image sha changed for kong:3.9.0

[medyagh]

hello I see that the image sha for kong has changed,
this breaks tools like minikube that verify the image sha

https://github.com/kubernetes/minikube/pull/20384/files

the sha changed from
kong:3.9.0@sha256:f0c19931763dccac7f927e205c98e656eb0c106a44f86d4c56e1355055627443",
"kong:3.9.0@sha256:cf2acb894c59d3787ba073d3af28e324ff8676767e14f0d76a0aa62bbb88f9d6"

is there a valid reason for this ? could there be a mechanism/automation to prevent this from happening in the future?

[Oyami-Srk]

Hi medyagh,
I think the discussion has explained the reason for the sha256 change: #14261
Could you take a look?

[medyagh]

Thanks for linking the older issue, I missed that, I see it has been labeled as "Wont Fix"
Ideally the image SHAs should NOT change once they are published, thats the whole point of using a SHA, if a SHA of an image is changed that is considered a New Image (must get a new TAG) or it must be considered as compromised, can we make sure this doesnt happen in the future ?

[Oyami-Srk]

I think this is a fix of incorrect image. SHA change isn't likely to happend but there is no guarantee about that.

[github-actions]

This issue is marked as stale because it has been open for 14 days with no activity.