fix: validate digest prior to layer download

[RTann]

No description provided.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[RTann]

/retest

[dcaravel]

LGTM - assuming tests pass and the dep updated to a tagged version as mentioned.

[RTann]

@dcaravel I updated the PR to add some more validation, as I fear the original was not sufficient. I believe now I cover all bases (fetching both manifests and layers. before was just layers).

[jvdm]

LGTM, just curious about why you expected validation outside the function calls? Not a blocker. I just think when this is the case, functions/methods/routines should still protect themselves from callers, but they don't need to support the invalid input by returning an error -- since this is a programmer's kinda error, they could just enforce and panic (like some standard library methods do for invalid input that cannot be handled in runtime).