nordisk/edda

crates/nornir-build-thing/examples/image_digest.rs

//! **What `[build.toolchain] image_sha256` pins, read off the engine** — the
//! MANIFEST digest of a local image, 64 lowercase hex, no `sha256:` prefix.
//!
//! MEASURED 2026-09-10: seven repos (skade · korp · Skidbladnir · draupnir ·
//! korp-collectors · znippy · znippy-zoomies) each ship a real
//! `<repo>-build-thing` cdylib recipe and were still read off their committed
//! table, because `CargoToolchain::validate` refuses an unpinned
//! `[build.toolchain]` and the code road runs the recipe's wasm32 build INSIDE
//! that container. The pin was the whole gap — and there was no door onto the
//! digest, only the sentence in the refusal telling you to shell
//! `podman image inspect --format '{{.Digest}}'`, which is the reach-around the
//! no-shelling law forbids.
//!
//! ```text
//! cargo run -p nornir-build-thing --features image-build --example image_digest
//! cargo run … --example image_digest -- nordisk-kernel-toolchain
//! ```
//!
//! Prints the bare hex and exits 0; refuses BY NAME (exit 1) when the engine is
//! unreachable, the image is absent, or the image carries no repo digest.

#[cfg(feature = "image-build")]
fn main() -> anyhow::Result<()> {
    use nornir_build_thing::image_build::BollardImageBuilder;
    let image = std::env::args()
        .nth(1)
        .unwrap_or_else(|| nornir_build_thing::cargo_container::CARGO_TOOLCHAIN_IMAGE.to_string());
    println!("{}", BollardImageBuilder::connect()?.manifest_digest(&image)?);
    Ok(())
}

#[cfg(not(feature = "image-build"))]
fn main() {
    eprintln!("image_digest needs `--features image-build` (the bollard engine leg)");
    std::process::exit(2);
}