Verify content identities through the image graph

OCI Image Specification 1.1.1 describes references using content descriptors with media type, digest, and byte size. A digest names the targeted bytes under its hash algorithm, while size supplies an expected length. A consumer should validate retrieved content against the expected descriptor before relying on its contents. The expected root must arrive through a trusted release or policy decision; downloading an image and its self-advertised digest from one untrusted source does not establish that the publisher or release is authorized. Integrity relative to an expectation and the origin of that expectation are separate links.

A tag can be updated to identify a different manifest or image index. Record the resolved digest when making an approval and preserve that identity through retrieval. If an image index covers multiple platforms, it identifies a structure containing child descriptors rather than one universal executable filesystem. The selected platform manifest, its configuration, and its layers have their own content identities. State whether policy approves the index and its relevant children or one specific platform artifact. An inventory or attestation associated with one child cannot silently stand in for every other architecture.

Hash exactly the representation the descriptor identifies. An image layer's compressed blob digest and the uncompressed layer's content identifier describe different byte sequences; recompression can change one without changing the other. Do not compare a decompressed stream against a compressed-blob digest and call the mismatch an attack. Conversely, a semantic equivalence argument does not let a consumer ignore a failed digest check for the requested blob. Bound sizes and perform appropriate integrity checks before expensive parsing or extraction, while treating media type and parser behavior as part of the consuming contract.

Registry authentication and encrypted transport address access and communication, but neither makes a mutable tag immutable or proves the account published an approved release. Registry writers can be compromised, and an authorized account can upload the wrong artifact. A verified digest permits retrieving the same content from different locations under the hash assumptions; it does not guarantee any location remains available. Retain approved artifacts and their evidence with controlled writers, and plan restoration when a registry is unavailable. A mirror should preserve identities rather than silently rewrite release content under a familiar tag.

Persist the selected digest in deployment configuration and ensure the node retrieves the same approved content rather than resolving the original tag again. Join signatures, provenance, and inventory by the appropriate artifact subject and platform. An attached document or registry referrer is discoverable evidence, not automatically a trusted assertion. Verify its own identity, signer, and semantic binding before using it. If a running service later downloads plugins or model files, the image digest does not identify those later bytes; extend the release contract to those inputs or state the boundary clearly.

The modular lab offers a deliberately limited analogy for label reuse. Reset, set both modulus m=4 and additive step a=1, predict the fourth step, then Play or Step. The displayed residue repeats after four additions, illustrating how one short label can describe different points in a history. This arithmetic is neither a cryptographic hash nor a registry. Real digest verification uses a specified collision-resistant algorithm and a trusted expected value; mutable tag reuse is a naming decision, not the small modular collision mechanism shown by the teaching instrument.