vitessio/vitess · error

resolve golang digest for %s: %w

Error message

resolve golang digest for %s: %w

What it means

resolveGolangImageDigest queries the container registry (via go-containerregistry's crane) for the digest of the golang:<tag> image on the target platform (linux/amd64 by default). Any registry/network/plumbing failure is wrapped with this message including the full image reference.

Source

Thrown at go/tools/go-upgrade/go-upgrade.go:520

			return match
		}

		return fmt.Sprintf("%s%s@%s", prefix, golangDockerTag(goVersion, distro), digest)
	})
	if replaceErr != nil {
		return "", replaceErr
	}

	return replaced, nil
}

// resolveGolangImageDigest resolves the pinned digest for the given Go version and distro.
func resolveGolangImageDigest(goVersion *version.Version, distro string) (string, error) {
	ref := "golang:" + golangDockerTag(goVersion, distro)

	digest, err := crane.Digest(ref, crane.WithPlatform(&gocr.Platform{OS: dockerPlatformOS, Architecture: dockerPlatformArch}))
	if err != nil {
		return "", fmt.Errorf("resolve golang digest for %s: %w", ref, err)
	}

	return digest, nil
}

// golangDockerTag returns the Golang Docker tag for the given version and distro.
func golangDockerTag(goVersion *version.Version, distro string) string {
	return goVersion.String() + "-" + distro
}

func updateBootstrapVersionInCodebase(old, new string, newGoVersion *version.Version) error {
	if old == new {
		return nil
	}
	files, err := getListOfFilesInPaths([]string{
		"./Makefile",
	})
	if err != nil {

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Verify the image tag exists: `docker manifest inspect golang:<tag>` — if not, the Go version/distro combo isn't published yet; wait or use an available tag
2. Check network/registry access and proxy settings; authenticate if needed (docker login / registry credentials)
3. If rate-limited, retry with backoff or use an authenticated Docker Hub account
4. Confirm the platform (linux/amd64) has a published manifest for the tag, or adjust dockerPlatformOS/dockerPlatformArch

Example fix

// before: transient rate-limit failure
digest, err := crane.Digest(ref, ...)
// after: caller-side retry
err = retry.Do(func() error {
    digest, err = crane.Digest(ref, crane.WithPlatform(&gocr.Platform{OS: "linux", Architecture: "amd64"}))
    return err
}, retry.Attempts(3), retry.Delay(time.Second))

ref := "golang:" + golangDockerTag(goVersion, distro)
// reachability pre-check
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
if err := pingRegistry(ctx); err != nil {
    return fmt.Errorf("registry unreachable; check network/credentials before resolving %s", ref)
}

digest, err := resolveGolangImageDigest(goVersion, distro)
if err != nil {
    return retry.Do(func() error {
        digest, err = resolveGolangImageDigest(goVersion, distro)
        return err
    }, retry.Attempts(3), retry.DelayType(retry.BackOffDelay))
}

When it happens

Trigger: Calling replaceGolangImageReferences during go-upgrade when crane.Digest fails: registry unreachable, image tag doesn't exist (unpublished tag), authentication required, rate limiting, or no manifest for the requested OS/architecture platform.

Common situations: Requesting a golang tag for a version/distro combination not yet published to Docker Hub; corporate proxy blocking registry access; Docker Hub rate limits on CI runners; offline environments.

Related errors

• golang version malformatted: %s
• malformatted golang image reference: %s
• missing golang digest for distro %s
• gRPC connection wait time exceeded
• SplitHostPort: missing port in %q

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/324962ffc6be01c8. Report an issue: GitHub.