fix(bom): return invalidStructuredImageDescriptorError for malformed digest

appendContainerSHA returns ErrCodeInvalidRequest which IsInvalidStructured-
ImageDescriptor does not recognize, so mirror-discovery and BOM-generation
callers took their warn-and-continue branch instead of failing closed.

Inline the sha256 format check in imageReferenceFromMapping and wrap the
failure in invalidStructuredImageDescriptorError (field "digest", line,
column) so callers that gate on IsInvalidStructuredImageDescriptor fail
closed. Update regression tests to assert IsInvalidStructuredImageDescriptor
rather than checking only the error string.

Signed-off-by: Terry Howe <thowe@nvidia.com>

Author: TerryHowe

pkg/bom/extract.go

@@ -229,6 +229,7 @@ func isStructuredImageKey(key string) bool {
 func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 	var name, repository, tag, digest string
 	var namePresent bool
+	var digestNode *yaml.Node
 	for i := 0; i+1 < len(n.Content); i += 2 {
 		key, value := n.Content[i], n.Content[i+1]
 		switch key.Value {
@@ -278,6 +279,7 @@ func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 			tag = scalar
 		case imageDigestKey:
 			digest = scalar
+			digestNode = value
 		}
 	}
 	if !namePresent {
@@ -291,7 +293,22 @@ func imageReferenceFromMapping(n *yaml.Node) (string, error) {
 		return "", nil
 	}
 	ref := combineCRDTriplet(name, repository, tag)
-	return appendContainerSHA(ref, digest)
+	if digest == "" || strings.Contains(ref, "@") {
+		return ref, nil
+	}
+	if !containerSHARE.MatchString(digest) {
+		return "", errors.Wrap(
+			errors.ErrCodeInvalidRequest,
+			"invalid image descriptor member",
+			&invalidStructuredImageDescriptorError{
+				field:  imageDigestKey,
+				line:   digestNode.Line,
+				column: digestNode.Column,
+				reason: fmt.Sprintf("must match sha256:<64 lowercase hex chars>, got %q", digest),
+			},
+		)
+	}
+	return ref + "@" + digest, nil
 }
 
 func nonNullImageMappingScalar(n *yaml.Node) (string, bool) {

pkg/bom/extract_test.go

@@ -602,9 +602,10 @@ func TestExtractImagesFromYAML_InvalidContainerSHA(t *testing.T) {
 
 // TestExtractImagesFromYAML_InvalidDigestInMapping exercises the fail-loud
 // guard for the structured image descriptor's `digest` field: any value that
-// does not match `^sha256:[a-f0-9]{64}$` must surface as an extraction error
-// so a typo, truncation, or bogus override cannot silently ship a malformed
-// ref into the BOM/PURL output.
+// does not match `^sha256:[a-f0-9]{64}$` must surface as an
+// invalidStructuredImageDescriptorError so mirror-discovery and BOM-generation
+// callers that gate on IsInvalidStructuredImageDescriptor fail closed rather
+// than warning-and-continuing with the image omitted.
 func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -620,7 +621,7 @@ func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
       tag: "17.4"
       digest: notasha256
 `,
-			wantSub: `invalid containerSHA "notasha256"`,
+			wantSub: `field "digest"`,
 		},
 		{
 			name: "sha256 prefix but truncated hex in digest field",
@@ -631,7 +632,7 @@ func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
       tag: "17.4"
       digest: sha256:abc123
 `,
-			wantSub: `invalid containerSHA "sha256:abc123"`,
+			wantSub: `field "digest"`,
 		},
 		{
 			name: "uppercase hex in digest field",
@@ -642,7 +643,7 @@ func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
       tag: "17.4"
       digest: sha256:304AB813518754228F9F792F79D6DA36359B82D8ECF418096C636725F8C930AD
 `,
-			wantSub: `invalid containerSHA`,
+			wantSub: `field "digest"`,
 		},
 	}
 	for _, tt := range tests {
@@ -651,6 +652,9 @@ func TestExtractImagesFromYAML_InvalidDigestInMapping(t *testing.T) {
 			if err == nil {
 				t.Fatal("expected error for malformed digest field")
 			}
+			if !IsInvalidStructuredImageDescriptor(err) {
+				t.Errorf("IsInvalidStructuredImageDescriptor(%v) = false, want true", err)
+			}
 			if !strings.Contains(err.Error(), tt.wantSub) {
 				t.Errorf("error %q does not contain %q", err.Error(), tt.wantSub)
 			}