mirror of
https://github.com/distribution/distribution.git
synced 2026-10-28 10:15:27 +08:00
Kris KennawayandClaude Opus 4.8
93c6e1a3b3
registry/client (*blobs).Get fetched a blob by digest but returned the bytes with no digest verification, so a malicious or compromised registry (or a MITM) could substitute arbitrary content for a digest-pinned blob (image config, layer) and any library consumer that trusted the returned bytes received the substituted content. This is the same integrity gap addressed for manifests in GHSA-685w-q87j-wqw3, one layer down. Get now buffers and verifies the whole blob against the requested digest, and rejects a digest whose algorithm is unsupported (fail closed) rather than allowing dgst.Verifier() to panic. Open is left as an unverified streaming reader, now documented as such: a content digest can only be checked after the entire blob has been read, but Open yields bytes as they stream and callers may read partially or seek, so single-pass verification cannot be guaranteed. Callers that rely on the digest for integrity must use Get. The pull-through proxy's local cache is protected independently by the storage blob writer's commit-time digest validation. Related to GHSA-685w-q87j-wqw3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>