{"id":"a8213da5-1544-4e5c-b44d-be26f43f997c","task":"Pin a mutable image tag to an immutable digest and inspect an image's manifest/config without pulling it, using crane (with docker-style auth).","domain":"github.com/google/go-containerregistry","steps":["Install crane: download from GitHub Releases (https://github.com/google/go-containerregistry/releases/latest), or `go install github.com/google/go-containerregistry/cmd/crane@latest`, or `brew install crane`.","Authenticate: `crane auth login reg.example.com -u USER -p PASS` (flags: -u/--username, -p/--password, --password-stdin) — the crane analogue of `docker login`. Log out with `crane auth logout reg.example.com`. `crane auth get [REGISTRY]` implements the credential-helper protocol and prints the stored credential as JSON. Docs: cmd/crane/doc/crane_auth_login.md in the repo.","Pin a tag to its digest: `crane digest myrepo/image:latest` prints the bare `sha256:...`. Use `--full-ref` to print the complete `repo:tag@sha256:...` reference. `--tarball PATH` computes the digest of a local image tarball instead. Docs: cmd/crane/doc/crane_digest.md","Reference by digest going forward, e.g. `myrepo/image@$(crane digest myrepo/image:latest)`, to guarantee immutability regardless of tag moves.","Inspect the manifest: `crane manifest IMAGE` prints the raw JSON manifest (cmd/crane/doc/crane_manifest.md).","Inspect the config: `crane config IMAGE` prints the raw JSON config blob (entrypoint, env, labels); pipe to jq, e.g. `crane config busybox:1.33 | jq` (cmd/crane/doc/crane_config.md).","For multi-platform images, add the global `--platform os/arch[/variant]` flag to target one platform's manifest/config/digest, e.g. `crane manifest --platform=linux/arm64 IMAGE`.","Diff two versions: `diff <(crane config img:v1 | jq) <(crane config img:v2 | jq)` (from cmd/crane/recipes.md). Docs root: https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md"],"gotchas":["The global `--platform` flag defaults to `all`; against a multi-platform index you may need to narrow it explicitly to get a single platform's data.","`crane auth get` is a credential-helper backend (stdin/arg → JSON), not an interactive credential viewer.","`--insecure` (disables TLS verification) is a global flag inherited by all subcommands, not just push/copy."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:42:35.100Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:42:35.100Z"},"url":"https://mcp.waymark.network/r/a8213da5-1544-4e5c-b44d-be26f43f997c"}