fix: use version 1.7.0 of kaniko

Version 1.8.0 and above breaks reproducible builds.

https://github.com/GoogleContainerTools/kaniko/issues/2005

Dockerfile

@@ -2,7 +2,7 @@ FROM alpine as certs
 
 RUN apk --update add ca-certificates
 
-FROM gcr.io/kaniko-project/executor:debug
+FROM gcr.io/kaniko-project/executor:v1.7.0-debug
 
 SHELL ["/busybox/sh", "-c"]
 
@@ -13,7 +13,7 @@ RUN wget -O /kaniko/jq \
     https://github.com/genuinetools/reg/releases/download/v0.16.1/reg-linux-386 && \
     chmod +x /kaniko/reg && \
     wget -O /crane.tar.gz \ 
-    https://github.com/google/go-containerregistry/releases/download/v0.1.1/go-containerregistry_Linux_x86_64.tar.gz && \
+    https://github.com/google/go-containerregistry/releases/download/v0.8.0/go-containerregistry_Linux_x86_64.tar.gz && \
     tar -xvzf /crane.tar.gz crane -C /kaniko && \
     rm /crane.tar.gz
 

entrypoint.sh

@@ -94,12 +94,9 @@ EOF
 if [ ! -z $INPUT_SKIP_UNCHANGED_DIGEST ]; then
     export DIGEST=$(cat digest)
 
-    if [ "$REGISTRY" == "ghcr.io" ]; then
-        wget -q -O manifest --header "Authorization: Basic $(echo -n $USERNAME:$PASSWORD | base64 | tr -d \\n)" https://ghcr.io/v2/$REPOSITORY/manifests/latest || true
-        export REMOTE="sha256:$(cat manifest | sha256sum | awk '{ print $1 }')"
-    else
-        export REMOTE=$(reg digest -u $USERNAME -p $PASSWORD $REGISTRY/$REPOSITORY | tail -1)
-    fi
+    /kaniko/crane auth login $REGISTRY -u $USERNAME -p $PASSWORD
+
+    export REMOTE=$(crane digest $REGISTRY/${REPOSITORY}:latest)
 
     if [ "$DIGEST" == "$REMOTE" ]; then
         echo "Digest hasn't changed, skipping, $DIGEST"
@@ -109,7 +106,6 @@ if [ ! -z $INPUT_SKIP_UNCHANGED_DIGEST ]; then
 
     echo "Pushing image..."
     
-    /kaniko/crane auth login $REGISTRY -u $USERNAME -p $PASSWORD
     /kaniko/crane push image.tar $IMAGE
 
     if [ ! -z $IMAGE_LATEST ]; then