Add parsing of Docker sha256 fixations

[hermanbanken]

Fixes #3329,
Fixes #3189,
Fixes #3080,
Fixes #3009, see also #3009 (comment)
Fixes #929

The proposal is to largely ignore the SHA as far as flux is concerned. Workloads with fixated docker ID's to a specific sha256 should not be updated automatically anyway.

Allowing docker sha256 is extremely important security wise. If you trust a Docker registry today, that does not mean that some bad actor can’t take over and releases containers with backdoors the next day. Not having support for this is dangerous, as people might be tempted to remove the sha256, while it is there for good reasons: you can only vet the code currently in a git repository, and you can't take responsibility for the security mechanisms used by the owner of the repository.

Details

We have registry scanning disabled, but still we see warning about the cache warmer not understanding our ImageID's.

flux/pkg/registry/cache/warming.go

Line 180 in 2dc2680

errorLogger.Log("err", errors.Wrap(err, "requesting tags"))

outputs:

requesting tags: mux: variable "hermanbanken/https-redirect@sha256" doesn't match, expected "^(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?/)?[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$"

[kingdonb]

Thanks for documenting so well what issues it targets!

I believe I am familiar with this problem and I have read some of the reports you're referencing. I have to review your PR and do some testing. I see a change in the Ref spec which is exported, this could be potentially considered as a breaking change, but I'm not sure. (I am pretty green at golang – sorry for this.) It seems safe since it is only adding a field.

I am going to try to include this in my upcoming release, bearing all that in mind I hope we will be able to test it in a prerelease shortly 👍 thanks so much!

[kingdonb]

I've rebased this into the omnibus branch that I am using to stage the 1.22.0 release.

[kingdonb]

LGTM 👍 💯