ContainerRegistry: Parse digest algorithm and value into separate fields

Author: euanh

Sources/ContainerRegistry/ImageReference.swift

@@ -214,45 +214,51 @@ extension ImageReference {
 
     /// Digest identifies a specific blob by the hash of the blob's contents.
     public struct Digest: Reference, Sendable, Equatable, CustomStringConvertible, CustomDebugStringConvertible {
+        var algorithm: String
         var value: String
 
         public enum ValidationError: Error, Equatable {
             case emptyString
             case invalidReferenceFormat(String)
-            case tooLong(String)
         }
 
         public init(_ rawValue: String) throws {
             guard rawValue.count > 0 else {
                 throw ValidationError.emptyString
             }
 
-            if rawValue.count > 7 + 64 {
-                throw ValidationError.tooLong(rawValue)
+            // https://github.com/opencontainers/image-spec/blob/v1.0.1/descriptor.md#sha-256
+            let sha256digest = /(sha256):([a-fA-F0-9]{64})/
+            if let match = try sha256digest.wholeMatch(in: rawValue) {
+                algorithm = String(match.1)
+                value = String(match.2)
+                return
             }
 
-            // https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pulling-manifests
-            let regex = /sha256:[a-fA-F0-9]{64}/
-            if try regex.wholeMatch(in: rawValue) == nil {
-                throw ValidationError.invalidReferenceFormat(rawValue)
+            // https://github.com/opencontainers/image-spec/blob/v1.0.1/descriptor.md#sha-512
+            let sha512digest = /(sha512):([a-fA-F0-9]{128})/
+            if let match = try sha512digest.wholeMatch(in: rawValue) {
+                algorithm = String(match.1)
+                value = String(match.2)
+                return
             }
 
-            value = rawValue
+            throw ValidationError.invalidReferenceFormat(rawValue)
         }
 
         public static func == (lhs: Digest, rhs: Digest) -> Bool {
-            lhs.value == rhs.value
+            lhs.algorithm == rhs.algorithm && lhs.value == rhs.value
         }
 
         public var separator: String = "@"
 
         public var description: String {
-            "\(value)"
+            "\(algorithm):\(value)"
         }
 
         /// Printable description in a form suitable for debugging.
         public var debugDescription: String {
-            "Digest(\(value))"
+            "Digest(\(algorithm):\(value))"
         }
     }
 }

Sources/containertool/Extensions/Errors+CustomStringConvertible.swift

@@ -81,8 +81,6 @@ extension ContainerRegistry.ImageReference.Digest.ValidationError: Swift.CustomS
         switch self {
         case .emptyString:
             return "Invalid reference format: digest cannot be empty"
-        case .tooLong(let rawValue):
-            return "Invalid reference format: digest (\(rawValue)) is too long"
         case .invalidReferenceFormat(let rawValue):
             return "Invalid reference format: digest (\(rawValue)) is not a valid digest"
         }

Tests/ContainerRegistryTests/ImageReferenceTests.swift

@@ -135,6 +135,18 @@ struct ReferenceTests {
             )
         ),
 
+        ReferenceTestCase(
+            reference:
+                "example.com/foo@sha512:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+            expected: try! ImageReference(
+                registry: "example.com",
+                repository: ImageReference.Repository("foo"),
+                reference: ImageReference.Digest(
+                    "sha512:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+                )
+            )
+        ),
+
         ReferenceTestCase(
             reference: "foo:1234/bar:1234",
             expected: try! ImageReference(
@@ -262,3 +274,59 @@ struct ReferenceTests {
         )
     }
 }
+
+struct DigestTests {
+    @Test(arguments: [
+        (
+            digest: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+            algorithm: "sha256", value: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        ),
+        (
+            digest: "sha512:"
+                + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+                + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+            algorithm: "sha512",
+            value: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+                + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        ),
+    ])
+    func testParseValidDigest(digest: String, algorithm: String, value: String) throws {
+        let parsed = try! ImageReference.Digest(digest)
+
+        #expect(parsed.algorithm == algorithm)
+        #expect(parsed.value == value)
+        #expect("\(parsed)" == digest)
+    }
+
+    @Test(arguments: [
+        "sha256:0123456789abcdef0123456789abcdef0123456789abcdef",  // short digest
+        "foo:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",  // bad algorithm
+        "sha256-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",  // bad separator
+    ])
+    func testParseInvalidDigest(digest: String) throws {
+        #expect(throws: ImageReference.Digest.ValidationError.invalidReferenceFormat(digest)) {
+            try ImageReference.Digest(digest)
+        }
+    }
+
+    @Test
+    func testDigestEquality() throws {
+        let digest1 = "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        let digest2 = "sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"
+        let digest3 =
+            "sha512:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+            + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+        #expect(try ImageReference.Digest(digest1) != ImageReference.Digest(digest2))
+        #expect(try ImageReference.Digest(digest1) != ImageReference.Digest(digest3))
+
+        // Same string, parsed twice, should yield the same digest
+        let sha256left = try ImageReference.Digest(digest1)
+        let sha256right = try ImageReference.Digest(digest1)
+        #expect(sha256left == sha256right)
+
+        let sha512left = try ImageReference.Digest(digest3)
+        let sha512right = try ImageReference.Digest(digest3)
+        #expect(sha512left == sha512right)
+    }
+}