feat(bootstrap): 先校验 SHA256SUMS 再运行下载的 felis，固定 k3s、cloudflared 与 registry 镜像版本

internal/platform/bootstrap_pin_test.go

@@ -0,0 +1,28 @@
+package platform
+
+import (
+	"os"
+	"regexp"
+	"testing"
+)
+
+// The renderer puts defaultRegistryImage in the registry Deployment, and bootstrap
+// caches and GC-pins REGISTRY_IMAGE in containerd. If the two drift, kubelet looks
+// for an image nobody cached or pinned, and an air-gapped box cannot start its
+// registry at all.
+func TestBootstrapPinsTheRegistryImage(t *testing.T) {
+	b, err := os.ReadFile("../../deploy/bootstrap.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := regexp.MustCompile(`(?m)^REGISTRY_IMAGE="([^"]+)"$`).FindSubmatch(b)
+	if m == nil {
+		t.Fatal("deploy/bootstrap.sh has no REGISTRY_IMAGE=\"...\" line")
+	}
+	if got := string(m[1]); got != defaultRegistryImage {
+		t.Fatalf("bootstrap REGISTRY_IMAGE = %q, renderer default = %q", got, defaultRegistryImage)
+	}
+	if !regexp.MustCompile(`@sha256:[0-9a-f]{64}$`).MatchString(defaultRegistryImage) {
+		t.Fatalf("defaultRegistryImage %q is not pinned by digest", defaultRegistryImage)
+	}
+}

internal/platform/identities.go

@@ -65,8 +65,11 @@ const (
 
 	// defaultRegistryImage is the upstream CNCF Distribution registry. It is an
 	// official, stable image and the only registry implementation the build/restore
-	// subsystems are exercised against (registry.<ns>.svc:5000).
-	defaultRegistryImage = "registry:2"
+	// subsystems are exercised against (registry.<ns>.svc:5000). Pinned by digest so
+	// a re-tag upstream cannot change what holds every image on the box; the tag is
+	// for humans. deploy/bootstrap.sh's REGISTRY_IMAGE caches and GC-pins this exact
+	// ref and must name the same one (TestBootstrapPinsTheRegistryImage).
+	defaultRegistryImage = "docker.io/library/registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373"
 )
 
 // Params parameterises the install bundle. Namespaces and the registry location
@@ -121,7 +124,7 @@ type Params struct {
 	// passes this value through as FELIS_IMAGE so the restore executor launches its
 	// `felis restore` Job using the very same image.
 	FelisImage string
-	// RegistryImage is the in-cluster registry image. Defaults to registry:2.
+	// RegistryImage is the in-cluster registry image. Defaults to registry 2.8.3, by digest.
 	RegistryImage string
 	// BackupPVC is the name of the world-archive PersistentVolumeClaim. The bundle
 	// RENDERS this PVC (backupPVC in workloads.go, Minecraft namespace — where every