Registry আর supply chain — tag, digest, scanning, SBOM আর signing

registry.example.com:5000/shop/api:1.4@sha256:a151f7de…
└──────── registry ─────┘└ repository ┘└tag┘└─ digest ─┘

$ curl -sI -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
    http://127.0.0.1:18411/v2/abcl-cr-api/manifests/v2 | grep -i docker-content
Docker-Content-Digest: sha256:f87d8bb69ec51c4ff4db64d56f76a586b0f2025c3629278634c17179382d1269

$ curl -s -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
    http://127.0.0.1:18411/v2/abcl-cr-api/manifests/v2 | sha256sum
f87d8bb69ec51c4ff4db64d56f76a586b0f2025c3629278634c17179382d1269  -

$ docker push localhost:18411/abcl-cr-shop:1.4     # build A
1.4: digest: sha256:a151f7de7c905758e747d0430a239f6d9807899351bb986c326b8f6725af63b7 size: 855

$ docker push localhost:18411/abcl-cr-shop:1.4     # build B, same tag
1.4: digest: sha256:f8acfc18b6009ff412b17c0f4b05e42f7e0287053eeb5e9edcc64fe5b211ac01 size: 855

$ curl -s http://127.0.0.1:18411/v2/abcl-cr-shop/tags/list
{"name":"abcl-cr-shop","tags":["1.4"]}

$ docker pull localhost:18411/abcl-cr-shop:1.4
Digest: sha256:f8acfc18b6009ff412b17c0f4b05e42f7e0287053eeb5e9edcc64fe5b211ac01
$ docker run --rm localhost:18411/abcl-cr-shop:1.4
shop build B: has a bug

$ docker pull localhost:18411/abcl-cr-shop@sha256:a151f7de7c905758e747d0430a239f6d9807899351bb986c326b8f6725af63b7
Digest: sha256:a151f7de7c905758e747d0430a239f6d9807899351bb986c326b8f6725af63b7
$ docker run --rm localhost:18411/abcl-cr-shop@sha256:a151f7de…
shop build A: stable

// Tag vs digest: a registry as two maps. Change pushes or IMMUTABLE.
const IMMUTABLE = false;            // true: a tag can never point elsewhere
const pushes = [                    // t = simulated minutes
  { t: 10, tag: '1.4',    body: 'build A' },
  { t: 20, tag: 'latest', body: 'build A' },
  { t: 30, tag: '1.4',    body: 'build B' },
  { t: 40, tag: 'latest', body: 'build C' },
];
function digest(s) {                // toy FNV-1a hash, not real SHA-256
  let h = 2166136261;
  for (const c of s) h = Math.imul(h ^ c.charCodeAt(0), 16777619);
  return 'sha:' + (h >>> 0).toString(16).padStart(8, '0');
}
const blobs = new Map(), history = [];
for (const p of pushes) {           // replay the timeline, keep each tag state
  const d = digest(p.body), old = history.findLast(h => h.tag === p.tag);
  blobs.set(d, p.body);
  if (IMMUTABLE && old && old.d !== d) {
    console.log(`t=${p.t} push ${p.tag}: REJECTED, tag is immutable`); continue;
  }
  history.push({ t: p.t, tag: p.tag, d });
  console.log(`t=${p.t} push ${p.tag} -> ${d}` + (old && old.d !== d ? ` (moved from ${old.d})` : ''));
}
const pinned = digest('build A');   // the digest a careful deploy recorded
function resolve(ref, t) {
  if (ref.startsWith('@')) return ref.slice(1);
  return history.findLast(h => h.tag === ref && h.t <= t)?.d;
}
console.log('--- resolve the same names at different times');
for (const [ref, t] of [['1.4', 15], ['1.4', 35], ['latest', 25], ['latest', 45], ['@' + pinned, 45]]) {
  const d = resolve(ref, t);
  console.log(`t=${t} ${ref.padEnd(14)} -> ${d} = ${blobs.get(d)}`);
}

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:e86b0012a82bc854af136cd21b950eea5384c96750f87fd74afd986bf5f5d62c",
    "size": 1009
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:25f1d6b1951ac8eb3740558fe94cb83d377bdadf95fd9f98b50d2e1b96130471",
      "size": 3630321
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:2d1b1b7444681f44435079c0842f26d6fecce3cf86fb81152b4450c41c0de5b9",
      "size": 159
    }
  ]
}

$ docker buildx imagetools inspect alpine:3.20
Name:      docker.io/library/alpine:3.20
MediaType: application/vnd.oci.image.index.v1+json
Digest:    sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
  Platform:    linux/amd64
  Platform:    unknown/unknown
  Platform:    linux/arm/v6
  …
  Platform:    linux/arm64/v8
  …
  Platform:    linux/riscv64
  Platform:    linux/s390x

$ docker buildx imagetools inspect localhost:18411/abcl-cr-shop:1.4
MediaType: application/vnd.oci.image.index.v1+json
  Name:        …abcl-cr-shop:1.4@sha256:395d6ff2…
  Platform:    linux/amd64
  Name:        …abcl-cr-shop:1.4@sha256:fc01e148…
  Platform:    unknown/unknown
    vnd.docker.reference.type:   attestation-manifest

$ docker push localhost:18411/abcl-cr-api:v1
edd22db6defa: Pushed
25f1d6b1951a: Mounted from abcl-cr-shop
7d2c0b965f82: Pushed
v1: digest: sha256:bd2de108de54422263f3f944ca11627e095671cb231c6832dfeb545a3e73d6e0 size: 896

$ docker push localhost:18411/abcl-cr-api:v2
8a4f2f418467: Pushed
25f1d6b1951a: Layer already exists
7d2c0b965f82: Layer already exists
v2: digest: sha256:f87d8bb69ec51c4ff4db64d56f76a586b0f2025c3629278634c17179382d1269 size: 896

$ docker pull localhost:18411/abcl-cr-report:v1     # alpine already on this machine
v1: Pulling from abcl-cr-report
c9d6c1cf503b: Pulling fs layer
c9d6c1cf503b: Download complete
c9d6c1cf503b: Pull complete
Digest: sha256:d37318293bfcf717b8d75725e217b071b57ce5c8e22b6f5d3794c794da5974dc
Status: Downloaded newer image for localhost:18411/abcl-cr-report:v1

# Token লেখার সময়ে প্রায় ১২ ঘণ্টা বৈধ; docker login-এ password-এর জায়গায় বসে
aws ecr get-login-password --region ap-south-1 \
  | docker login --username AWS --password-stdin \
    123456789012.dkr.ecr.ap-south-1.amazonaws.com

aws ecr put-image-tag-mutability \
  --repository-name shop \
  --image-tag-mutability IMMUTABLE

$ du -s …/blobs                       # KiB, inside the registry container
32144
$ curl -s -o /dev/null -w 'DELETE %{http_code}\n' -X DELETE …/v2/abcl-cr-api/manifests/sha256:bd2de108…
DELETE 202
$ curl -s …/v2/abcl-cr-api/tags/list
{"name":"abcl-cr-api","tags":["v2"]}
$ du -s …/blobs
32144                                 # nothing changed yet

$ registry garbage-collect --dry-run /etc/docker/registry/config.yml
…
22 blobs marked, 3 blobs and 0 manifests eligible for deletion
$ registry garbage-collect /etc/docker/registry/config.yml
$ du -s …/blobs
32120

$ registry garbage-collect --delete-untagged /etc/docker/registry/config.yml
11 blobs marked, 11 blobs and 5 manifests eligible for deletion

$ docker pull localhost:18411/abcl-cr-shop@sha256:a151f7de…     # build A
Error response from daemon: failed to resolve reference … not found

# worse: the tag still answers, but its platform manifest is gone
$ curl … -w 'tag index %{http_code}\n' …/abcl-cr-shop/manifests/1.4
tag index 200
$ curl … -w 'amd64 child %{http_code}\n' …/abcl-cr-shop/manifests/sha256:5a6aab8a…
amd64 child 404
$ docker pull localhost:18411/abcl-cr-shop:1.4
short read: expected 1052 bytes but got 0: unexpected EOF

// Retention rule over a SAMPLE repository. Change the rule values.
const KEEP_LAST_RELEASES = 2, PR_MAX_AGE = 7, UNTAGGED_MAX_AGE = 14;
const LAYER_MB = { base: 8, deps: 120, a1: 5, a2: 5, a3: 5, a4: 5, p1: 5, p2: 5 };
const images = [        // age in days; running = used by production right now
  { ref: 'rel-1.1', age: 90, running: false, layers: ['base', 'deps', 'a1'] },
  { ref: 'rel-1.2', age: 60, running: true,  layers: ['base', 'deps', 'a2'] },
  { ref: 'rel-1.3', age: 20, running: false, layers: ['base', 'deps', 'a3'] },
  { ref: 'rel-1.4', age: 3,  running: false, layers: ['base', 'deps', 'a4'] },
  { ref: 'pr-77',   age: 12, running: false, layers: ['base', 'deps', 'p1'] },
  { ref: 'pr-81',   age: 2,  running: false, layers: ['base', 'deps', 'p2'] },
  { ref: 'untagged', age: 30, running: false, layers: ['base', 'deps', 'p1'] },
];
const releases = images.filter(i => i.ref.startsWith('rel-')).sort((a, b) => a.age - b.age);
function verdict(img, protect) {
  if (protect && img.running) return 'KEEP   running in production';
  if (img.ref === 'untagged') return img.age > UNTAGGED_MAX_AGE ? 'DELETE old and untagged' : 'KEEP   young untagged';
  if (img.ref.startsWith('pr-')) return img.age > PR_MAX_AGE ? 'DELETE old PR build' : 'KEEP   recent PR';
  return releases.indexOf(img) < KEEP_LAST_RELEASES ? 'KEEP   recent release' : 'DELETE old release';
}
const size = i => i.layers.reduce((t, l) => t + LAYER_MB[l], 0);
for (const protect of [false, true]) {
  console.log(`--- protect running images: ${protect}`);
  const out = images.map(i => ({ i, v: verdict(i, protect) }));
  const del = out.filter(x => x.v.startsWith('DELETE'));
  const kept = new Set(out.filter(x => !del.includes(x)).flatMap(x => x.i.layers));
  const gone = new Set(del.flatMap(x => x.i.layers).filter(l => !kept.has(l)));
  for (const { i, v } of out) {
    const warn = i.running && v.startsWith('DELETE') ? '  <-- OUTAGE RISK' : '';
    console.log(`${i.ref.padEnd(8)} ${String(i.age).padStart(2)}d ${v}${warn}`);
  }
  const freed = [...gone].reduce((s, l) => s + LAYER_MB[l], 0);
  console.log(`freed after GC: ${freed} MB, sum of image sizes: ${del.reduce((s, x) => s + size(x.i), 0)} MB`);
}

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Expire untagged images after 14 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 14
      },
      "action": { "type": "expire" }
    }
  ]
}

# HIGH/CRITICAL only, JSON report, non-zero exit if found
trivy image --severity HIGH,CRITICAL --exit-code 1 \
  --format json -o scan.json registry.example.com/shop/api@sha256:...

# Grype: fail the job at critical severity
grype registry.example.com/shop/api@sha256:... --fail-on critical

{
  "ArtifactName": "registry.example.com/shop/api",
  "Results": [
    {
      "Target": "registry.example.com/shop/api (alpine 3.20)",
      "Class": "os-pkgs",
      "Type": "alpine",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-SAMPLE-0003",
          "PkgName": "zlib",
          "InstalledVersion": "1.3.1-r0",
          "FixedVersion": "1.3.1-r1",
          "Severity": "CRITICAL"
        }
      ]
    }
  ]
}

set -euo pipefail
# SAMPLE scanner export. Fake IDs, not from a real scan.
cat > scan.csv <<'CSV'
id,package,installed,fixed,severity,cvss
CVE-SAMPLE-0001,libfoo,1.2.0,,CRITICAL,9.8
CVE-SAMPLE-0002,openssl,3.1.4-r5,3.1.4-r6,HIGH,7.5
CVE-SAMPLE-0003,zlib,1.3.1-r0,1.3.1-r1,CRITICAL,9.1
CVE-SAMPLE-0004,busybox,1.36.1-r29,1.36.1-r30,MEDIUM,5.5
CVE-SAMPLE-0005,webframe,4.2.0,,HIGH,8.2
CVE-SAMPLE-0006,gcc-libs,13.2.1-r3,,LOW,2.9
CSV

echo "== count by severity"
tail -n +2 scan.csv | cut -d, -f5 | sort | uniq -c | sort -rn

echo "== CRITICAL or HIGH with a fix (act first)"
awk -F, 'NR>1 && $4!="" && ($5=="CRITICAL" || $5=="HIGH") {
  printf "%-16s %-8s %s -> %s\n", $1, $2, $3, $4 }' scan.csv

echo "== CRITICAL or HIGH without a fix (needs a decision)"
awk -F, 'NR>1 && $4=="" && ($5=="CRITICAL" || $5=="HIGH") {
  printf "%-16s %-8s cvss %s\n", $1, $2, $6 }' scan.csv

fixable=$(awk -F, 'NR>1 && $4!="" && $5=="CRITICAL"' scan.csv | wc -l)
if [ "$fixable" -gt 0 ]; then
  echo "GATE: block release, $fixable fixable CRITICAL"
else
  echo "GATE: pass"
fi

// Scan triage on a labelled SAMPLE. IDs are fake; change flags or weights.
const SEVERITY = { CRITICAL: 40, HIGH: 25, MEDIUM: 10, LOW: 3 };
const WEIGHT = { reachable: 30, exploited: 40, fix: 10 };
const findings = [
  { id: 'CVE-SAMPLE-0001', pkg: 'libfoo',   sev: 'CRITICAL', reachable: false, exploited: false, fix: false },
  { id: 'CVE-SAMPLE-0002', pkg: 'openssl',  sev: 'HIGH',     reachable: true,  exploited: true,  fix: true  },
  { id: 'CVE-SAMPLE-0003', pkg: 'zlib',     sev: 'CRITICAL', reachable: true,  exploited: false, fix: true  },
  { id: 'CVE-SAMPLE-0004', pkg: 'busybox',  sev: 'MEDIUM',   reachable: false, exploited: false, fix: true  },
  { id: 'CVE-SAMPLE-0005', pkg: 'webframe', sev: 'HIGH',     reachable: true,  exploited: false, fix: false },
  { id: 'CVE-SAMPLE-0006', pkg: 'gcc-libs', sev: 'LOW',      reachable: false, exploited: false, fix: false },
];
function score(f) {
  return SEVERITY[f.sev] + (f.reachable ? WEIGHT.reachable : 0)
    + (f.exploited ? WEIGHT.exploited : 0) + (f.fix ? WEIGHT.fix : 0);
}
function action(f) {
  if (f.reachable && f.exploited) return 'NOW: patch and redeploy today';
  if (f.reachable && f.fix) return 'NEXT: patch in this release';
  if (f.reachable) return 'MITIGATE: no fix yet, reduce exposure';
  if (f.fix) return 'ROUTINE: next base-image rebuild';
  return 'RECORD: note why not reachable, review later';
}
const ranked = [...findings].sort((a, b) => score(b) - score(a) || a.id.localeCompare(b.id));
for (const f of ranked) {
  console.log(`${String(score(f)).padStart(3)} ${f.sev.padEnd(8)} ${f.pkg.padEnd(8)} ${action(f)}`);
}
const bySeverity = [...findings].sort((a, b) => SEVERITY[b.sev] - SEVERITY[a.sev] || a.id.localeCompare(b.id));
console.log('first by severity only:', bySeverity[0].pkg);
console.log('first by triage       :', ranked[0].pkg);

# Generate from the image, then scan the SBOM later without pulling it
syft registry.example.com/shop/api@sha256:... -o spdx-json=sbom.spdx.json
trivy image --format cyclonedx -o sbom.cdx.json registry.example.com/shop/api@sha256:...
grype sbom:./sbom.spdx.json

# Always sign the digest, never a tag
cosign sign registry.example.com/shop/api@sha256:...

cosign verify \
  --certificate-identity "https://github.com/example-org/shop/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  registry.example.com/shop/api@sha256:...

$ docker buildx imagetools inspect localhost:18411/abcl-cr-shop:1.4 \
    --format '{{json .Provenance}}'
{
 "SLSA": {
  "buildDefinition": {
   "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
   …
   "resolvedDependencies": [
    {
     "digest": {
      "sha256": "d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc"
     },
     "uri": "pkg:docker/alpine@3.20?platform=linux%2Famd64"
    }
   ]
  },
  …

# npm: install exactly what package-lock.json says, with integrity checks
npm ci

# pip: refuse any file whose hash is not listed
pip install --require-hashes -r requirements.txt