GHSA-685W-Q87J-WQW3 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...