What causes "unexpected digest output for %s: %q" in goreleaser/goreleaser?

Upgrade docker-buildx-plugin to a recent version that supports the inspect --format query.

unexpected digest output for %s: %q

Error message

unexpected digest output for %s: %q

What it means

After `docker buildx imagetools inspect` succeeds, resolveBaseImageDigest trims the output and requires it to look like a sha256 digest. This error means the command ran but produced output without the expected `sha256:` prefix — the --format '{{.Manifest.Digest}}' query returned something else (older buildx, unexpected manifest structure, registry returning an index or error payload).

Source

Thrown at internal/pipe/docker/v2/baseimage.go:129

	})
}

// resolveBaseImageDigest queries `docker buildx imagetools inspect` for
// the manifest digest of the given image reference.
func resolveBaseImageDigest(ctx stdctx.Context, ref string) (string, error) {
	cmd := exec.CommandContext(
		ctx,
		"docker", "buildx", "imagetools",
		"inspect", ref,
		"--format", "{{.Manifest.Digest}}",
	)
	out, err := cmd.Output()
	if err != nil {
		return "", fmt.Errorf("docker buildx imagetools inspect %s: %w", ref, err)
	}
	digest := strings.TrimSpace(string(out))
	if !strings.HasPrefix(digest, "sha256:") {
		return "", fmt.Errorf("unexpected digest output for %s: %q", ref, digest)
	}
	return digest, nil
}

View on GitHub (pinned to f5edd73956)

Solutions

Upgrade docker-buildx-plugin to a recent version that supports the inspect --format query.
Run the inspect command manually to inspect the actual output and registry behavior.
Pin a known-good base image tag and verify `docker buildx imagetools inspect --format '{{.Manifest.Digest}}' <ref>` returns a sha256 digest.

Example fix

// before
$ docker buildx version  # 0.8.x
// after
$ docker buildx upgrade  # >= 0.12, supporting Manifest.Digest format query

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("docker", "buildx", "imagetools", "inspect", ref,
    "--format", "{{.Manifest.Digest}}").Output()
if err != nil || !strings.HasPrefix(strings.TrimSpace(string(out)), "sha256:") {
    return errors.New("buildx too old or registry output unsupported; upgrade docker-buildx-plugin")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "unexpected digest output") {
    // upgrade buildx or inspect the registry response manually
}

Prevention

Keep docker-buildx-plugin current (>= 0.12)
Test the inspect --format query against your registry before releases
Prefer well-known registries (Docker Hub, ghcr) for base images

When it happens

Trigger: A buildx/registry combination where .Manifest.Digest is empty or not the top-level digest; custom or very old buildx versions; images whose inspect output schema differs (e.g. attestations/indices wrapping).

Common situations: Outdated docker-buildx-plugin that doesn't support the --format '{{.Manifest.Digest}}' query; registries serving OCI indexes where the digest field resolves oddly.

Related errors

AI-assisted analysis of goreleaser/goreleaser@f5edd73956 (2026-09-05). Data as JSON: /api/errors/9d498eb0a3229922. Report an issue: GitHub.