# Oci descriptor verify

`oci-descriptor-verify` · version 1.0.0 · Hashing & signatures · free, no key needed

Verify supplied bytes against an OCI descriptor digest and size.

**Use when you need to: verify an OCI descriptor · check OCI blob digest and size · validate container descriptor bytes.**

## Decide before calling

Read the [versioned contract](/v1/tools/oci-descriptor-verify/versions/1.0.0) and the supported scope below. Reuse `oci-descriptor-verify@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `oci-descriptor-verify@1.0.0` for verify an OCI descriptor. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- verify an OCI descriptor
- check OCI blob digest and size
- validate container descriptor bytes
- audit OCI content identity
- compare blob to OCI descriptor
- verify sha512 OCI descriptor

## Not supported

- registry access or blob downloads
- archive extraction or signature verification

## Behavior

- Implements OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1.
- Content is canonical padded base64; only lowercase sha256 and sha512 OCI digests are accepted.
- Well-typed digest or size differences are verdicts, while malformed contracts throw invalid_input.
- Security-sensitive verification: callers must supply a trusted expected descriptor and apply their own authenticity and policy controls.

## Input

- `descriptor` (object, required)
- `content` (string, required): max length 1398104

## Output

- `valid` (boolean, required)
- `reasons` (array of one of "digest_mismatch", "size_mismatch", required): max items 2
- `computed_digest` (string, required): pattern `^(sha256:[0-9a-f]{64}|sha512:[0-9a-f]{128})$`
- `computed_size` (integer, required): min 0; max 1048576
- `standard` (constant "OCI Image and Image Layout Specifications v1.1.1", required)
- `reference` (constant "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1", required)

## Limits

- max content bytes: 1048576

## Example

Request input:

```json
{
  "descriptor": {
    "media_type": "application/vnd.oci.image.layer.v1.tar",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "content": ""
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "reasons": [],
    "computed_digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "computed_size": 0,
    "standard": "OCI Image and Image Layout Specifications v1.1.1",
    "reference": "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "oci-descriptor-verify",
  "version": "1.0.0",
  "input": {
    "descriptor": {
      "media_type": "application/vnd.oci.image.layer.v1.tar",
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size": 0
    },
    "content": ""
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/oci-descriptor-verify/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"descriptor":{"media_type":"application/vnd.oci.image.layer.v1.tar","digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"content":""}'
```

The machine-readable contract is at [/v1/tools/oci-descriptor-verify/versions/1.0.0](/v1/tools/oci-descriptor-verify/versions/1.0.0).

### CLI

```sh
node cli.mjs run oci-descriptor-verify 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Multihash digest verify](/tools/multihash-digest-verify): Verify exact digest bytes and optional algorithm against a canonical multihash.
- [Oci layout integrity verify](/tools/oci-layout-integrity-verify): Verify an in-memory OCI image layout, index, and reachable blob closure.
- [Oci manifest graph audit](/tools/oci-manifest-graph-audit): Recursively audit reachable descriptors in a supplied OCI manifest graph.
- [Adler-32 chunks verify](/tools/adler32-chunks-verify): Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.
- [Hash digest verify](/tools/hash-digest-verify): Recompute a fixed-length digest over encoded input bytes and compare it to an expected digest given in any encoding.
- [Crc check value verify](/tools/crc-check-value-verify): Recompute a pinned catalogue CRC of ASCII 123456789 and compare an observed check.