@caelo-cms/provisioning 0.10.64 → 0.10.66

package/src/upgrader-job.ts

@@ -70,11 +70,13 @@ import {
 import { restoreCommand, takeSqlBackup } from "./upgrade/backup.js";
 import {
   findServingImage,
+  findTemplateImageDigest,
   lookupFailure,
   resolveGcpResourceName,
   servingImageDigests,
 } from "./upgrade/gcp-lookup.js";
 import type { HealthProbe } from "./upgrade/health.js";
+import { platformDigestsOf, type ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseImageRef } from "./upgrade/release-images.js";
 import { assessUpgradeRequest, type RefusalCode } from "./upgrader-assess.js";
 import {
@@ -166,6 +168,13 @@ export interface UpgraderJobDeps {
   readonly iam: IamTester;
   /** fetchVerifiedReleaseManifest against the fixed registry. */
   readonly fetchManifest: (version: string) => Promise<ReleaseManifestResult>;
+  /**
+   * Every digest a release image is known by (#1025): the signed platform
+   * digests, else the content-checked index from the fixed mirror
+   * (createReleaseImageForms). One instance per run, so each index is read
+   * at most once.
+   */
+  readonly imageForms: ReleaseImageForms;
   /**
    * Take the install's state lock (the one `pulumi up`, `state migrate` and
    * the CLI `upgrade` hold) right before the run's first write; returns its
@@ -384,10 +393,16 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     if (!serving.ok) {
       return stopWith("failed", ["lookup"], `Nothing was changed: ${serving.error}.`);
     }
-    if (!recordMatchesServing(meta.imageDigests, serving.digests)) {
+    if (!recordMatchesServing(meta, serving.digests)) {
       // #860 — re-record the serving release ourselves, but only one whose
-      // admin AND gateway images a signed release manifest names.
-      const found = await findServingRelease(meta, serving.digests, deps);
+      // admin AND gateway images a signed release manifest names, as its
+      // index or a platform manifest inside it (#1025).
+      const found = await findServingRelease(meta, serving.digests, {
+        run: deps.run,
+        fetchManifest: deps.fetchManifest,
+        imageForms: deps.imageForms,
+        hintDigests: () => templateDigests(deps, serving.services),
+      });
       if (!found.ok) {
         if (found.retryable) return stopWith("failed", ["registry"], found.reason);
         // #815 — the serving images were read without the lock: a run that
@@ -400,14 +415,17 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
         }
         return stopWith("needs_cloud_shell", ["install-state-drift"], found.reason);
       }
-      // The manifest's digests, not the serving ones: the signed form is the
-      // one every later comparison and deploy uses (gcp-lookup.ts ServingImage).
+      // The manifest's index digests, not the serving ones: the signed form
+      // is the one every deploy pins. The linux/amd64 forms go next to them
+      // (#1025), so the next run matches what Cloud Run records directly.
+      const { platformDigests: _stale, ...rest } = meta;
       meta = {
-        ...meta,
+        ...rest,
         imageDigests: {
           admin: found.manifest.digests.admin,
           gateway: found.manifest.digests.gateway,
         },
+        ...(found.platformDigests ? { platformDigests: found.platformDigests } : {}),
         releaseVersion: found.manifest.version,
       };
       // Judged against now, written under the lock once decided (#815).
@@ -562,9 +580,23 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
         // never "succeeded" while the records name the previous release).
         recordDigests: async (digests) => {
           r.phase("record");
+          // #1025 — both forms, so the next run recognises what Cloud Run
+          // records without a registry lookup. Not knowing the platform form
+          // is no failure: the next run then reads the index itself.
+          const platform = await platformDigestsOf(digests, deps.imageForms, m);
+          if (!platform.ok) {
+            r.warn(
+              `install.json records ${m.version} by its image indexes only; their linux/amd64 forms could not be read (${platform.message}). The next update reads them from the release registry.`,
+            );
+          }
           try {
-            const fresh = deps.readInstall() ?? meta;
-            deps.writeInstall({ ...fresh, imageDigests: digests, releaseVersion: m.version });
+            const { platformDigests: _previous, ...fresh } = deps.readInstall() ?? meta;
+            deps.writeInstall({
+              ...fresh,
+              imageDigests: digests,
+              ...(platform.ok ? { platformDigests: platform.platformDigests } : {}),
+              releaseVersion: m.version,
+            });
             r.info(`Recorded ${m.version} as this install's release.`);
           } catch (e) {
             recordError = errorText(e);
@@ -659,10 +691,17 @@ export async function recordUpdateEnd(
 }
 
 /** Every digest the revisions serving traffic are known by, per service. */
-async function servingDigests(
-  deps: UpgraderJobDeps,
-): Promise<{ ok: true; digests: ServingDigests } | { ok: false; error: string }> {
+async function servingDigests(deps: UpgraderJobDeps): Promise<
+  | {
+      ok: true;
+      digests: ServingDigests;
+      /** The services' deployed names, for the template hints. */
+      services: Readonly<Record<RollSlug, string>>;
+    }
+  | { ok: false; error: string }
+> {
   const digests: Partial<Record<RollSlug, readonly string[]>> = {};
+  const services: Partial<Record<RollSlug, string>> = {};
   for (const slug of ["admin", "gateway"] as const) {
     const prefix = `${gcpNamePrefix(deps.env)}-${slug}`;
     const service = await resolveGcpResourceName(
@@ -678,8 +717,30 @@ async function servingDigests(
     const image = await findServingImage(deps.run, deps.projectId, deps.region, service.name);
     if (!image) return { ok: false, error: `could not read which image the ${slug} serves` };
     digests[slug] = servingImageDigests(image);
+    services[slug] = service.name;
+  }
+  return {
+    ok: true,
+    digests: digests as ServingDigests,
+    services: services as Record<RollSlug, string>,
+  };
+}
+
+/**
+ * The index digests the services' templates pin (#1025): hints for which
+ * release to check when the serving revisions name only platform digests,
+ * which carry no release tag.
+ */
+async function templateDigests(
+  deps: UpgraderJobDeps,
+  services: Readonly<Record<RollSlug, string>>,
+): Promise<ServingDigests> {
+  const out: Partial<Record<RollSlug, readonly string[]>> = {};
+  for (const slug of ["admin", "gateway"] as const) {
+    const d = await findTemplateImageDigest(deps.run, deps.projectId, deps.region, services[slug]);
+    out[slug] = d ? [d] : [];
   }
-  return { ok: true, digests: digests as ServingDigests };
+  return out as ServingDigests;
 }
 
 async function recordFacts(

package/src/upgrader-records.test.ts

@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Which signed release serves (#860, #1025), with the shapes recorded on
+ * live installs: the serving revisions name the linux/amd64 platform
+ * manifests (`2e75…`, `d24f…`), the signed v0.10.64 manifest and
+ * install.json the indexes (`bcda…`, `fbb0…`) that list them next to one
+ * attestation manifest each.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { GcloudResult } from "./gcloud.js";
+import type { InstallMetadata } from "./install-state.js";
+import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import {
+  ADMIN_AMD64,
+  ADMIN_ATTESTATION,
+  ADMIN_INDEX,
+  fakeRegistryFetch,
+  GATEWAY_AMD64,
+  GATEWAY_INDEX,
+} from "./upgrade/__tests__/live-indexes.js";
+import { createReleaseImageForms } from "./upgrade/image-forms.js";
+import {
+  findServingRelease,
+  recordMatchesServing,
+  type ServingDigests,
+  type ServingReleaseDeps,
+} from "./upgrader-records.js";
+
+const D = (c: string) => `sha256:${c.repeat(64)}`;
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+
+const V064: ReleaseManifest = {
+  manifestVersion: 1,
+  version: "0.10.64",
+  channel: "stable",
+  digests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, ops: D("c") },
+  minFromVersion: "0.10.0",
+  infraContractVersion: 13,
+  migrations: { contract: false, lastContractVersion: null, head: "0338_x" },
+  security: false,
+  advisories: [],
+};
+
+const META: InstallMetadata = {
+  installId: "gcp-firebase-acme",
+  provider: "gcp-firebase",
+  projectId: "acme",
+  domain: "acme.com",
+  ownerEmail: "owner@acme.com",
+  region: "europe-west1",
+  createdAt: "2026-01-01T00:00:00Z",
+  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+  releaseVersion: "0.10.64",
+  infraContractVersion: 13,
+};
+
+/** What the serving revisions read back as on searchviu-website (spec = status). */
+const LIVE_SERVING: ServingDigests = { admin: [ADMIN_AMD64], gateway: [GATEWAY_AMD64] };
+
+function deps(
+  opts: {
+    manifests?: Record<string, ReleaseManifest>;
+    calls?: string[];
+    registry?: Parameters<typeof fakeRegistryFetch>[1];
+    /** `gcloud artifacts docker tags list` answers: version → digest, per slug. */
+    tags?: Partial<Record<"admin" | "gateway", Record<string, string>>>;
+    hints?: ServingDigests;
+  } = {},
+): ServingReleaseDeps & { fetched: string[] } {
+  const fetched: string[] = [];
+  const manifests = opts.manifests ?? { "0.10.64": V064 };
+  return {
+    fetched,
+    run: async (args) => {
+      const line = args.join(" ");
+      const slug = /\/(admin|gateway) /.exec(`${line} `)?.[1] as "admin" | "gateway" | undefined;
+      if (line.startsWith("artifacts docker tags list") && slug) {
+        const tags = opts.tags?.[slug] ?? {};
+        return ok(
+          Object.entries(tags)
+            .map(
+              ([v, d]) => `projects/p/locations/l/repositories/r/packages/${slug}/tags/${v}\t${d}`,
+            )
+            .join("\n"),
+        );
+      }
+      return ok("");
+    },
+    fetchManifest: async (version): Promise<ReleaseManifestResult> => {
+      fetched.push(version);
+      const m = manifests[version];
+      return m
+        ? { ok: true, manifest: m }
+        : {
+            ok: false,
+            error: { code: "registry", message: `no release manifest for v${version}` },
+          };
+    },
+    imageForms: createReleaseImageForms(fakeRegistryFetch(opts.calls ?? [], opts.registry)),
+    ...(opts.hints ? { hintDigests: async () => opts.hints as ServingDigests } : {}),
+  };
+}
+
+describe("recordMatchesServing", () => {
+  it("regression #1025: the index alone does not match what Cloud Run reports", () => {
+    expect(recordMatchesServing(META, LIVE_SERVING)).toBe(false);
+  });
+
+  it("matches by the recorded platform forms", () => {
+    const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
+    expect(recordMatchesServing(both, LIVE_SERVING)).toBe(true);
+    // Still by the index when a revision names it.
+    expect(recordMatchesServing(META, { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] })).toBe(
+      true,
+    );
+  });
+
+  it("both services must match, and no record never matches", () => {
+    const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
+    expect(recordMatchesServing(both, { admin: [ADMIN_AMD64], gateway: [D("6")] })).toBe(false);
+    expect(recordMatchesServing({}, LIVE_SERVING)).toBe(false);
+  });
+});
+
+describe("findServingRelease", () => {
+  it("regression #1025: identifies v0.10.64 from the platform digests inside its signed indexes", async () => {
+    const calls: string[] = [];
+    const d = deps({ calls });
+    const r = await findServingRelease(META, LIVE_SERVING, d);
+    expect(r).toEqual({
+      ok: true,
+      manifest: V064,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 },
+    });
+    expect(d.fetched).toEqual(["0.10.64"]);
+    expect(calls).toHaveLength(2);
+  });
+
+  it("an attestation manifest of the index is not a serving image of the release", async () => {
+    const r = await findServingRelease(
+      META,
+      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64] },
+      deps(),
+    );
+    expect(r.ok).toBe(false);
+    expect(r.ok ? "" : r.reason).toContain(
+      "The gateway serves v0.10.64's image, the admin does not.",
+    );
+  });
+
+  it("uses the signed platform digests without reading the index", async () => {
+    const calls: string[] = [];
+    const signed = {
+      ...V064,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64, ops: D("3") },
+    };
+    const r = await findServingRelease(
+      META,
+      LIVE_SERVING,
+      deps({ calls, manifests: { "0.10.64": signed } }),
+    );
+    expect(r.ok).toBe(true);
+    expect(calls).toEqual([]);
+  });
+
+  it("a digest in no signed index is still refused with the current message", async () => {
+    const r = await findServingRelease(META, { admin: [D("7")], gateway: [D("6")] }, deps());
+    expect(r).toMatchObject({ ok: false, retryable: false });
+    expect(r.ok ? "" : r.reason).toContain(
+      "are not the ones install.json names, and they do not belong to one signed Caelo release",
+    );
+    expect(r.ok ? "" : r.reason).toContain(`admin ${D("7")}`);
+  });
+
+  it("a registry outage reading the index is retryable, a tampered index is not", async () => {
+    const down = await findServingRelease(META, LIVE_SERVING, deps({ registry: { status: 503 } }));
+    expect(down).toMatchObject({ ok: false, retryable: true });
+    expect(down.ok ? "" : down.reason).toContain("could not be reached");
+
+    const tampered = await findServingRelease(
+      META,
+      LIVE_SERVING,
+      deps({ registry: { tampered: new TextEncoder().encode("{}") } }),
+    );
+    expect(tampered).toMatchObject({ ok: false, retryable: false });
+    expect(tampered.ok ? "" : tampered.reason).toContain("could not be verified");
+  });
+
+  it("finds the release by the template's index when install.json names none", async () => {
+    const { releaseVersion: _none, ...unversioned } = META;
+    const meta = { ...unversioned, imageDigests: { admin: D("9"), gateway: D("8") } };
+    const d = deps({
+      tags: { admin: { "0.10.64": ADMIN_INDEX } },
+      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] },
+    });
+    const r = await findServingRelease(meta, LIVE_SERVING, d);
+    expect(r.ok && r.manifest.version).toBe("0.10.64");
+    expect(d.fetched).toEqual(["0.10.64"]);
+  });
+});

package/src/upgrader-records.ts

@@ -15,6 +15,12 @@
  * Images that belong to no signed release are a deployment nobody can
  * vouch for, so the run stops and says so.
  *
+ * A serving image is a release's image when its digest is one of that
+ * image's forms (#1025, upgrade/image-forms.ts): the index the manifest
+ * signs, or a platform manifest inside it. Cloud Run records the
+ * linux/amd64 platform manifest it resolved, so comparing with the index
+ * alone never matched on a live install.
+ *
  * Which releases to try comes from untrusted hints — the version
  * install.json names, and the release tags pointing at the serving digests
  * in the fixed mirror (releaseVersionForDigest). A wrong hint costs one
@@ -25,6 +31,7 @@ import type { GcloudRunner } from "./gcloud-retry.js";
 import type { ImageDigests, InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
 import type { RollSlug } from "./upgrade/app-roll.js";
+import type { ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseVersionForDigest } from "./upgrade/release-images.js";
 
 /** Every digest each serving image is known by (gcp-lookup.ts servingImageDigests). */
@@ -32,18 +39,35 @@ export type ServingDigests = Readonly<Record<RollSlug, readonly string[]>>;
 
 const SLUGS: readonly RollSlug[] = ["admin", "gateway"];
 
-/** Whether `recorded` names the images that serve, in any form they are known by. */
+/**
+ * Whether install.json names the images that serve: per service, the
+ * recorded index digest or its recorded linux/amd64 form (#1025) is one of
+ * the digests the serving revision is known by.
+ */
 export function recordMatchesServing(
-  recorded: ImageDigests | undefined,
+  recorded: Pick<InstallMetadata, "imageDigests" | "platformDigests">,
   serving: ServingDigests,
 ): boolean {
-  if (!recorded) return false;
-  return SLUGS.every((slug) => serving[slug].includes(recorded[slug]));
+  const { imageDigests, platformDigests } = recorded;
+  if (!imageDigests) return false;
+  return SLUGS.every(
+    (slug) =>
+      serving[slug].includes(imageDigests[slug]) ||
+      (platformDigests !== undefined && serving[slug].includes(platformDigests[slug])),
+  );
 }
 
 /** What {@link findServingRelease} learned. */
 export type ServingRelease =
-  | { readonly ok: true; readonly manifest: ReleaseManifest }
+  | {
+      readonly ok: true;
+      readonly manifest: ReleaseManifest;
+      /**
+       * The linux/amd64 form of each of its images (#1025), to record next
+       * to the index digests; null when it is not known for both.
+       */
+      readonly platformDigests: ImageDigests | null;
+    }
   | {
       readonly ok: false;
       /**
@@ -62,6 +86,15 @@ export interface ServingReleaseDeps {
   readonly run: GcloudRunner;
   /** fetchVerifiedReleaseManifest against the fixed registry. */
   readonly fetchManifest: (version: string) => Promise<ReleaseManifestResult>;
+  /** Every digest a release image is known by (#1025; createReleaseImageForms). */
+  readonly imageForms: ReleaseImageForms;
+  /**
+   * The image digests the services' templates name (the index a deploy
+   * pinned; after a rollback, possibly another release's). Untrusted hints
+   * for which release tags to look up, asked only when nothing else found
+   * the serving release.
+   */
+  readonly hintDigests?: () => Promise<ServingDigests>;
 }
 
 /**
@@ -79,7 +112,7 @@ export async function findServingRelease(
   const unverified: string[] = [];
   const unreachable: string[] = [];
   const tried: string[] = [];
-  for await (const version of candidateVersions(meta, serving, deps.run)) {
+  for await (const version of candidateVersions(meta, serving, deps)) {
     if (tried.includes(version)) continue;
     tried.push(version);
     const fetched = await deps.fetchManifest(version);
@@ -92,12 +125,21 @@ export async function findServingRelease(
       continue;
     }
     const m = fetched.manifest;
-    const matching = SLUGS.filter((slug) => serving[slug].includes(m.digests[slug]));
-    if (matching.length === SLUGS.length) return { ok: true, manifest: m };
-    if (matching.length > 0) {
-      const other = SLUGS.filter((s) => !matching.includes(s));
+    const judged = await judgeRelease(m, serving, deps.imageForms);
+    if (judged.kind === "unreadable") {
+      // The index could not be read, so this release is neither confirmed
+      // nor ruled out: an outage is retried, anything else is a release
+      // record that could not be verified.
+      (judged.transient ? unreachable : unverified).push(`v${version} (${judged.message})`);
+      continue;
+    }
+    if (judged.matching.length === SLUGS.length) {
+      return { ok: true, manifest: m, platformDigests: judged.platformDigests };
+    }
+    if (judged.matching.length > 0) {
+      const other = SLUGS.filter((s) => !judged.matching.includes(s));
       partial.push(
-        `the ${matching.join(", ")} serves v${m.version}'s image, the ${other.join(", ")} does not`,
+        `the ${judged.matching.join(", ")} serves v${m.version}'s image, the ${other.join(", ")} does not`,
       );
     }
   }
@@ -125,6 +167,51 @@ export async function findServingRelease(
   };
 }
 
+/** Which of release `m`'s images serve, by {@link judgeRelease}. */
+type ReleaseJudgement =
+  | {
+      readonly kind: "judged";
+      readonly matching: readonly RollSlug[];
+      readonly platformDigests: ImageDigests | null;
+    }
+  | { readonly kind: "unreadable"; readonly transient: boolean; readonly message: string };
+
+/**
+ * Which of `m`'s images serve. A serving digest equal to the signed index
+ * matches without a lookup; any other is compared with the image's
+ * platform forms (signed, or read from the content-checked index).
+ */
+async function judgeRelease(
+  m: ReleaseManifest,
+  serving: ServingDigests,
+  imageForms: ReleaseImageForms,
+): Promise<ReleaseJudgement> {
+  const matching: RollSlug[] = [];
+  const platform: Partial<Record<RollSlug, string>> = {};
+  for (const slug of SLUGS) {
+    if (serving[slug].includes(m.digests[slug])) {
+      matching.push(slug);
+      const signed = m.platformDigests?.[slug];
+      if (signed) platform[slug] = signed;
+      continue;
+    }
+    const forms = await imageForms.of(m, slug);
+    if (!forms.ok)
+      return { kind: "unreadable", transient: forms.transient, message: forms.message };
+    const match = serving[slug].find((d) => forms.digests.includes(d));
+    if (match) {
+      matching.push(slug);
+      if (forms.amd64) platform[slug] = forms.amd64;
+    }
+  }
+  const { admin, gateway } = platform;
+  return {
+    kind: "judged",
+    matching,
+    platformDigests: admin && gateway ? { admin, gateway } : null,
+  };
+}
+
 /**
  * Release versions worth checking, most likely first. Lazy: the version
  * install.json names usually is the serving one, and then no tag listing
@@ -133,17 +220,26 @@ export async function findServingRelease(
 async function* candidateVersions(
   meta: InstallMetadata,
   serving: ServingDigests,
-  run: GcloudRunner,
+  deps: ServingReleaseDeps,
 ): AsyncGenerator<string> {
   if (meta.releaseVersion) yield meta.releaseVersion;
-  // Release tags point at the index digest a deploy pins (the deployed form,
-  // listed first); the platform digest Cloud Run resolved has no tag.
-  for (const slug of SLUGS) {
-    for (const digest of serving[slug]) {
-      const version = await releaseVersionForDigest(run, slug, digest);
-      if (version) yield version;
+  // Release tags point at the index digest a deploy pins. The platform
+  // digest Cloud Run records for a revision (#1025) has no tag, so the
+  // indexes the service templates name are asked too: only hints, the
+  // signed manifest still decides.
+  const asked: string[] = [];
+  const tagged = async function* (digests: ServingDigests): AsyncGenerator<string> {
+    for (const slug of SLUGS) {
+      for (const digest of digests[slug]) {
+        if (asked.includes(`${slug}@${digest}`)) continue;
+        asked.push(`${slug}@${digest}`);
+        const version = await releaseVersionForDigest(deps.run, slug, digest);
+        if (version) yield version;
+      }
     }
-  }
+  };
+  yield* tagged(serving);
+  if (deps.hintDigests) yield* tagged(await deps.hintDigests());
 }
 
 function capitalize(s: string): string {

package/src/wizards/gcp.ts

@@ -120,6 +120,7 @@ import {
 } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
 import { lookupFailure, resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
+import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
   releaseVersionForDigest,
   resolveOpsImageRef,
@@ -500,7 +501,22 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // the admin can install the next update itself.
   if (upgraderReady && convergeReady && remoteMcpReady) {
     const version = releaseVersion;
-    recordImageDigests(installId, imageDigests, version);
+    // #1025 — the linux/amd64 forms Cloud Run reports, next to the indexes,
+    // so the upgrader recognises what serves without a registry lookup.
+    const platform = await platformDigestsOf(imageDigests, createReleaseImageForms());
+    if (!platform.ok) {
+      log.warn(
+        yellow(
+          `install.json records the release by its image indexes only; their linux/amd64 forms could not be read (${platform.message}). The first in-product update reads them from the release registry.`,
+        ),
+      );
+    }
+    recordImageDigests(
+      installId,
+      imageDigests,
+      version,
+      platform.ok ? platform.platformDigests : null,
+    );
     recordInfraContractVersion(installId, INFRA_CONTRACT_VERSION);
     if (!version) {
       log.warn(