Validate an untrusted manifest and prove its identity digest still matches its
normalized contents, returning the normalized value.
A store hands back whatever was persisted, so any consumer that is about to
trust a stored manifest's provenance — versions, attribution, authorization
scope — verifies it here first rather than reading fields off unvalidated
input.
Validate an untrusted manifest and prove its identity digest still matches its normalized contents, returning the normalized value.
A store hands back whatever was persisted, so any consumer that is about to trust a stored manifest's provenance — versions, attribution, authorization scope — verifies it here first rather than reading fields off unvalidated input.