diff --git a/internal/bundle/digest.go b/internal/bundle/digest.go
index 01f7ee5..fc6a63c 100644
--- a/internal/bundle/digest.go
+++ b/internal/bundle/digest.go
@@ -1,19 +1,9 @@
 package bundle
 
-import (
-	"fmt"
-	"regexp"
-
-	publicbundle "gitea.maximumdirect.net/eric/distributor/pkg/bundle"
-)
-
-var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
+import publicbundle "gitea.maximumdirect.net/eric/distributor/pkg/bundle"
 
 func ValidateDigest(value string) error {
-	if !digestPattern.MatchString(value) {
-		return fmt.Errorf("must be lowercase sha256:<64 hex>")
-	}
-	return nil
+	return publicbundle.ValidateDigest(value)
 }
 
 func FileDigest(data []byte) string {
diff --git a/pkg/bundle/digest.go b/pkg/bundle/digest.go
index a675ee6..25149d4 100644
--- a/pkg/bundle/digest.go
+++ b/pkg/bundle/digest.go
@@ -11,7 +11,8 @@ import (
 
 var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
 
-func validateDigest(value string) error {
+// ValidateDigest reports whether value uses the lowercase sha256:<64 hex> form.
+func ValidateDigest(value string) error {
 	if !digestPattern.MatchString(value) {
 		return fmt.Errorf("must be lowercase sha256:<64 hex>")
 	}
diff --git a/pkg/bundle/digest_test.go b/pkg/bundle/digest_test.go
new file mode 100644
index 0000000..e6e4bca
--- /dev/null
+++ b/pkg/bundle/digest_test.go
@@ -0,0 +1,58 @@
+package bundle
+
+import "testing"
+
+func TestValidateDigest(t *testing.T) {
+	tests := []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{
+			name:  "valid",
+			value: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+		},
+		{
+			name:    "uppercase hex",
+			value:   "sha256:0123456789ABCDEF0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "missing prefix",
+			value:   "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "wrong algorithm",
+			value:   "sha512:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "short hex",
+			value:   "sha256:0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "long hex",
+			value:   "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0",
+			wantErr: true,
+		},
+		{
+			name:    "non hex",
+			value:   "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdeg",
+			wantErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateDigest(test.value)
+			if test.wantErr && err == nil {
+				t.Fatal("ValidateDigest() error = nil, want error")
+			}
+			if !test.wantErr && err != nil {
+				t.Fatalf("ValidateDigest() error = %v", err)
+			}
+		})
+	}
+}
diff --git a/pkg/bundle/validate.go b/pkg/bundle/validate.go
index 2cdfb8c..05f75bc 100644
--- a/pkg/bundle/validate.go
+++ b/pkg/bundle/validate.go
@@ -13,7 +13,7 @@ func ValidateManifest(manifest Manifest) error {
 	if manifest.ID == "" {
 		return fmt.Errorf("id is required")
 	}
-	if err := validateDigest(manifest.Digest); err != nil {
+	if err := ValidateDigest(manifest.Digest); err != nil {
 		return fmt.Errorf("digest: %w", err)
 	}
 	if manifest.Created.IsZero() {
@@ -27,7 +27,7 @@ func ValidateManifest(manifest Manifest) error {
 		if err := ValidateSourcePath(file.Path); err != nil {
 			return fmt.Errorf("files[%d].path: %w", index, err)
 		}
-		if err := validateDigest(file.SHA256); err != nil {
+		if err := ValidateDigest(file.SHA256); err != nil {
 			return fmt.Errorf("files[%d].sha256: %w", index, err)
 		}
 		if file.Size < 0 {