admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

REPORT: the mirror base images ARE byte-identical to Docker Hub - measured, not assumed
gates / gates (push) Successful in 13s
Details

Browse Source 
The throttle cleared 40 minutes later, so the check was run instead of left as a
one-command IOU. 'docker pull docker.io/library/<img>' answered 'Image is up to
date' for both bases - Docker Hub's own manifest resolved to the images already
local, the ones the mirror supplied and 0.233.0 was built from. The two manifest
indexes are also identical between registries.

Also corrected in passing: the two sha256 values recorded earlier are local IMAGE
IDs, not manifest-list digests. I conflated them once during this very check, so
the report now says which is which.
This commit is contained in:
authentik Default Admin
2026-09-02 21:03:24 +02:00
parent 50312b63bc
commit 32da46cd64
1 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+17 -6
View File
@@ -92,14 +92,25 @@ resolve either base image; DooPlex holds no Docker Hub login. Both were pulled f
official Docker Hub mirror** and retagged locally, after which `build.sh` ran unmodified: official Docker Hub mirror** and retagged locally, after which `build.sh` ran unmodified:
``` ```
mirror.gcr.io/library/debian:bookworm-slim sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 debian:bookworm-slim image id sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
mirror.gcr.io/library/golang:1.24-bookworm sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac golang:1.24-bookworm image id sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac
``` ```
**GRADED HONESTLY: that these are byte-identical to Docker Hub's is KNOWN, not MEASURED here** — the **MEASURED — the identity claim is no longer taken on trust.** The throttle cleared 40 minutes later
throttle was still in force at the end of the session, so `docker manifest inspect` could not be run and the check was run rather than left for someone else:
against Hub for the comparison. The digests are recorded above precisely so the check is one command
whenever the window clears. No host configuration was changed and no daemon was restarted. - `docker pull docker.io/library/debian:bookworm-slim` and `…/golang:1.24-bookworm` both answered
**`Status: Image is up to date`**, i.e. **Docker Hub's own manifest resolved to the images already
local — the ones the mirror supplied and the ones 0.233.0 was built from.** The image ids above are
unchanged after the Hub pull. That is the decisive test: same bytes, by Docker's own resolution.
- Independently, the two manifest indexes are identical between the registries: `sha256` of the
`docker manifest inspect` body is `959bc47a76ff713a…` (debian) and `de3a17b36657e232…` (golang) on
**both** `docker.io/library/…` and `mirror.gcr.io/library/…`.
**So the shipped 0.233.0 image is byte-for-byte what a Docker-Hub build would have produced.** No host
configuration was changed and no daemon was restarted. (Note for the next reader: the two `sha256`
values above are local IMAGE IDs, not manifest-list digests — the two are easy to confuse and were
confused once during this check.)
## 6. Live validation — what was proven, and by which method ## 6. Live validation — what was proven, and by which method