ocibuild_digest (ocibuild v0.10.4)

Digest utilities for OCI content addressing.

OCI uses SHA256 digests in the format sha256:<hex> to identify content-addressable blobs.

Security Note

The encoded/1 function extracts the hash portion from a digest WITHOUT validation. When using digests from untrusted sources (registry manifests, tarballs) to construct file paths, callers MUST validate the digest format first to prevent path traversal attacks.

A malicious digest like sha256:../../etc/passwd would return ../../etc/passwd from encoded/1, which could escape intended directories when used in file paths.

Safe pattern:

case validate_digest_format(Digest) of
    {ok, _} ->
        Path = filename:join(Dir, binary_to_list(ocibuild_digest:encoded(Digest)));
    {error, _} ->
        {error, invalid_digest}
end.

Summary

Types

digest()

Functions

algorithm(Digest)

Extract the algorithm from a digest.

encoded(Digest)

Extract the encoded hash from a digest.

from_hex(Hex)

Parse a hex string to binary.

sha256(Data)

Calculate SHA256 digest of data in OCI format.

sha256_hex(Data)

Calculate raw SHA256 hash and return as hex string (without algorithm prefix).

to_hex(Bin)

Convert binary to lowercase hex string.