pull-oci: verify redirected manifest digest

An OCI index redirect already carries the digest of the selected
manifest. Store it in the expected checksum field so pull-job
verifies the downloaded manifest instead of overwriting the digest
with the computed checksum before comparison.

Follow-up for a9f6ba04969d6eb2e629e30299fab7538ef42a57

diff --git a/src/import/pull-oci.c b/src/import/pull-oci.c
index 90dfee9ed4a84e04106c7ef9e883ee8c4812a941..c2d9bfeddf441b8b3acabac447f2e23e58af543d 100644 (file)
--- a/src/import/pull-oci.c
+++ b/src/import/pull-oci.c
@@ -366,7 +366,7 @@ static int oci_pull_redirect_manifest(OciPull *i, const OciIndexEntry *entry) {
 
         j->on_finished = oci_pull_job_on_finished_manifest;
         j->calc_checksum = true;
-        if (!iovec_memdup(&entry->digest, &j->checksum))
+        if (!iovec_memdup(&entry->digest, &j->expected_checksum))
                 return -ENOMEM;
 
         j->description = strjoin("Image Manifest (", url, ")");