Add digest to source, Fixes #187, Fixes #194

[creack]

• Add support for source digest.
• Verify the resulting digest.

[pivotal-issuemaster]

@creack Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@creack Thank you for signing the Contributor License Agreement!

[vito]

Thanks for taking the time to submit this!

We're actually going to be tackling concourse/concourse#2439 very soon which will enable users to do this without any changes to this resource type (and enable users to do this for all resource types).

Would you be OK with just closing this for now in light of #190 (primarily the 'too many knobs' concern)? We should be picking up the issue I linked very soon - it's at the top of the "core" backlog and we need it done before we can continue on the "spaces" epic.

[achawki]

Since this PR addresses #194 just partly, check would still always reach out the docker registry => concourse jobs cannot be scheduled anymore in case of a registry downtime, we opened #231 . Just for discussion.

[creack]

Closing in favor of concourse/concourse#2439

This is a critical security issue, I hope it will be addressed soon.

[creack]

For reference, I've been using this in the meantime:

  - name: docker-image-digest-unchecked
    type: docker-image
    privileged: true
    source:
      repository: creack/docker-image-resource
  - name: docker-image-digest
    type: docker-image-digest-unchecked
    privileged: true
    source:
      repository: creack/docker-image-resource
      digest:     sha256:45b2409bdc9a6d49ac56a83bb32715f9389848d1c1a33a98569106c383dfa946

creack/docker-image-resource being this PR.