Rebuilding an unchanged image can change its index digest through provenance
attestations, invalidating downstream cache despite an unchanged platform
manifest. Use the selected platform manifest as an alternate source cache
key while retaining the root manifest key for existing caches.
Capture the image manifest during the existing platform-filtered traversal,
including nested indexes and embedded manifests. Preserve the first image
manifest so malformed config or layer descriptors cannot replace its cache
identity.
Keep checksum validation and provenance pins tied to the root manifest.
Both cache keys use verified manifest digests, without restoring the
unverified DiffID fallback removed for GHSA-f2v9-hprr-32q3.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
CrazyMax
8c2d0611b6