{"record":{"id":"9d498eb0a3229922","repo":"goreleaser/goreleaser","slug":"unexpected-digest-output-for-s-q","errorCode":null,"errorMessage":"unexpected digest output for %s: %q","messagePattern":"unexpected digest output for (.+?): %q","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pipe/docker/v2/baseimage.go","lineNumber":129,"sourceCode":"\t})\n}\n\n// resolveBaseImageDigest queries `docker buildx imagetools inspect` for\n// the manifest digest of the given image reference.\nfunc resolveBaseImageDigest(ctx stdctx.Context, ref string) (string, error) {\n\tcmd := exec.CommandContext(\n\t\tctx,\n\t\t\"docker\", \"buildx\", \"imagetools\",\n\t\t\"inspect\", ref,\n\t\t\"--format\", \"{{.Manifest.Digest}}\",\n\t)\n\tout, err := cmd.Output()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"docker buildx imagetools inspect %s: %w\", ref, err)\n\t}\n\tdigest := strings.TrimSpace(string(out))\n\tif !strings.HasPrefix(digest, \"sha256:\") {\n\t\treturn \"\", fmt.Errorf(\"unexpected digest output for %s: %q\", ref, digest)\n\t}\n\treturn digest, nil\n}\n","sourceCodeStart":111,"sourceCodeEnd":133,"githubUrl":"https://github.com/goreleaser/goreleaser/blob/f5edd7395693c0c6b501dc722d445d2e86af854d/internal/pipe/docker/v2/baseimage.go#L111-L133","documentation":"After `docker buildx imagetools inspect` succeeds, resolveBaseImageDigest trims the output and requires it to look like a sha256 digest. This error means the command ran but produced output without the expected `sha256:` prefix — the --format '{{.Manifest.Digest}}' query returned something else (older buildx, unexpected manifest structure, registry returning an index or error payload).","triggerScenarios":"A buildx/registry combination where .Manifest.Digest is empty or not the top-level digest; custom or very old buildx versions; images whose inspect output schema differs (e.g. attestations/indices wrapping).","commonSituations":"Outdated docker-buildx-plugin that doesn't support the --format '{{.Manifest.Digest}}' query; registries serving OCI indexes where the digest field resolves oddly.","solutions":["Upgrade docker-buildx-plugin to a recent version that supports the inspect --format query.","Run the inspect command manually to inspect the actual output and registry behavior.","Pin a known-good base image tag and verify `docker buildx imagetools inspect --format '{{.Manifest.Digest}}' <ref>` returns a sha256 digest."],"exampleFix":"// before\n$ docker buildx version  # 0.8.x\n// after\n$ docker buildx upgrade  # >= 0.12, supporting Manifest.Digest format query","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"docker\", \"buildx\", \"imagetools\", \"inspect\", ref,\n    \"--format\", \"{{.Manifest.Digest}}\").Output()\nif err != nil || !strings.HasPrefix(strings.TrimSpace(string(out)), \"sha256:\") {\n    return errors.New(\"buildx too old or registry output unsupported; upgrade docker-buildx-plugin\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unexpected digest output\") {\n    // upgrade buildx or inspect the registry response manually\n}","preventionTips":["Keep docker-buildx-plugin current (>= 0.12)","Test the inspect --format query against your registry before releases","Prefer well-known registries (Docker Hub, ghcr) for base images"],"tags":["docker","buildx","digest"],"backgroundTag":"unexpected-command-output","analyzedSha":"f5edd7395693c0c6b501dc722d445d2e86af854d","analyzedAt":"2026-09-05T09:57:18.807Z","contentChangedAt":"2026-09-05T09:57:18.807Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}