str)
+            and "@" in repo_digest
+            and repo_digest.rsplit("@", 1)[1] == digest
+            for repo_digest in repo_digests
+        )
+    ):
         fail(f"{report_name} image target digest must appear in repoDigests")
     if target.get("architecture") != "amd64" or target.get("os") != "linux":
         fail(f"{report_name} image target must be linux/amd64")

release/scripts/test_registry_release.py

@@ -874,6 +874,31 @@ def run_checker(
             )
             self.assertEqual(0, extra_metadata_result.returncode, extra_metadata_result.stderr)
 
+            target["repoDigests"] = [
+                f"index.docker.io/library/postgres@{digest}"
+            ]
+            normalized_repository_result = run_checker(
+                "Low", {"versions": [], "state": "not-fixed"}
+            )
+            self.assertEqual(
+                0,
+                normalized_repository_result.returncode,
+                normalized_repository_result.stderr,
+            )
+
+            target["repoDigests"] = [
+                "index.docker.io/library/postgres@sha256:" + "d" * 64
+            ]
+            wrong_digest_result = run_checker(
+                "Low", {"versions": [], "state": "not-fixed"}
+            )
+            self.assertEqual(1, wrong_digest_result.returncode)
+            self.assertIn(
+                "image target digest must appear in repoDigests",
+                wrong_digest_result.stderr,
+            )
+            target["repoDigests"] = [image_ref]
+
             mismatch_result = run_checker(
                 "Low",
                 {"versions": [], "state": "not-fixed"},