#!/bin/bash
set -euo pipefail

repo="clamav/clamav-debian"
tag="1.5.2-31"

echo "Attempting to resolve digest for ${repo}:${tag}..."

# Get token
token="$(curl -fsSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:${repo}:pull" 2>&1 | jq -r '.token' 2>&1)"

if [ -z "$token" ] || [ "$token" = "null" ]; then
  echo "Error: Failed to get authentication token"
  exit 1
fi

echo "Token obtained: ${token:0:20}..."

# Get digest
digest="$(
  curl -fsSI \
    -H "Authorization: Bearer ${token}" \
    -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
    "https://registry-1.docker.io/v2/${repo}/manifests/${tag}" \
  2>&1 | tr -d '\r' \
  | awk -F': ' '/Docker-Content-Digest/ {print $2}'
)"

if [ -z "$digest" ]; then
  echo "Error: Failed to resolve digest. Tag may not exist or be accessible."
  exit 1
fi

echo "Successfully resolved digest:"
echo "${repo}:${tag}@${digest}"

#!/bin/bash

# Try a simpler curl request to check if the tag exists
repo="clamav/clamav-debian"
tag="1.5.2-31"

# Get token
token=$(curl -fsSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:${repo}:pull" | jq -r '.token')

# Try to get manifest metadata (without -I flag to get more info)
echo "Checking if tag exists..."
curl -fsSL \
  -H "Authorization: Bearer ${token}" \
  -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
  "https://registry-1.docker.io/v2/${repo}/manifests/${tag}" 2>&1 | head -50

echo ""
echo "---"
echo "Attempting to list available tags..."

# Try to get tags list
curl -fsSL \
  -H "Authorization: Bearer ${token}" \
  "https://registry-1.docker.io/v2/${repo}/tags/list" 2>&1 | jq '.tags | sort | .[-10:]'

-FROM clamav/clamav-debian:1.5.2-31
+FROM clamav/clamav-debian:1.5.2-31@sha256:83f8128fadcd26bb3a177ea66b995efa6b1a22a13d11b6e4d2679681e2873bab

Verify each finding against the current code and only fix it if needed.

In @.docker/clamav.dockerfile at line 15, The Dockerfile uses a mutable tag in
the FROM instruction ("FROM clamav/clamav-debian:1.5.2-31"); replace that tag
with the corresponding immutable digest (preferably the image index digest for
multi-arch support) so the base image is pinned and reproducible—update the FROM
line to reference the canonical sha256 digest for the desired release (or
platform-specific digest if intentionally targeting amd64/arm64).