validateManifestDigest computes the manifest digest, and, if pulling by digest, ensures that it matches the requested digest.
(ref reference.Named, mfst distribution.Manifest)
| 132 | // validateManifestDigest computes the manifest digest, and, if pulling by |
| 133 | // digest, ensures that it matches the requested digest. |
| 134 | func validateManifestDigest(ref reference.Named, mfst distribution.Manifest) (ocispec.Descriptor, error) { |
| 135 | mediaType, canonical, err := mfst.Payload() |
| 136 | if err != nil { |
| 137 | return ocispec.Descriptor{}, err |
| 138 | } |
| 139 | desc := ocispec.Descriptor{ |
| 140 | Digest: digest.FromBytes(canonical), |
| 141 | Size: int64(len(canonical)), |
| 142 | MediaType: mediaType, |
| 143 | } |
| 144 | |
| 145 | // If pull by digest, then verify the manifest digest. |
| 146 | if digested, isDigested := ref.(reference.Canonical); isDigested && digested.Digest() != desc.Digest { |
| 147 | return ocispec.Descriptor{}, fmt.Errorf("manifest verification failed for digest %s", digested.Digest()) |
| 148 | } |
| 149 | |
| 150 | return desc, nil |
| 151 | } |
| 152 | |
| 153 | // pullManifestList handles "manifest lists" which point to various |
| 154 | // platform-specific manifests. |
no test coverage detected
searching dependent graphs…