CVE-2025-24882

@@ -209,7 +209,7 @@ func (reg *Reg) referrerListByAPIPage(ctx context.Context, r ref.Ref, config sch
 	}
 
 	m, err := manifest.New(
-		manifest.WithRef(r),
+		manifest.WithRef(r.SetDigest("")),
 		manifest.WithHeader(resp.HTTPResponse().Header),
 		manifest.WithRaw(rawBody),
 	)

@@ -102,6 +102,7 @@ type manifestConfig struct {
 type Opts func(*manifestConfig)
 
 // New creates a new manifest based on provided options.
+// The digest for the manifest will be checked against the descriptor, reference, or headers, depending on which is available first (later digests will be ignored).
 func New(opts ...Opts) (Manifest, error) {
 	mc := manifestConfig{}
 	for _, opt := range opts {
@@ -113,6 +114,13 @@ func New(opts ...Opts) (Manifest, error) {
 		rawBody:   mc.raw,
 		rawHeader: mc.header,
 	}
+	if c.r.Digest != "" && c.desc.Digest == "" {
+		dig, err := digest.Parse(c.r.Digest)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse digest from ref: %w", err)
+		}
+		c.desc.Digest = dig
+	}
 	// extract fields from header where available
 	if mc.header != nil {
 		if c.desc.MediaType == "" {
@@ -446,7 +454,7 @@ func fromOrig(c common, orig interface{}) (Manifest, error) {
 	}
 	// verify digest didn't change
 	if origDigest != "" && origDigest != c.desc.Digest {
-		return nil, fmt.Errorf("manifest digest mismatch, expected %s, computed %s", origDigest, c.desc.Digest)
+		return nil, fmt.Errorf("manifest digest mismatch, expected %s, computed %s%.0w", origDigest, c.desc.Digest, errs.ErrDigestMismatch)
 	}
 	return m, nil
 }
@@ -563,7 +571,7 @@ func fromCommon(c common) (Manifest, error) {
 	}
 	// verify digest didn't change
 	if origDigest != "" && origDigest != c.desc.Digest {
-		return nil, fmt.Errorf("manifest digest mismatch, expected %s, computed %s", origDigest, c.desc.Digest)
+		return nil, fmt.Errorf("manifest digest mismatch, expected %s, computed %s%.0w", origDigest, c.desc.Digest, errs.ErrDigestMismatch)
 	}
 	return m, nil
 }

@@ -828,7 +828,15 @@ func TestNew(t *testing.T) {
 			wantE: fmt.Errorf("manifest contains an unexpected media type: expected %s, received %s", mediatype.OCI1Manifest, mediatype.OCI1ManifestList),
 		},
 		{
-			name: "Invalid digest",
+			name: "Invalid ref digest",
+			opts: []Opts{
+				WithRef(r.SetDigest(digestInvalid.String())),
+				WithRaw(rawDockerSchema2),
+			},
+			wantE: errs.ErrDigestMismatch,
+		},
+		{
+			name: "Invalid descriptor digest",
 			opts: []Opts{
 				WithRef(r),
 				WithRaw(rawDockerSchema2),
@@ -838,7 +846,7 @@ func TestNew(t *testing.T) {
 					Size:      int64(len(rawDockerSchema2)),
 				}),
 			},
-			wantE: fmt.Errorf("manifest digest mismatch, expected %s, computed %s", digestInvalid, digestDockerSchema2),
+			wantE: errs.ErrDigestMismatch,
 		},
 		{
 			name: "Invalid Media Type",