Context
Follow-up from PR #2326 (port node launcher to Rust). Tracked in #2598.
Problem
The Python and Rust launchers may produce different RTMR3 measurements for the same image, breaking attestation continuity.
- Python: Sends bare hex string (without
sha256: prefix) via get_bare_digest() as the EmitEvent payload
- Rust: Sends
image_hash.as_ref().to_vec() as bytes
If as_ref() returns the full sha256:... string or raw binary (not the bare hex), the RTMR3 measurement will differ.
Action
- Confirm what
DockerSha256Digest::as_ref() returns (bare hex? full prefixed string? raw bytes?)
- Compare against Python's
get_bare_digest() output for the same image
- If they differ, fix the Rust side to match Python (or coordinate a migration)
Impact
If measurements differ, remote attestation verifiers expecting Python-era measurements will reject Rust-launcher nodes.