Downloaded content was hashed nowhere: OCI layer digests were only
used to build blob URLs and distro tarballs were trusted as served,
so a truncated or tampered rootfs went straight into the cache and
from there into execution.
Hash sha256 and sha512 while streaming and verify before the atomic
rename, so a bad download never enters the cache:
- OCI architecture manifests requested by digest are checked against
that digest, since the layer digests read from them are trusted
next; layer blobs are checked against the digest the manifest names.
- Direct distro tarballs are checked against the checksums published
next to them (Alpine: per-file .sha256; Ubuntu: SHA256SUMS in the
release directory). A missing or unfetchable checksum artifact
degrades to an unverified download with a warning, mirroring the
freshness-check policy; a mismatch always fails.
- Digest algorithms other than sha256/sha512 cannot be checked: warn
and accept.
vhaudiquet
2225c33ef2