# crane digest: Resolve an Image Digest

> crane digest resolves a tag to its immutable digest without pulling the image. Reference for --platform, --full-ref, and the CI errors.

Source: https://latchkey.dev/learn/command-reference/crane-digest  
Updated: 2026-06-30

crane digest returns the immutable sha256 digest for an image tag, fetched directly from the registry.

Signing, deploying, and pinning should all use a digest, not a mutable tag. crane digest is the quickest way to resolve a tag to that digest in a pipeline.

## What it does

crane digest queries the registry for the manifest of a reference and prints its sha256 digest. For a multi-arch index it returns the index digest by default; --platform returns the digest of a specific platform image within the index.

## Common usage

```Terminal
crane digest ghcr.io/org/app:ci
# capture it for a sign/deploy step
DIGEST=$(crane digest ghcr.io/org/app:ci)
cosign sign --yes ghcr.io/org/app@${DIGEST}
# digest of a specific platform
crane digest --platform linux/arm64 ghcr.io/org/app:ci
```

## Options

| Flag | What it does |
| --- | --- |
| --platform <os/arch> | Digest of a specific platform in an index |
| --full-ref | Print repo@sha256:... instead of just the digest |
| --insecure | Allow plain HTTP / skip TLS (testing) |
| crane auth login | Authenticate for private repositories |

## In CI

Resolve the digest right after a push and use it for every downstream step, signing, attesting, and deploying by digest so a moved tag cannot change what you ship. Use --platform when you need to pin a single architecture rather than the whole index.

## Common errors in CI

"MANIFEST_UNKNOWN" means the tag does not exist or the repo path is wrong. "UNAUTHORIZED" means the repo is private and crane is not logged in; run crane auth login. An empty result piped into a sign step usually means the digest command failed silently inside a subshell; check its exit code.

## FAQ

### crane digest: Resolve an Image Digest?

Signing, deploying, and pinning should all use a digest, not a mutable tag. crane digest is the quickest way to resolve a tag to that digest in a pipeline.

### What it does?

crane digest queries the registry for the manifest of a reference and prints its sha256 digest. For a multi-arch index it returns the index digest by default; --platform returns the digest of a specific platform image within the index.

### In CI?

Resolve the digest right after a push and use it for every downstream step, signing, attesting, and deploying by digest so a moved tag cannot change what you ship. Use --platform when you need to pin a single architecture rather than the whole index.

### Common errors in CI?

"MANIFEST_UNKNOWN" means the tag does not exist or the repo path is wrong. "UNAUTHORIZED" means the repo is private and crane is not logged in; run crane auth login. An empty result piped into a sign step usually means the digest command failed silently inside a subshell; check its exit code.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt