build: verify SOCI and Nydus artifacts

Dockerfile

@@ -42,13 +42,13 @@ ARG BUILDG_VERSION=v0.5.3@BINARY
 ARG GOMODJAIL_VERSION=v2.0.1@5924a4079d0f70459a10973f715238dc336478ea
 
 # Test deps
-# Currently, the Docker Official Images and the test deps are not pinned by the hash
+# Docker Official Images intentionally track their latest revisions
 ARG GO_VERSION=1.26
 ARG UBUNTU_VERSION=26.04
-ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2
-ARG NYDUS_VERSION=v2.4.5
-ARG SOCI_SNAPSHOTTER_VERSION=0.16.1
-ARG KUBO_VERSION=v0.43.1
+ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2@3025bfd6df7b4c11ad69cc7bb0bc0874ecdf901a
+ARG NYDUS_VERSION=v2.4.5@BINARY
+ARG SOCI_SNAPSHOTTER_VERSION=0.16.1@BINARY
+ARG KUBO_VERSION=v0.43.1@acc53c093810a8fe9a4bc2f023f0b1e0c1d629b5
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.10.0@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx
 
@@ -237,7 +237,7 @@ COPY --from=build-gomodjail /out/${TARGETARCH:-amd64}/* /out/bin/
 RUN echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md
 ARG CONTAINERIZED_SYSTEMD_VERSION
 RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN \
-  http::helper github::file AkihiroSuda/containerized-systemd docker-entrypoint.sh "${CONTAINERIZED_SYSTEMD_VERSION}" > /docker-entrypoint.sh && \
+  http::helper github::file AkihiroSuda/containerized-systemd docker-entrypoint.sh "${CONTAINERIZED_SYSTEMD_VERSION##*@}" > /docker-entrypoint.sh && \
   chmod +x /docker-entrypoint.sh
 
 RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \
@@ -277,18 +277,23 @@ COPY --from=ghcr.io/sigstore/cosign/cosign:v3.0.5@sha256:be924970ba7438c22e18067
 # (the static build, so that it also runs on EL hosts, whose glibc is older than what
 # the default build requires)
 ARG SOCI_SNAPSHOTTER_VERSION
-RUN fname="soci-snapshotter-${SOCI_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}-static.tar.gz" && \
+RUN SOCI_SNAPSHOTTER_VERSION=${SOCI_SNAPSHOTTER_VERSION%%@*}; \
+  fname="soci-snapshotter-${SOCI_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}-static.tar.gz" && \
   curl -o "${fname}" -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/awslabs/soci-snapshotter/releases/download/v${SOCI_SNAPSHOTTER_VERSION}/${fname}" && \
+  grep "${fname}" "/SHA256SUMS.d/soci-snapshotter-v${SOCI_SNAPSHOTTER_VERSION}" | sha256sum -c && \
   tar -C /out/bin -xvf "${fname}" soci soci-snapshotter-grpc && \
   rm -f "${fname}"
 # enable offline ipfs for integration test
 COPY --from=build-kubo /out/${TARGETARCH:-amd64}/* /out/bin/
 # install nydus components
 ARG NYDUS_VERSION
-RUN curl -o nydus-static.tgz -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/dragonflyoss/image-service/releases/download/${NYDUS_VERSION}/nydus-static-${NYDUS_VERSION}-linux-${TARGETARCH}.tgz" && \
-  tar xzf nydus-static.tgz && \
+RUN NYDUS_VERSION=${NYDUS_VERSION%%@*}; \
+  fname="nydus-static-${NYDUS_VERSION}-linux-${TARGETARCH}.tgz" && \
+  curl -o "${fname}" -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/dragonflyoss/nydus/releases/download/${NYDUS_VERSION}/${fname}" && \
+  grep "${fname}" "/SHA256SUMS.d/nydus-${NYDUS_VERSION}" | sha256sum -c && \
+  tar xzf "${fname}" && \
   mv nydus-static/nydus-image nydus-static/nydusd nydus-static/nydusify /out/bin/ && \
-  rm -rf nydus-static.tgz nydus-static
+  rm -rf "${fname}" nydus-static
 # tests need a tini-custom binary
 RUN cp /out/bin/tini /out/bin/tini-custom
 

Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5

@@ -0,0 +1,2 @@
+1ad7b793a1996577e462b0bf5c1a22e4450b9c04f7e9e99d4b274ccc92f19072  nydus-static-v2.4.5-linux-amd64.tgz
+85925af702d79fc3a8b9d501a5267ddc9f81449ff9fe94841845eb98eda84593  nydus-static-v2.4.5-linux-arm64.tgz

Dockerfile.d/SHA256SUMS.d/soci-snapshotter-v0.16.1

@@ -0,0 +1,2 @@
+2ad05a0430042885a7b2ab4a707a85250117dd39f41adc097e83a00a83ae4bc7  soci-snapshotter-0.16.1-linux-amd64-static.tar.gz
+8cea5bd515c5beda5d9e9ba3ddaadcf3e2a5fcd11ea3492630cbd91da68db8a3  soci-snapshotter-0.16.1-linux-arm64-static.tar.gz

hack/build-integration-canary.sh

@@ -42,7 +42,8 @@ dependencies=(
   containerd/fuse-overlayfs-snapshotter
   gotestyourself/gotestsum
   ipfs/kubo
-  containerd/nydus-snapshotter
+  AkihiroSuda/containerized-systemd
+  dragonflyoss/nydus
   containernetworking/plugins
   rootless-containers/rootlesskit
   opencontainers/runc
@@ -64,6 +65,7 @@ FUSE_OVERLAYFS_CHECKSUM=linux
 # Avoids the full build
 BUILDG_CHECKSUM=buildg-v
 ROOTLESSKIT_CHECKSUM=linux
+NYDUS_CHECKSUM=linux
 STARGZ_SNAPSHOTTER_CHECKSUM=linux
 # We specifically want the static ones
 TINI_CHECKSUM=static