Unable to specify base image sha256 (error parsing ... as image reference)

[eriksw]

I would like to pin the exact base image used in my builds, but encountered an error.

I tried to do this by setting KO_DEFAULTBASEIMAGE to a pinned docker image reference, but get the following error:

$ KO_DEFAULTBASEIMAGE="cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" ko build --local ./cmd/dummy-lambda
Error: error creating builder: 'defaultBaseImage': error parsing "cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" as image reference: could not parse reference: cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378

Removing the tag doesn't help:

KO_DEFAULTBASEIMAGE="cgr.dev/chainguard/static@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" ko build --local ./cmd/dummy-lambda 
Error: error creating builder: 'defaultBaseImage': error parsing "cgr.dev/chainguard/static@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" as image reference: could not parse reference: cgr.dev/chainguard/static@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd37

My goal for pinning the base image to a specific sha256 is to have better reproducibility of my images, as well as have new versions of the base image trigger building/pushing new container images. (By way of having the specified base image reference be updated by automation like Renovate, then on-merge/release workflows pushing the new image.)

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Keep fresh with the 'lifecycle/frozen' label.

[Roshan-anand]

@eriksw I have noticed that the code that you have given,

$ KO_DEFAULTBASEIMAGE="cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" ko build --local ./cmd/dummy-lambda
Error: error creating builder: 'defaultBaseImage': error parsing "cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378" as image reference: could not parse reference: cgr.dev/chainguard/static:latest@sha256:6a4b683f4708f1f167ba218e31fcac0b7515d94c33c3acf223c36d5c6acd378

has a SHA256 code containing only 63 characters, but SHA256 produces 64 characters.

---

However, I also tested KO using another SHA256 image, and it is working completely fine.

❯ KO_DEFAULTBASEIMAGE="cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d" ko build --local .
2025/11/18 12:14:16 Using base cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d for sample
2025/11/18 12:14:17 Using build config main for sample
2025/11/18 12:14:17 current folder is not a git repository. Git info will not be available
2025/11/18 12:14:17 Building sample for linux/amd64
2025/11/18 12:14:18 Loading ko.local/sample-5e8ff9bf55ba3508199d22e984129be6:665313ccb2e5b404a362065448db3b3db51c8e9fea5a6dd03b06f29b38aacbbb
2025/11/18 12:14:19 Loaded ko.local/sample-5e8ff9bf55ba3508199d22e984129be6:665313ccb2e5b404a362065448db3b3db51c8e9fea5a6dd03b06f29b38aacbbb
2025/11/18 12:14:19 Adding tag latest
2025/11/18 12:14:19 Added tag latest
ko.local/sample-5e8ff9bf55ba3508199d22e984129be6:665313ccb2e5b404a362065448db3b3db51c8e9fea5a6dd03b06f29b38aacbbb