Function fetch_manifest_inner

vmm/src/app/registry.rs:164–212

(
    client: &Client,
    registry: &str,
    repo: &str,
    tag: &str,
    token: Option<&str>,
)

}

async fn fetch_manifest_inner(
    client: &Client,
    registry: &str,
    repo: &str,
    tag: &str,
    token: Option<&str>,
) -> Result<OciManifest> {
    let url = format!("https://{registry}/v2/{repo}/manifests/{tag}");

    let mut req = client.get(&url).header(
        "Accept",
        "application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json",
    );
    if let Some(t) = token {
        req = req.bearer_auth(t);
    }

    let response = req.send().await.context("failed to fetch manifest")?;

    if !response.status().is_success() {
        bail!(
            "failed to fetch manifest: HTTP {} {}",
            response.status(),
            response.text().await.unwrap_or_default()
        );
    }

    // Try to parse as a single manifest first
    let body = response.text().await?;
    if let Ok(manifest) = serde_json::from_str::<OciManifest>(&body) {
        if !manifest.layers.is_empty() {
            return Ok(manifest);
        }
    }

    // Might be an index/manifest list — pick the first manifest
    if let Ok(index) = serde_json::from_str::<OciIndex>(&body) {
        if let Some(first) = index.manifests.into_iter().find(|m| {
            // Prefer the non-attestation manifest
            !m.media_type
                .as_deref()
                .is_some_and(|mt| mt.contains("attestation"))
        }) {
            return fetch_manifest(client, registry, repo, &first.digest, token).await;
        }
    }

    bail!("unsupported manifest format");
}

/// Download and extract all layer blobs into `dest`.
async fn download_and_extract_layers(