fix: added digest check on resolve ref (notaryproject#689)

This PR adds check on user input digest and resolved digest.

Signed-off-by: Patrick Zheng <[email protected]>

cmd/notation/manifest.go

@@ -64,6 +64,10 @@ func resolveReference(ctx context.Context, inputType inputType, reference string
 	resolvedRef = resolvedRef + "@" + manifestDesc.Digest.String()
 	if _, err := digest.Parse(tagOrDigestRef); err == nil {
 		// tagOrDigestRef is a digest reference
+		if tagOrDigestRef != manifestDesc.Digest.String() {
+			// tagOrDigestRef does not match the resolved digest
+			return ocispec.Descriptor{}, "", fmt.Errorf("user input digest %s does not match the resolved digest %s", tagOrDigestRef, manifestDesc.Digest.String())
+		}
 		return manifestDesc, resolvedRef, nil
 	}
 	// tagOrDigestRef is a tag reference