Connectivity compose-templates hardcoded an unpinned image:tag (proxy even
referenced the renamed-away svc-redsocks), so the per-instance container that
actually ran pulled an unverified :latest — bypassing the cosign/digest
verification the store performs at install. Add a ${PIC_IMAGE} render variable
that resolves to the manifest's digest-pinned, verified image; the matching
pic-services templates switch to image: ${PIC_IMAGE} so the container that runs
is exactly the ref the store verified.
Verified on pic1: rendering the proxy template yields the pinned
svc-proxy@sha256 image.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
roof
c806a9bb54