fix(remote): wrap content.ErrMismatchedDigest on a Docker-Content-Digest mismatch

verifyContentDigest and (*manifestStore).generateDescriptor reported a
response digest mismatch with a bare fmt.Errorf, so errors.Is could not
classify it as content.ErrMismatchedDigest even though it is exactly the
failure that sentinel names. ReadAll() already wrapped it, so whether a
caller could classify "the registry served the wrong bytes" depended on
which layer caught it.

Wrap content.ErrMismatchedDigest at both sites and widen the sentinel's
doc comment to cover every detection point, not just ReadAll(). The
malformed-header branch keeps its unwrapped error, and the message text
is otherwise unchanged.

Extend the two subtests that already drive these paths with the
errors.Is assertion; both fail against unmodified main.

Fixes #1470

Signed-off-by: fuleinist <1163738+fuleinist@users.noreply.github.com>

Author: fuleinist

content/reader.go

@@ -40,8 +40,10 @@ var (
 	// the descriptor has an invalid size.
 	ErrInvalidDescriptorSize = errors.New("invalid descriptor size")
 
-	// ErrMismatchedDigest is returned by ReadAll() when
-	// the descriptor has an invalid digest.
+	// ErrMismatchedDigest is returned when content does not match the digest
+	// recorded in its descriptor, wherever that mismatch is detected: by
+	// ReadAll() for a descriptor with an invalid digest, and by a registry
+	// client whose response digest disagrees with the requested digest.
 	ErrMismatchedDigest = errors.New("mismatched digest")
 
 	// ErrTrailingData is returned by ReadAll() when

registry/remote/repository.go

@@ -2209,10 +2209,11 @@ func (s *manifestStore) generateDescriptor(resp *http.Response, ref properties.R
 
 	if len(refDigest) > 0 && refDigest != contentDigest {
 		return ocispec.Descriptor{}, fmt.Errorf(
-			"%s %q: invalid response; digest mismatch in %s: received %q when expecting %q",
+			"%s %q: invalid response; digest mismatch in %s: received %q when expecting %q; %w",
 			resp.Request.Method, resp.Request.URL,
 			headerDockerContentDigest, contentDigest,
 			refDigest,
+			content.ErrMismatchedDigest,
 		)
 	}
 
@@ -2260,10 +2261,11 @@ func verifyContentDigest(resp *http.Response, expected digest.Digest) error {
 
 	if contentDigest != expected {
 		return fmt.Errorf(
-			"%s %q: invalid response; digest mismatch in %s: received %q when expecting %q",
+			"%s %q: invalid response; digest mismatch in %s: received %q when expecting %q; %w",
 			resp.Request.Method, resp.Request.URL,
 			headerDockerContentDigest, contentDigest,
 			expected,
+			content.ErrMismatchedDigest,
 		)
 	}
 

registry/remote/repository_test.go

@@ -3373,6 +3373,8 @@ func Test_BlobStore_Fetch_BadResponse(t *testing.T) {
 
 		if _, err = store.Fetch(ctx, blobDesc); err == nil {
 			t.Error("Blobs.Fetch() error = nil, want error")
+		} else if !errors.Is(err, content.ErrMismatchedDigest) {
+			t.Errorf("Blobs.Fetch() error = %v, want %v", err, content.ErrMismatchedDigest)
 		}
 	})
 
@@ -4326,6 +4328,8 @@ func Test_ManifestStore_Fetch(t *testing.T) {
 		_, err = store.Fetch(ctx, manifestDesc)
 		if err == nil {
 			t.Error("Manifests.Fetch() error = nil, wantErr = true")
+		} else if !errors.Is(err, content.ErrMismatchedDigest) {
+			t.Errorf("Manifests.Fetch() error = %v, want %v", err, content.ErrMismatchedDigest)
 		}
 	})
 }