Oci descriptor verify

oci-descriptor-verify · version 1.0.0 · Hashing & signatures · free, no key needed

Verify supplied bytes against an OCI descriptor digest and size.

Use when you need to: verify an OCI descriptor · check OCI blob digest and size · validate container descriptor bytes.

Decide before calling

Read the versioned contract and the supported scope below. Reuse oci-descriptor-verify@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use oci-descriptor-verify@1.0.0 for verify an OCI descriptor. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• verify an OCI descriptor
• check OCI blob digest and size
• validate container descriptor bytes
• audit OCI content identity
• compare blob to OCI descriptor
• verify sha512 OCI descriptor

Not supported

• registry access or blob downloads
• archive extraction or signature verification

Behavior

• Implements OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1.
• Content is canonical padded base64; only lowercase sha256 and sha512 OCI digests are accepted.
• Well-typed digest or size differences are verdicts, while malformed contracts throw invalid_input.
• Security-sensitive verification: callers must supply a trusted expected descriptor and apply their own authenticity and policy controls.

Input

• descriptor (object, required)
• content (string, required): max length 1398104

Output

• valid (boolean, required)
• reasons (array of one of "digest_mismatch", "size_mismatch", required): max items 2
• computed_digest (string, required): pattern ^(sha256:[0-9a-f]{64}|sha512:[0-9a-f]{128})$
• computed_size (integer, required): min 0; max 1048576
• standard (constant "OCI Image and Image Layout Specifications v1.1.1", required)
• reference (constant "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1", required)

Limits

• max content bytes: 1048576

Example

Request input:

{
  "descriptor": {
    "media_type": "application/vnd.oci.image.layer.v1.tar",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "content": ""
}

Response:

{
  "result": {
    "valid": true,
    "reasons": [],
    "computed_digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "computed_size": 0,
    "standard": "OCI Image and Image Layout Specifications v1.1.1",
    "reference": "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "oci-descriptor-verify",
  "version": "1.0.0",
  "input": {
    "descriptor": {
      "media_type": "application/vnd.oci.image.layer.v1.tar",
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size": 0
    },
    "content": ""
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/oci-descriptor-verify/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"descriptor":{"media_type":"application/vnd.oci.image.layer.v1.tar","digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"content":""}'

The machine-readable contract is at /v1/tools/oci-descriptor-verify/versions/1.0.0.

CLI

node cli.mjs run oci-descriptor-verify 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Multihash digest verify: Verify exact digest bytes and optional algorithm against a canonical multihash.
• Oci layout integrity verify: Verify an in-memory OCI image layout, index, and reachable blob closure.
• Oci manifest graph audit: Recursively audit reachable descriptors in a supplied OCI manifest graph.
• Adler-32 chunks verify: Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.
• Hash digest verify: Recompute a fixed-length digest over encoded input bytes and compare it to an expected digest given in any encoding.
• Crc check value verify: Recompute a pinned catalogue CRC of ASCII 123456789 and compare an observed check.