From 5d3e95601d8c05f662ea3b7c516d431a47d9af89 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Wed, 15 Jul 2026 08:01:49 +0200
Subject: [PATCH] =?UTF-8?q?fix(pikaoa):=20=E7=A8=B3=E5=81=A5=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=20BuildKit=20=E9=95=9C=E5=83=8F=E6=91=98=E8=A6=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/src/pikaoa-test-delivery-renderer.test.ts |  3 +++
 scripts/src/pikaoa-test-delivery-renderer.ts      | 11 +++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/scripts/src/pikaoa-test-delivery-renderer.test.ts b/scripts/src/pikaoa-test-delivery-renderer.test.ts
index 6421cb61..69b79b4f 100644
--- a/scripts/src/pikaoa-test-delivery-renderer.test.ts
+++ b/scripts/src/pikaoa-test-delivery-renderer.test.ts
@@ -63,6 +63,9 @@ describe("PikaOA test PaC renderer", () => {
         expect(JSON.stringify(task)).toContain("buildctl-daemonless.sh build");
         expect(JSON.stringify(task)).toContain("$(params.revision)");
         expect(JSON.stringify(task)).not.toContain("source-token");
+        const buildScript = (((task?.taskSpec as Record<string, unknown>).steps as Array<Record<string, unknown>>)[0]?.script) as string;
+        expect(buildScript).toContain('"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)"');
+        expect(buildScript).toContain("Docker-Content-Digest:");
       }
       const sourceTask = tasks.find((item) => item.name === "source");
       expect(JSON.stringify(sourceTask)).toContain("source-token");
diff --git a/scripts/src/pikaoa-test-delivery-renderer.ts b/scripts/src/pikaoa-test-delivery-renderer.ts
index 4524142e..3a5e9e2f 100644
--- a/scripts/src/pikaoa-test-delivery-renderer.ts
+++ b/scripts/src/pikaoa-test-delivery-renderer.ts
@@ -178,8 +178,15 @@ buildctl-daemonless.sh build \\
   --opt network=${shellSingleQuote(target.build.networkMode)} \\
   --output "type=image,name=$tag,push=true" \\
   --metadata-file "$metadata"
-digest=$(grep -o '"containerimage.digest":"sha256:[0-9a-f]*"' "$metadata" | head -n1 | cut -d'"' -f4)
-case "$digest" in sha256:[0-9a-f]*) ;; *) echo 'build digest missing' >&2; exit 3;; esac
+metadata_compact=$(tr -d '\\n\\r' < "$metadata")
+digest=$(printf '%s' "$metadata_compact" | sed -n 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)".*/\\1/p' | head -n1)
+if ! printf '%s' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+  registry_host=${shellSingleQuote(imageRepository.split("/")[0] ?? "")}
+  registry_path=${shellSingleQuote(imageRepository.split("/").slice(1).join("/"))}
+  headers=$(wget --server-response --spider --header='Accept: application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' "http://$registry_host/v2/$registry_path/manifests/$revision" 2>&1 || true)
+  digest=$(printf '%s\\n' "$headers" | awk 'BEGIN{IGNORECASE=1} /^[[:space:]]*Docker-Content-Digest:/ {gsub(/\\r/, "", $2); print $2; exit}')
+fi
+case "$digest" in sha256:[0-9a-f][0-9a-f]*) test "\${#digest}" -eq 71 ;; *) echo 'build digest missing from metadata and registry manifest' >&2; exit 3;; esac
 printf '%s' "$digest" > "$(results.digest.path)"
 printf '%s@%s' ${shellSingleQuote(imageRepository)} "$digest" > "$(results.image.path)"
 printf '{"ok":true,"phase":"${taskName}","sourceCommit":"%s","imageTag":"%s","digest":"%s","valuesPrinted":false}\n' "$revision" "$tag" "$digest"