...

1. All VM IMages will have the sha specified for verification
1. Current behavior - no changes here.
2. For Containers:
1. In an Image, User can OPTIONALLY specify SHA of manifest.
1. If specified, this is verified after the manifest is downloaded.
2. If Manifest SHA is NOT Specified
1. Download the manifest, Calculate the SHA and use it for internal purposes ( Image Tracking ).
2. Report the SHA back to the controller in info msg for app instance.
1. In an Image, User can OPTIONALLY specify SHA of manifest.
2. If Manifest SHA is NOT Specified
Need to add an abstraction from ImageID to SHA
3. Need to add an abstraction from ImageObjectID to SHA of the Image.
1. Currently, there is an assumption that IMAGE-OBJECT-ID is unchangeable. This needs to change.
1. This  may be true for VMs also, as we allow the VM image to be stored in a docker registry.
2. In EVE, ImageObjectID needs to be resolved to a SHA
1. Multiple images can resolve to the same SHA.
ImageID
1. ImageObjectID -> SHA is resolved during App Instance Create
1. This can be updated using the “RefreshImage” trigger
.
Currently, there is an assumption that IMAGE-ID is unchangeable. This needs to change
1. .
In EVE, Image ID needs to be resolved to a SHA

4 APPENDIX - Comment from AVI - Alternate Proposal

...