Centralize digest validation in public bundle API

pkg/bundle/digest.go

@@ -11,7 +11,8 @@ import (
 
 var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
 
-func validateDigest(value string) error {
+// ValidateDigest reports whether value uses the lowercase sha256:<64 hex> form.
+func ValidateDigest(value string) error {
 	if !digestPattern.MatchString(value) {
 		return fmt.Errorf("must be lowercase sha256:<64 hex>")
 	}

pkg/bundle/digest_test.go

@@ -0,0 +1,58 @@
+package bundle
+
+import "testing"
+
+func TestValidateDigest(t *testing.T) {
+	tests := []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{
+			name:  "valid",
+			value: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+		},
+		{
+			name:    "uppercase hex",
+			value:   "sha256:0123456789ABCDEF0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "missing prefix",
+			value:   "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "wrong algorithm",
+			value:   "sha512:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "short hex",
+			value:   "sha256:0123456789abcdef",
+			wantErr: true,
+		},
+		{
+			name:    "long hex",
+			value:   "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0",
+			wantErr: true,
+		},
+		{
+			name:    "non hex",
+			value:   "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdeg",
+			wantErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateDigest(test.value)
+			if test.wantErr && err == nil {
+				t.Fatal("ValidateDigest() error = nil, want error")
+			}
+			if !test.wantErr && err != nil {
+				t.Fatalf("ValidateDigest() error = %v", err)
+			}
+		})
+	}
+}

pkg/bundle/validate.go

@@ -13,7 +13,7 @@ func ValidateManifest(manifest Manifest) error {
 	if manifest.ID == "" {
 		return fmt.Errorf("id is required")
 	}
-	if err := validateDigest(manifest.Digest); err != nil {
+	if err := ValidateDigest(manifest.Digest); err != nil {
 		return fmt.Errorf("digest: %w", err)
 	}
 	if manifest.Created.IsZero() {
@@ -27,7 +27,7 @@ func ValidateManifest(manifest Manifest) error {
 		if err := ValidateSourcePath(file.Path); err != nil {
 			return fmt.Errorf("files[%d].path: %w", index, err)
 		}
-		if err := validateDigest(file.SHA256); err != nil {
+		if err := ValidateDigest(file.SHA256); err != nil {
 			return fmt.Errorf("files[%d].sha256: %w", index, err)
 		}
 		if file.Size < 0 {