Scope data verification to content consumers

While registries might want to verify the data field, we shouldn't rely on it, as many registries are unaware of this field. On the other hand, clients SHOULD verify the content before consuming it. Signed-off-by: Jon Johnson <[email protected]>
opencontainers · Aug 10, 2021 · 0d98a6c · 0d98a6c
1 parent 83479d4
commit 0d98a6c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/descriptor.md b/descriptor.md
@@ -48,7 +48,7 @@ The following fields contain the primary properties that constitute a Descriptor
 
   This OPTIONAL property contains an embedded representation of the referenced content.
   Values MUST conform to the Base 64 encoding, as defined in [RFC 4648][rfc4648-s4].
-  The decoded data MUST be identical to the referenced content and SHOULD be verified against the [`digest`](#digests) and `size` fields.
+  The decoded data MUST be identical to the referenced content and SHOULD be verified against the [`digest`](#digests) and `size` fields by content consumers.
   See [Embedded Content](#embedded-content) for when this is appropriate.
 
 Descriptors pointing to [`application/vnd.oci.image.manifest.v1+json`](manifest.md) SHOULD include the extended field `platform`, see [Image Index Property Descriptions](image-index.md#image-index-property-descriptions) for details.