descriptor: Require lowercase hex

[wking]

Now that 75a51ed (fix regular expression of algorithim, 2016-08-30, #221) has made the Markdown and JSON Schema consistent (and required lowercase algorithms), make digest comparisons easier by also requiring lowercase hex.

This also:

• Makes it easier to serve blobs out of a case-insensitive filesystem
  store.
• Avoids having two otherwise-identical descriptor (or
  descriptor-containing) blobs with different hashes because they
  picked differend hex-casing.

[stevvooe]

LGTM

[runcom]

@stevvooe @wking is this a must for the spec? Should we add validation to oci-image-tool? (I'll fix it if so in a follow up not to block this)

[wking]

On Fri, Sep 09, 2016 at 03:40:09PM -0700, Antonio Murdaca wrote:

is this a must for the spec?

Yes. I've pushed efb13e3 → 660d130 adding a MUST to make that
clearer.

Should we add validation to oci-image-tool?

This should be handled automatically via the JSON Schema regex (bumped
in this PR). We're using that as part of validate already, aren't we?

[runcom]

@stevvooe does the MUST look good to you?

@wking I can't check right now, I hope it's validating using the json schema.

[runcom]

@wking @stevvooe unfortunately with this PR, oci-image-tool isn't reporting any invalid digest format.

if you change a digest under refs/ to have some uppercase char you get:

oci-image-tool validate --ref latest . 
.: validation failed: sha256:2A2b6168c040d25148a4972cb20108b737adc51685d4dc68a8e01d55416d27a1: not found

it isn't saying anything about lower/upper cases..I guess it's the same for blobs/ (notice that I would have had the above to fail with "invalid digest, no uppercase!" or something like this, I know I renamed to digest and now it can't find the correct blob)

[stevvooe]

@runcom I don't think a fix for that should be a pre-cursor to a merge here. Sounds like our validation is slightly broken.

Could we still merge this and file a bug?

[runcom]

@stevvooe absolutely, this is by any means a blocker, sorry if I intended that, please go ahead and merge this, I'll file a separate issue and probably wait to do this because I would love to have the separate repo for the tool in order not to make noise in the spec.

The fix in oci-image-tool will be done separately and it's part of a big refactor I have in mind about validation steps.

[jonboulle]

LGTM

[stevvooe]

LGTM