build: make pinned image inputs portable

tests/unit/test_docker_util_image.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import subprocess
 import unittest
 from datetime import timezone
-from unittest.mock import patch
+from unittest.mock import call, patch
 
 from bot_bottle.backend.docker import util as docker_mod
 
@@ -170,5 +170,59 @@ class TestImageId(unittest.TestCase):
                 die.assert_called_once()
 
 
+class TestPinnedLocalImageRef(unittest.TestCase):
+    def test_tags_and_verifies_content_derived_reference(self):
+        image = "sha256:" + "c" * 64
+        expected = "registry.example:5000/team/base:sha256-" + "c" * 64
+        with patch.object(
+            docker_mod,
+            "image_id",
+            side_effect=[image, image],
+        ) as image_id, patch.object(
+            docker_mod,
+            "run_docker",
+            return_value=_ok(),
+        ) as run:
+            self.assertEqual(
+                expected,
+                docker_mod.pinned_local_image_ref(
+                    "registry.example:5000/team/base:mutable"
+                ),
+            )
+        self.assertEqual(
+            ["docker", "image", "tag", image, expected],
+            run.call_args.args[0],
+        )
+        self.assertEqual(
+            [
+                call("registry.example:5000/team/base:mutable"),
+                call(expected),
+            ],
+            image_id.call_args_list,
+        )
+
+    def test_rejects_invalid_id_or_failed_tag(self):
+        cases = [
+            ("sha256:short", _ok()),
+            ("sha256:" + "d" * 64, _fail("tag failed")),
+        ]
+        for image, result in cases:
+            with self.subTest(image=image), patch.object(
+                docker_mod,
+                "image_id",
+                return_value=image,
+            ), patch.object(
+                docker_mod,
+                "run_docker",
+                return_value=result,
+            ), patch.object(
+                docker_mod,
+                "die",
+                side_effect=SystemExit("die"),
+            ):
+                with self.assertRaises(SystemExit):
+                    docker_mod.pinned_local_image_ref("base:latest")
+
+
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_firecracker_infra_vm.py

@@ -110,9 +110,9 @@ class TestEnsureBuilt(unittest.TestCase):
                 patch.object(infra_vm.docker_mod, "build_image") as build, \
                 patch.object(
                     infra_vm.docker_mod,
-                    "image_id",
-                    return_value="sha256:" + "a" * 64,
-                ) as image_id:
+                    "pinned_local_image_ref",
+                    return_value="bot-bottle-orchestrator:sha256-" + "a" * 64,
+                ) as pinned_ref:
             infra_vm.ensure_built()
         tags = [c.args[0] for c in build.call_args_list]
         # orchestrator-fc is FROM orchestrator, so the base is built first.
@@ -121,9 +121,12 @@ class TestEnsureBuilt(unittest.TestCase):
         self.assertEqual(infra_vm._ORCHESTRATOR_FC_IMAGE, tags[-1])
         self.assertLess(tags.index(infra_vm._ORCHESTRATOR_IMAGE),
                         tags.index(infra_vm._ORCHESTRATOR_FC_IMAGE))
-        image_id.assert_called_once_with(infra_vm._ORCHESTRATOR_IMAGE)
+        pinned_ref.assert_called_once_with(infra_vm._ORCHESTRATOR_IMAGE)
         self.assertEqual(
-            {"ORCHESTRATOR_BASE_IMAGE": "sha256:" + "a" * 64},
+            {
+                "ORCHESTRATOR_BASE_IMAGE":
+                    "bot-bottle-orchestrator:sha256-" + "a" * 64,
+            },
             build.call_args_list[-1].kwargs["build_args"],
         )