fix(ci): verify staged image config on classic store

scripts/security/runtime_image_mirror_controller.py

@@ -603,7 +603,7 @@ def _registry_descriptor(image_ref: str) -> RegistryDescriptor | None:
     )
 
 
-def _local_platform_digest(image_ref: str, platform: str) -> str:
+def _local_platform_config_digest(image_ref: str, platform: str) -> str:
     output = _run(
         [
             "docker",
@@ -611,17 +611,13 @@ def _local_platform_digest(image_ref: str, platform: str) -> str:
             "inspect",
             "--platform",
             platform,
-            "--format={{json .Descriptor}}",
+            "--format={{.Id}}",
             image_ref,
         ]
     ).stdout
-    try:
-        descriptor = json.loads(output or "{}")
-    except json.JSONDecodeError as exc:
-        raise ControllerError("local_platform_descriptor_invalid") from exc
-    if not isinstance(descriptor, dict):
-        raise ControllerError("local_platform_descriptor_invalid")
-    return _require_digest(descriptor.get("digest"), "local_platform_digest")
+    return _require_digest(
+        (output or "").strip(), "local_platform_config_digest"
+    )
 
 
 def _local_image_present(image_ref: str) -> bool:
@@ -811,10 +807,12 @@ def stage_images(
                             quiet=True,
                         )
                         if (
-                            _local_platform_digest(source_ref, policy.platform)
-                            != image.platform_digest
+                            _local_platform_config_digest(
+                                source_ref, policy.platform
+                            )
+                            != source_config_digest
                         ):
-                            raise ControllerError("local_image_platform_digest_mismatch")
+                            raise ControllerError("local_image_config_digest_mismatch")
                         _run(
                             ["docker", "tag", source_ref, image.push_ref],
                             quiet=True,

scripts/security/tests/test_runtime_image_mirror_controller.py

@@ -738,17 +738,19 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
                 )
             )
 
-    def test_local_platform_digest_reads_platform_descriptor(self) -> None:
+    def test_local_platform_config_digest_reads_image_id(self) -> None:
         digest = "sha256:" + "1" * 64
         completed = controller.subprocess.CompletedProcess(
             args=[],
             returncode=0,
-            stdout=json.dumps({"digest": digest}),
+            stdout=digest + "\n",
             stderr="",
         )
         with patch.object(controller, "_run", return_value=completed) as run:
             self.assertEqual(
-                controller._local_platform_digest("source:tag", "linux/amd64"),
+                controller._local_platform_config_digest(
+                    "source:tag", "linux/amd64"
+                ),
                 digest,
             )
 
@@ -756,7 +758,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
         self.assertEqual(command[:3], ["docker", "image", "inspect"])
         self.assertIn("--platform", command)
         self.assertIn("linux/amd64", command)
-        self.assertIn("--format={{json .Descriptor}}", command)
+        self.assertIn("--format={{.Id}}", command)
 
     def test_target_digest_verifier_uses_internal_registry_transport(self) -> None:
         image = controller.load_policy(POLICY_PATH).images[0]
@@ -940,8 +942,8 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
                 ) as archive_contains,
                 patch.object(
                     controller,
-                    "_local_platform_digest",
-                    return_value=image.platform_digest,
+                    "_local_platform_config_digest",
+                    return_value=image.source_config_digest,
                 ),
                 patch.object(controller, "_registry_digest_present", return_value=True),
                 patch.object(controller, "_remove_local_image") as remove,