GoogleContainerTools/jib · warning

Expected image digest ${expectedDigest}, but received: ${rec

Error message

Expected image digest ${expectedDigest}, but received: ${receivedDigests}

What it means

ManifestPusher logs this warning when the digest returned by the registry after pushing an image manifest does not match the digest Jib computed for the manifest it sent. Jib still returns the expected digest but warns that the registry's reported digest(s) differ, which can indicate a registry bug or a proxy altering content.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/ManifestPusher.java:145

    // Checks if the image digest is as expected.
    DescriptorDigest expectedDigest = Digests.computeJsonDigest(manifestTemplate);

    List<String> receivedDigests = response.getHeader(RESPONSE_DIGEST_HEADER);
    if (receivedDigests.size() == 1) {
      try {
        DescriptorDigest receivedDigest = DescriptorDigest.fromDigest(receivedDigests.get(0));
        if (expectedDigest.equals(receivedDigest)) {
          return expectedDigest;
        }

      } catch (DigestException ex) {
        // Invalid digest.
      }
    }

    // The received digest is not as expected. Warns about this.
    eventHandlers.dispatch(
        LogEvent.warn(makeUnexpectedImageDigestWarning(expectedDigest, receivedDigests)));
    return expectedDigest;
  }

  @Override
  public URL getApiRoute(String apiRouteBase) throws MalformedURLException {
    return new URL(
        apiRouteBase + registryEndpointRequestProperties.getImageName() + "/manifests/" + imageTag);
  }

  @Override
  public String getHttpMethod() {
    return HttpMethods.PUT;
  }

  @Override
  public String getActionDescription() {
    return "push image manifest for "
        + registryEndpointRequestProperties.getServerUrl()

View on GitHub (pinned to fb949e2676)

Solutions

1. Verify the pushed image by pulling it by digest and checking `docker inspect` / `crane digest`
2. Check for proxies or registry middleware that rewrite manifests and bypass/fix them
3. Update the registry software; known old registries mishandle Docker-Content-Digest headers
4. If the mismatch is benign for your setup, note that the warning is informational — Jib uses its locally computed digest

Example fix

// before: silent confusion over digest mismatch
crane digest registry.example.com/app@sha256:...
// after: confirm with the registry what was actually stored
crane manifest registry.example.com/app:tag | sha256sum

// confirm stored digest matches after push
crane digest registry.example.com/app@sha256:<expected> || echo "digest mismatch on registry"

try {
  ImageDigest pushed = jibPush();
  if (!pushed.getDigest().equals(expectedDigest)) {
    log.warn("registry returned a different digest; verify what was stored");
  }
} catch (RegistryException e) { /* handle registry errors */ }

When it happens

Trigger: docker push-style manifest PUT completes with HTTP 201, but the Docker-Content-Digest response header (or digest computed from the response body) differs from the sha256 digest Jib computed locally; handled in handleResponse of ManifestPusher.

Common situations: Registries or reverse proxies that modify/normalize manifests; misconfigured registries returning wrong Docker-Content-Digest headers; signed/rewritten manifests by admission proxies; image references resolving to a registry that transforms manifests.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• The pulled BLOB has digest '${receivedDigest}', but the requ
• push may fail with pull-only bearer auth token
• Received unrecognized status code ${statusCode}
• Expected 1 'Location' header, but found ${headerCount}
• Cannot build to a container registry in offline mode

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/8526dec58a41272b. Report an issue: GitHub.