Don't pivot if identical sha256

Gopkg.toml

@@ -40,3 +40,7 @@
 [[constraint]]
   branch = "master"
   name = "github.com/golang/glog"
+
+[[constraint]]
+  name = "github.com/containers/image"
+  version = "1.5.0"

cmd/root.go

@@ -7,12 +7,16 @@ import (
 	"io/ioutil"
 	"os"
 	"strings"
+	// Enable sha256 in container image references
+	_ "crypto/sha256"
 
 	"github.com/golang/glog"
 	"github.com/openshift/pivot/types"
 	"github.com/openshift/pivot/utils"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+
+	imgref "github.com/containers/image/docker/reference"
 )
 
 // flag storage
@@ -70,6 +74,46 @@ func getDefaultDeployment() types.RpmOstreeDeployment {
 	return rosState.Deployments[0]
 }
 
+// getRefDigest parses a Docker/OCI image reference and returns
+// its digest, or an error if the string fails to parse as
+// a "canonical" image reference with a digest.
+func getRefDigest(ref string) (string, error) {
+	refParsed, err := imgref.ParseNamed(ref)
+	if err != nil {
+		return "", fmt.Errorf("parsing reference: %q: %v", ref, err)
+	}
+	canon, ok := refParsed.(imgref.Canonical)
+	if !ok {
+		return "", fmt.Errorf("not canonical form: %q: %v", ref, err)
+	}
+
+	return canon.Digest().String(), nil
+}
+
+// compareOSImageURL determines whether two images are the same, or have
+// matching digests.
+func compareOSImageURL(current, desired string) (bool, error) {
+	if current == desired {
+		return true, nil
+	}
+
+	currentDigest, err := getRefDigest(current)
+	if err != nil {
+		return false, fmt.Errorf("parsing current osImageURL: %v", err)
+	}
+	desiredDigest, err := getRefDigest(desired)
+	if err != nil {
+		return false, fmt.Errorf("parsing desired osImageURL: %v", err)
+	}
+
+	if currentDigest == desiredDigest {
+		glog.Infof("Current and target osImageURL have matching digest %q", currentDigest)
+		return true, nil
+	}
+
+	return false, nil
+}
+
 // pullAndRebase potentially rebases system if not already rebased.
 func pullAndRebase(container string) (imgid string, changed bool) {
 	defaultDeployment := getDefaultDeployment()
@@ -98,7 +142,11 @@ func pullAndRebase(container string) (imgid string, changed bool) {
 	imgid = fmt.Sprintf("%s@%s", imagedata.Name, imagedata.Digest)
 	glog.Infof("Resolved to: %s", imgid)
 
-	if previousPivot == imgid {
+	targetMatched, err := compareOSImageURL(previousPivot, imgid)
+	if err != nil {
+		glog.Fatalf("%v", err)
+	}
+	if targetMatched {
 		changed = false
 		return
 	}

cmd/root_test.go

@@ -0,0 +1,32 @@
+package cmd
+
+import (
+	"testing"
+)
+
+func mustCompareOSImageURL(t *testing.T, refA, refB string) bool {
+	m, err := compareOSImageURL(refA, refB)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	return m
+}
+
+func TestCompareOSImageURL(t *testing.T) {
+	refA := "registry.example.com/foo/bar@sha256:0743a3cc3bcf3b4aabb814500c2739f84cb085ff4e7ec7996aef7977c4c19c7f"
+	refB := "registry.example.com/foo/baz@sha256:0743a3cc3bcf3b4aabb814500c2739f84cb085ff4e7ec7996aef7977c4c19c7f"
+	refC := "registry.example.com/foo/bar@sha256:2a76681fd15bfc06fa4aa0ff6913ba17527e075417fc92ea29f6bcc2afca24ff"
+	if !mustCompareOSImageURL(t, refA, refA) {
+		t.Fatalf("Expected refA ident")
+	}
+	if !mustCompareOSImageURL(t, refA, refB) {
+		t.Fatalf("Expected refA = refB")
+	}
+	if mustCompareOSImageURL(t, refA, refC) {
+		t.Fatalf("Expected refA != refC")
+	}
+	m, err := compareOSImageURL(refA, "registry.example.com/foo/bar")
+	if m || err == nil {
+		t.Fatalf("Expected err")
+	}
+}