code: func (ms *manifestListHandler) verifyManifest(ctx context.Context, mnfst manifestlist.DeserializedManifestList, skipDependencyVerification bool) error {
  	var errs distribution.ErrManifestVerification
  
  	if mnfst.SchemaVersion != 2 {
  		return fmt.Errorf("unrecognized manifest list schema version %d", mnfst.SchemaVersion)
  	}
  
  	if !skipDependencyVerification {
  		// This manifest service is different from the blob service
  		// returned by Blob. It uses a linked blob store to ensure that
  		// only manifests are accessible.
  
  		manifestService, err := ms.repository.Manifests(ctx)
  		if err != nil {
  			return err
  		}
  
  		for _, manifestDescriptor := range mnfst.References() {
  			exists, err := manifestService.Exists(ctx, manifestDescriptor.Digest)
  			if err != nil && err != distribution.ErrBlobUnknown {
  				errs = append(errs, err)
  			}
  			if err != nil || !exists {
  				// On error here, we always append unknown blob errors.
  				errs = append(errs, distribution.ErrManifestBlobUnknown{Digest: manifestDescriptor.Digest})
  			}
  		}
  	}
  	if len(errs) != 0 {
  		return errs
  	}
  
  	return nil
  }
docs: // verifyManifest ensures that the manifest content is valid from the
  // perspective of the registry. As a policy, the registry only tries to
  // store valid content, leaving trust policies of that content up to
  // consumers.