Method Download

pkg/blobmanager/oci/backend.go:208–248

(_ context.Context, w io.Writer, digest string)

}

func (b *Backend) Download(_ context.Context, w io.Writer, digest string) error {
	if digest == "" {
		return errors.New("digest is empty")
	}

	ref, err := name.ParseReference(b.resourcePath(digest))
	if err != nil {
		return fmt.Errorf("parsing reference: %w", err)
	}

	img, err := remote.Image(ref, remote.WithAuthFromKeychain(b.keychain))
	if err != nil {
		return fmt.Errorf("getting image: %w", err)
	}

	if err := validateImage(img, digest); err != nil {
		return fmt.Errorf("validating image: %w", err)
	}

	// Download the layer with the same digest, not relying on the image name
	l, err := img.LayerByDiffID(v1.Hash{Algorithm: "sha256", Hex: digest})
	if err != nil {
		return fmt.Errorf("getting layer with hash sha256:%s: %w", digest, err)
	}

	// Do not uncompress since we want the raw stored data
	rc, err := l.Compressed()
	if err != nil {
		return fmt.Errorf("extracting data from layer: %w", err)
	}

	defer rc.Close()
	// 1MB buffer
	buf := make([]byte, 1<<20)
	_, err = io.CopyBuffer(w, rc, buf)
	if err != nil {
		return fmt.Errorf("copying data from layer: %w", err)
	}

	return nil
}

// validateImage checks that the image was crafted by chainloop and contains the expected content
func validateImage(img v1.Image, digest string) error {