Prerequisites

• I searched existing issues

Feature Summary

Related: #745
Nodewright supports the package key: containerSHA: sha256:.... in addition to version which is used to track upgrade/downgrade logic. Update the customizations to use the sha to better address supply chain assurance.

Problem/Use Case

Supply chain attacks for nodewright-customizations

Proposed Solution

Update all recipes/nodewright-customizations to use the proper sha for their container

Example:

  packages:
    my-pkg:
      image: ghcr.io/nvidia/nodewright/example
      version: 1.2.3
      containerSHA: sha256:1234...cdef

Success Criteria

• All nodewright-customizations use the containerSHA

Alternatives Considered

No response

Component

Recipe engine / data

Priority

Nice to have

Compatibility / Breaking Changes

No response

Operational Considerations

No response

Are you willing to contribute?

Yes, I can open a PR