From ad0996191d247a10ce37ff251d3d520aa9ea267c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 8 Jul 2026 13:53:52 +0100 Subject: [PATCH] pull-oci: verify redirected manifest digest An OCI index redirect already carries the digest of the selected manifest. Store it in the expected checksum field so pull-job verifies the downloaded manifest instead of overwriting the digest with the computed checksum before comparison. Follow-up for a9f6ba04969d6eb2e629e30299fab7538ef42a57 --- src/import/pull-oci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/import/pull-oci.c b/src/import/pull-oci.c index 90dfee9ed4..c2d9bfeddf 100644 --- a/src/import/pull-oci.c +++ b/src/import/pull-oci.c @@ -366,7 +366,7 @@ static int oci_pull_redirect_manifest(OciPull *i, const OciIndexEntry *entry) { j->on_finished = oci_pull_job_on_finished_manifest; j->calc_checksum = true; - if (!iovec_memdup(&entry->digest, &j->checksum)) + if (!iovec_memdup(&entry->digest, &j->expected_checksum)) return -ENOMEM; j->description = strjoin("Image Manifest (", url, ")");