From e832dc6ad79f7132ee6be841c1314ec32d089ad9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Sat, 15 Aug 2026 17:53:33 +0800
Subject: [PATCH] fix: allow verified JD Ubuntu proxy digest

---
 .../hololake-platform/guanghu-os/README.md        |  5 ++++-
 .../scripts/linux-subcontrol-docker-backend.sh    |  2 +-
 .../test-linux-subcontrol-docker-backend.sh       | 15 +++++++++++++--
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md
index 1dcf025..8dba48b 100644
--- a/product-source/hololake-platform/guanghu-os/README.md
+++ b/product-source/hololake-platform/guanghu-os/README.md
@@ -80,7 +80,10 @@ physical cutover is implied by that source result.
 
 `scripts/linux-subcontrol-docker-backend.sh` is the first executable shadow
 backend for the Linux-hosted transition. It binds the exact JD instance,
-backend id, immutable Ubuntu image digest, and preserved GRUB rescue slot. A
+backend id, immutable Ubuntu image digest, and preserved GRUB rescue slot. It
+accepts only the direct Ubuntu repository or the explicitly approved
+`docker.m.daocloud.io/library/ubuntu` proxy needed by the JD route; arbitrary
+registry paths fail closed. A
 wake starts a networkless, read-only, capability-free container with explicit
 CPU, memory, and PID limits. Only the registered runtime-identity readback is
 accepted; reclaim removes the container and verifies `DORMANT`. Environment
diff --git a/product-source/hololake-platform/guanghu-os/scripts/linux-subcontrol-docker-backend.sh b/product-source/hololake-platform/guanghu-os/scripts/linux-subcontrol-docker-backend.sh
index 0b212f7..2becb47 100755
--- a/product-source/hololake-platform/guanghu-os/scripts/linux-subcontrol-docker-backend.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/linux-subcontrol-docker-backend.sh
@@ -55,7 +55,7 @@ done <"${config_path}"
 [[ "${instance_id}" =~ ^[0-9a-f-]{36}$ ]] || die "instance id is invalid"
 [[ "${backend_id}" =~ ^[a-z0-9-]+$ ]] || die "backend id is invalid"
 [[ "${container_name}" =~ ^[a-z0-9-]+$ ]] || die "container name is invalid"
-[[ "${image}" =~ ^ubuntu@sha256:[0-9a-f]{64}$ ]] || die "image must use an immutable Ubuntu digest"
+[[ "${image}" =~ ^(ubuntu|docker\.m\.daocloud\.io/library/ubuntu)@sha256:[0-9a-f]{64}$ ]] || die "image must use an immutable Ubuntu digest from the direct or approved proxy repository"
 [[ "${rescue_slot_id}" =~ ^[A-Za-z0-9._-]+$ ]] || die "rescue slot id is invalid"
 [[ -x "${docker_bin}" ]] || die "docker executable is unavailable"
 
diff --git a/product-source/hololake-platform/guanghu-os/scripts/test-linux-subcontrol-docker-backend.sh b/product-source/hololake-platform/guanghu-os/scripts/test-linux-subcontrol-docker-backend.sh
index 2caf540..20bd5ae 100755
--- a/product-source/hololake-platform/guanghu-os/scripts/test-linux-subcontrol-docker-backend.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-linux-subcontrol-docker-backend.sh
@@ -15,7 +15,7 @@ node_id=JD-FD-PRIMARY
 instance_id=f3d4b730-7f02-452f-975b-7091a4800431
 backend_id=jd-linux-on-demand
 container_name=guanghu-linux-subcontrol-jd
-image=ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+image=docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 rescue_slot_id=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
 EOF
 
@@ -73,7 +73,18 @@ grep -Fq -- '--read-only' "${fixture}/docker.log"
 grep -Fq -- '--cap-drop ALL' "${fixture}/docker.log"
 grep -Fq -- '--security-opt no-new-privileges' "${fixture}/docker.log"
 grep -Fq -- '--pids-limit 64' "${fixture}/docker.log"
-grep -Fq -- 'ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log"
+grep -Fq -- 'docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log"
+
+sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#ubuntu@#' "${fixture}/backend.conf"
+"${adapter}" preflight jd-linux-on-demand
+mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"
+
+sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#unapproved.example/ubuntu@#' "${fixture}/backend.conf"
+if "${adapter}" preflight jd-linux-on-demand; then
+  echo "unapproved image repository was accepted" >&2
+  exit 1
+fi
+mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"
 
 if "${adapter}" execute jd-linux-on-demand arbitrary-shell REQ-002; then
   echo "unregistered capability was accepted" >&2