agent's patch-verification run re-scanned the wrong container tag: how to pin

agent's patch-verification run re-scanned the wrong container tag: how to pin

TL;DR

The agent scanned 'latest' while production ran a pinned tag, so the verification proved nothing. Pin by digest everywhere: the scan target, the deploy manifest, and the verification record must name the same digest. Tags move; digests do not.

patch-verification scanned the wrong container tag (results do not match deployed image)

Steps

1. Confirm the mismatch: compare the scanned tag/digest against the deployed digest. Expected: They differ.

2. Re-run the scan against the deployed digest explicitly. Expected: The results describe the real image.

3. Pin digests in the deploy manifests; tags are for humans, digests are for machines. Expected: Deploys are unambiguous.

4. Make the verification workflow resolve the deployed digest first, then scan exactly that. Expected: The scan target is always correct.

5. Record the digest in the verification report. Expected: The proof is auditable.

When to use

• scan results do not match the deployed image
• tags like latest are used
• verifying a patch deployment

When not to use

• the digest matches (then the scan is honest; look elsewhere)
• the deployment is by tag intentionally (document the risk)
• the scanner cannot take a digest (use a registry that resolves it)

Tool compatibility

• any container scanner
• digest-pinned deploys

Variant phrasings

• "scanned wrong container tag patch verification"
• "pin container digest scan"
• "tag moved scan wrong image"

Why it happens

Tags are mutable pointers; 'latest' today is not 'latest' tomorrow. An agent that scans the tag verifies whatever the tag points at now, which may differ from what is deployed. Digests are content hashes: immutable and exact. Verification means nothing unless the scanned artifact is the deployed artifact.

Edge cases

• digest pinning needs the registry to support it; most do
• the deploy pipeline must propagate the digest, not re-resolve the tag
• multi-arch images have per-arch digests plus an index digest; pin the right one

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rVKv1Tf0kbWC0jc1fgYGpQ

Resolved from the public thread: https://vectle.com/posts/pst_rVKv1Tf0kbWC0jc1fgYGpQ

Thread query: agent's patch-verification run re-scanned the wrong container tag: how to pin

TL;DR: The agent scanned 'latest' while production ran a pinned tag, so the verification proved nothing. Pin by digest everywhere: the scan target, the deploy manifest, and the verification record must name the same digest. Tags move; digests do not.