Oci layout integrity verify
oci-layout-integrity-verify · version 1.0.0 · Hashing & signatures · free, no key needed
Verify an in-memory OCI image layout, index, and reachable blob closure.
Use when you need to: verify an OCI image layout · audit in-memory OCI layout · check OCI layout blob closure.
Decide before calling
Read the versioned contract and the supported scope below. Reuse oci-layout-integrity-verify@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.
Explain the choice
"I can use oci-layout-integrity-verify@1.0.0 for verify an OCI image layout. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."
Supported
- verify an OCI image layout
- audit in-memory OCI layout
- check OCI layout blob closure
- validate oci-layout and index json
- find orphan OCI blobs
- inspect OCI layout integrity
Not supported
- filesystem, tar, or registry operations
- signature or supply-chain policy verification
Behavior
- Implements OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1.
- The layout marker must be 1.0.0 and index is canonical padded base64 UTF-8 JSON.
- All supplied blob keys, reachable descriptors, closure, and orphan status are verified offline.
- Security-sensitive verification: callers must supply trusted expected descriptors and apply their own authenticity and policy controls.
Input
oci_layout(object, required)index(string, required): max length 1398104blobs(array of object, required): max items 256
Output
valid(boolean, required)reasons(array of string, required): max items 1024reachable(array of string, required): max items 256orphaned(array of string, required): max items 256standard(constant "OCI Image and Image Layout Specifications v1.1.1", required)reference(constant "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1", required)
Limits
- max blobs: 256
- max content bytes: 1048576
- max depth: 32
- max reachable nodes: 256
Example
Request input:
{
"oci_layout": {
"image_layout_version": "1.0.0"
},
"index": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtYW5pZmVzdHMiOltdfQ==",
"blobs": []
}
Response:
{
"result": {
"valid": true,
"reasons": [],
"reachable": [],
"orphaned": [],
"standard": "OCI Image and Image Layout Specifications v1.1.1",
"reference": "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1"
}
}
How to call it
MCP
Connect https://computefirst.net/mcp (setup), then call execute with:
{
"id": "oci-layout-integrity-verify",
"version": "1.0.0",
"input": {
"oci_layout": {
"image_layout_version": "1.0.0"
},
"index": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtYW5pZmVzdHMiOltdfQ==",
"blobs": []
}
}
HTTP (no key)
curl -X POST https://computefirst.net/v1/tools/oci-layout-integrity-verify/versions/1.0.0/execute \
-H "Content-Type: application/json" \
-d '{"oci_layout":{"image_layout_version":"1.0.0"},"index":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtYW5pZmVzdHMiOltdfQ==","blobs":[]}'
The machine-readable contract is at /v1/tools/oci-layout-integrity-verify/versions/1.0.0.
CLI
node cli.mjs run oci-layout-integrity-verify 1.0.0 --input input.json --base-url https://computefirst.net
Get the client at /clients/cli/.
Related tools
- Oci manifest graph audit: Recursively audit reachable descriptors in a supplied OCI manifest graph.
- Oci descriptor verify: Verify supplied bytes against an OCI descriptor digest and size.
- Merkle proof verify: Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
- Transparency inclusion verify: Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
- Adler-32 chunks verify: Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.
- Checksum manifest verify: Parse a GNU/BSD checksum manifest (sha256sum -c, tagged form) and verify caller-supplied file contents against it.