code: func schema2ManifestDigest(ref reference.Named, mfst distribution.Manifest) (digest.Digest, error) {
  	_, canonical, err := mfst.Payload()
  	if err != nil {
  		return "", err
  	}
  
  	// If pull by digest, then verify the manifest digest.
  	if digested, isDigested := ref.(reference.Canonical); isDigested {
  		verifier := digested.Digest().Verifier()
  		if _, err := verifier.Write(canonical); err != nil {
  			return "", err
  		}
  		if !verifier.Verified() {
  			err := fmt.Errorf("manifest verification failed for digest %s", digested.Digest())
  			logrus.Error(err)
  			return "", err
  		}
  		return digested.Digest(), nil
  	}
  
  	return digest.FromBytes(canonical), nil
  }
docs: // schema2ManifestDigest computes the manifest digest, and, if pulling by
  // digest, ensures that it matches the requested digest.