From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Wed, 8 Jul 2026 12:53:52 +0000 (+0100)
Subject: pull-oci: verify redirected manifest digest
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ad0996191d247a10ce37ff251d3d520aa9ea267c;p=thirdparty%2Fsystemd.git

pull-oci: verify redirected manifest digest

An OCI index redirect already carries the digest of the selected
manifest. Store it in the expected checksum field so pull-job
verifies the downloaded manifest instead of overwriting the digest
with the computed checksum before comparison.

Follow-up for a9f6ba04969d6eb2e629e30299fab7538ef42a57
---

diff --git a/src/import/pull-oci.c b/src/import/pull-oci.c
index 90dfee9ed4a..c2d9bfeddf4 100644
--- a/src/import/pull-oci.c
+++ b/src/import/pull-oci.c
@@ -366,7 +366,7 @@ static int oci_pull_redirect_manifest(OciPull *i, const OciIndexEntry *entry) {
 
         j->on_finished = oci_pull_job_on_finished_manifest;
         j->calc_checksum = true;
-        if (!iovec_memdup(&entry->digest, &j->checksum))
+        if (!iovec_memdup(&entry->digest, &j->expected_checksum))
                 return -ENOMEM;
 
         j->description = strjoin("Image Manifest (", url, ")");