verify expected digest when reusing cached image without digest file

[SABITHSAHEB]

1. getCached selects its validation path from whether the cache has an <algo>.digest file. When a digest is expected but that file is absent (the same URL was cached earlier without a digest), it takes the digest-less branch.
2. that branch only compares Last-Modified, and when the remote HEAD request fails it reuses the cached bytes while returning ValidatedDigest=true, so the expected digest is never checked and a caller pinning a digest can boot a mismatching cached image.

Added a branch that validates the cached data against the expected digest before reuse when no digest file is present; the else path stays for genuinely digest-less images. Test covers the mismatch (now rejected) and the matching offline case (still served from cache).

[Copilot]

Pull request overview

Fixes a cache-validation edge case in the downloader where a URL previously cached without a digest sidecar (<algo>.digest) could later be reused for a digest-pinned request without actually verifying the cached bytes, allowing a mismatching cached image to be used when the remote HEAD check fails.

Changes:

• Add a getCached branch to verify cached bytes against expectedDigest when the digest sidecar is absent.
• Add a regression test covering both the digest-mismatch rejection and the digest-match offline/cache reuse case.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/downloader/downloader.go	Ensures cached data is hash-validated against an expected digest even when the cache lacks a digest sidecar.
pkg/downloader/downloader_test.go	Adds coverage for the “cached without digest sidecar + expected digest” scenario, including mismatch and match cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SABITHSAHEB]

Reasonable, done. After verification succeeds the digest file is now written (best effort, same as fetch does after a download), so later offline hits compare against the sidecar instead of re-hashing the data. The match subtest now asserts the file gets written.