Check this receipt without trusting this site

gh attestation verify run-record-M-016-4a0512e8d6e6.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Expected output includes Verification succeeded!

NORTHSET

Proof-of-Pass Receipt

Receipt ID M-016

ISSUE / WORKfix(manager/quadlet): pass specifyReplaceString to getDep so docker:pinDigests can pin/update digests · PR #44538

CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION

RUN2m 59s

01 / TECHNICAL RESULT

Technical result

1/1

declared command passed

1/1 declared command returned exit 0 in the recorded environment

Upstream
MERGEDAPPROVED GitHub review decision
Environment
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7network phaseA:bridge,phaseB:none
Signature
verified Northset signing workflow provenance

02 / DECLARED CHECKS

Command evidence

Execution summary
1/1 declared command returned exit 0 in the recorded environment

  1. node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts

    exit 0 · 5s

unclassified executor time (derived residual) 2m54s

run wall (derived from recorded timestamps) 2m59s

Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.

03 / RECORDED IDENTITIES

Compact hashes

Patch diff SHA-256
sha256:19902c…6a49cfb
Container image digest
node@sha256:40ad9f…a6badd7
Bundle contents digest
sha256:4a0512…f759ef2
Signed asset SHA-256
sha256:215c2a…6353287

04 / PUBLIC SCOPE INTERPRETATION

Public scope interpretation

The declared network-off check runs one focused Vitest spec for Quadlet digest replacement. It does not run Renovate’s full test, lint, typecheck, or coverage gates.

05 / CLAIMS BOUNDARY

NOT INCLUDED

  • Does not prove code quality
  • Does not prove security
  • Contributor self-run record of Northset's own contribution; not the maintainer's verification.
06 / Evidence annexTechnical · provenance · full recorded values
01

Technical evidence

Code, full environment, patch, and redacted outputs

Project

renovatebot/renovate

Work

fix(manager/quadlet): pass specifyReplaceString to getDep so docker:pinDigests can pin/update digests · PR #44538

Verification execution

runtime: northset-oss executor v1
human operator: aeziz

Code

base
77da69117e70421ae034f2723f8007dd6829f142
recorded patch commit
77ba52c5b58855836bb00545c37f81cb7d2d1747
declared metadata; not execution-bound
patch diff SHA-256
sha256:19902c…6a49cfb
bound to executed patch bytes

Environment

image reference
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
repository digest
node@sha256:40ad9f…a6badd7
network
phaseA:bridge,phaseB:none
Committed patch.diff
diff --git a/lib/modules/manager/quadlet/digest-replacement.spec.ts b/lib/modules/manager/quadlet/digest-replacement.spec.ts
new file mode 100644
index 0000000000000000000000000000000000000000..05d30e92a567ad61e0584e65fa4a5f2e059b49a4
--- /dev/null
+++ b/lib/modules/manager/quadlet/digest-replacement.spec.ts
@@ -0,0 +1,32 @@
+import { codeBlock } from 'common-tags';
+import { extractPackageFile } from './extract.ts';
+
+describe('modules/manager/quadlet/digest-replacement', () => {
+  it('supports digest replacement metadata for Quadlet images', () => {
+    const image =
+      'docker.io/library/alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375';
+    const content = codeBlock`
+      [Container]
+      Image=${image}
+    `;
+
+    const result = extractPackageFile(content, 'alpine.container', {});
+
+    expect(result).toEqual({
+      deps: [
+        {
+          autoReplaceStringTemplate:
+            '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+          currentDigest:
+            'sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375',
+          currentValue: '3.23.0',
+          datasource: 'docker',
+          depName: 'docker.io/library/alpine',
+          depType: 'image',
+          packageName: 'docker.io/library/alpine',
+          replaceString: image,
+        },
+      ],
+    });
+  });
+});
diff --git a/lib/modules/manager/quadlet/extract.ts b/lib/modules/manager/quadlet/extract.ts
index f7e6dcc08f0ef4a96c4d603538e86016f1147374..dcd803533fa690036170f577976af48e65942956 100644
--- a/lib/modules/manager/quadlet/extract.ts
+++ b/lib/modules/manager/quadlet/extract.ts
@@ -40,7 +40,7 @@ function getQuadletImage(
     const cleanedImage = image
       .replace(regEx(/^docker:\/\//), '')
       .replace(regEx(/^docker-daemon:/), '');
-    const dep = getDep(cleanedImage, false, config.registryAliases);
+    const dep = getDep(cleanedImage, true, config.registryAliases);
     if (dep) {
       dep.depType = 'image';
 
Redacted stdout
=== cmd 1: node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts ===

 RUN  v4.1.10 /workspace
      Coverage enabled with v8

 ✓ lib/modules/manager/quadlet/digest-replacement.spec.ts (1 test) 7ms

 Test Files  1 passed (1)
      Tests  1 passed (1)
   Start at  18:10:44
   Duration  3.14s (transform 688ms, setup 591ms, import 1.77s, tests 7ms, environment 0ms)

<?xml version="1.0" encoding="UTF-8" ?>
<testsuites name="vitest tests" tests="1" failures="0" errors="0" time="0.006817833">
    <testsuite name="lib/modules/manager/quadlet/digest-replacement.spec.ts" timestamp="2026-07-13T18:10:47.837Z" hostname="ec0ab839a8b9" tests="1" failures="0" errors="0" skipped="0" time="0.006817833">
        <testcase classname="lib/modules/manager/quadlet/digest-replacement.spec.ts" name="modules/manager/quadlet/digest-replacement &gt; supports digest replacement metadata for Quadlet images" time="0.004128458">
        </testcase>
    </testsuite>
</testsuites>
 % Coverage report from v8

=============================== Coverage summary ===============================
Statements   : 8.09% ( 291/3595 )
Branches     : 2.79% ( 55/1971 )
Functions    : 12.76% ( 83/650 )
Lines        : 8.13% ( 289/3554 )
================================================================================
Redacted stderr
=== cmd 1: node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts ===
02

Provenance & record

Full hashes, bundle identity, attestation, and record details

Record details

payment
none · not merge-contingent
redactions
none recorded
Bundle contents digest
sha256:4a0512…f759ef2
Signed asset SHA-256
sha256:215c2a…6353287
Signed provenance recorded
verified

Full cryptographic values

Full recorded values. The compact receipt above shortens these for legibility only.

Patch diff SHA-256
sha256:19902c75871d1443d6dd3040ad366857a13c16c9b43c568a73fc7a0e86a49cfb
Container image digest
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
Bundle contents digest
sha256:4a0512e8d6e6ed0dc578b9a8f13e8551592127d98ed6a0bd9a8b5bff0f759ef2
Signed asset SHA-256
sha256:215c2a7f6a4fa32e3d4a6cf481c364f898e8fcd1b55fb136e256ae0956353287

Signed bundle

Download signed bundle

Verify this receipt

gh attestation verify run-record-M-016-4a0512e8d6e6.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Attestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.

QR → receipt page
Northset contributed this fix and ran its declared checks. Contributor self-run. Not maintainer verification.

Evidence of what ran — not a verdict that the code is good.

SELF-FUNDED FIELD-TESTING.

- - - detach here - - -

External status

Mutable upstream observation; unattested and separate from the signed run record.

PR state
MERGED
GitHub review decision
APPROVED
Upstream updated
Observed
MERGED

Linked upstream record · open linked record

All Northset work in renovatebot/renovate →

FOR MAINTAINERS

Maintain renovatebot/renovate?

Get this same run for any PR in your queue — private, free during the pilot, nothing published without your approval.

The issue form is public. Do not include secrets or private repository details there; use email instead.

Already onboarded? Add northset-verify to a PR to request a run on that PR.

Claims boundary

This page reports scoped proof-of-pass receipt evidence. It does not prove code quality, security, full CI coverage, production readiness, or maintainer approval. An attestation confirms bundle provenance; it does not broaden the receipt's claim.

Read the full Claims Boundary policy.