apps: Preserve app image digest

Make `skopeo` preserve the original container image manifest so its hash
matches the hash specified in its digest reference in an app compose
project or in an image index.

Signed-off-by: Mike Sul <mike.sul@foundries.io>

Author: mike-sul

apps/target_apps_fetcher.py

@@ -183,8 +183,9 @@ def fetch_image(self, target_name: str, arch: str, image: str, dst_root_dir: str
         image_dir = os.path.join(dst_root_dir, uri.host, uri.name, uri.hash)
         os.makedirs(image_dir, exist_ok=True)
         subprocess.check_call(['skopeo', '--insecure-policy', '--override-arch', arch, 'copy',
-                               '--retry-times', '3', '--format', 'v2s2', '--dest-shared-blob-dir',
-                               self.blobs_dir(target_name), 'docker://' + image, 'oci:' + image_dir])
+                               '--preserve-digests', '--retry-times', '3', '--format', 'v2s2',
+                               '--dest-shared-blob-dir', self.blobs_dir(target_name),
+                               'docker://' + image, 'oci:' + image_dir])
 
         # Store the image manifest in the blob directory, as result it contains all blobs/nodes of
         # the app's merkle tree. It allows to check app integrity on devices with preloaded apps and