# Content digest of a staged sandbox image context, shared by the box-side builder and
# the workstation-side provisioner. Path-independent: the digest covers the context's
# relative paths and file contents only, so the workstation can predict the tag a box
# will build and detect a box still serving an older one.
sandbox_image_context_hash() { # context-dir -> 12 hex chars
  local context="$1"
  [ -d "$context" ] || { echo "sandbox_image_context_hash: no context at $context" >&2; return 2; }
  ( cd "$context" && LC_ALL=C find . -type f -print0 | LC_ALL=C sort -z \
      | LC_ALL=C xargs -0 sha256sum | sha256sum | cut -c1-12 )
}