code: func validateManifestDigest(ref reference.Named, mfst distribution.Manifest) (ocispec.Descriptor, error) {
  	mediaType, canonical, err := mfst.Payload()
  	if err != nil {
  		return ocispec.Descriptor{}, err
  	}
  	desc := ocispec.Descriptor{
  		Digest:    digest.FromBytes(canonical),
  		Size:      int64(len(canonical)),
  		MediaType: mediaType,
  	}
  
  	// If pull by digest, then verify the manifest digest.
  	if digested, isDigested := ref.(reference.Canonical); isDigested {
  		if digested.Digest() != desc.Digest {
  			err := fmt.Errorf("manifest verification failed for digest %s", digested.Digest())
  			return ocispec.Descriptor{}, err
  		}
  	}
  
  	return desc, nil
  }
docs: // validateManifestDigest computes the manifest digest, and, if pulling by
  // digest, ensures that it matches the requested digest.