{"record":{"id":"964be54c4e582f87","repo":"theonedev/onedev","slug":"unsupported","errorCode":"UNSUPPORTED","errorMessage":"Unsupported digest: ${digestString}","messagePattern":"Unsupported digest: (.+?)","errorType":"http","errorClass":"ClientException","httpStatus":406,"severity":"error","filePath":"server-plugin/server-plugin-pack-container/src/main/java/io/onedev/server/plugin/pack/container/ContainerServlet.java","lineNumber":508,"sourceCode":"\t}\n\t\n\tprivate String getBlobUrl(String projectPath, String repository, String digest) {\n\t\treturn \"/v2/\" + projectPath + \"/\" + repository + \"/blobs/\" + digest;\n\t}\n\n\tprivate String getManifestUrl(String projectPath, String repository, String reference) {\n\t\treturn \"/v2/\" + projectPath + \"/\" + repository + \"/manifests/\" + reference;\n\t}\n\t\n\tprivate boolean isTag(String reference) {\n\t\treturn !reference.contains(\":\");\n\t}\n\t\n\tprivate Digest parseDigest(String digestString) {\n\t\tif (digestString.startsWith(\"sha256:\")) {\n\t\t\treturn new Digest(SHA256, digestString.substring(\"sha256:\".length()));\n\t\t} else {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.UNSUPPORTED, \n\t\t\t\t\t\"Unsupported digest: \" + digestString);\n\t\t}\n\t}\n\t\n\tprivate Project checkProject(String projectPath, boolean needsToPush) {\n\t\tvar project = projectService.findByPath(projectPath);\n\t\tif (project == null) \n\t\t\tthrow new NotFoundException(ErrorCode.NAME_UNKNOWN, \"Unknown project: \" + projectPath);\n\t\telse if (!project.isPackManagement())\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.DENIED, \"Package management not enabled for project: \" + projectPath);\n\t\telse if (needsToPush && !SecurityUtils.canWritePack(project))\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\telse if (!needsToPush && !SecurityUtils.canReadPack(project))\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\telse\n\t\t\treturn project;\n\t}\n","sourceCodeStart":490,"sourceCodeEnd":526,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-container/src/main/java/io/onedev/server/plugin/pack/container/ContainerServlet.java#L490-L526","documentation":"The container registry servlet only supports sha256 digests. When a client references a manifest or blob with a digest algorithm other than sha256 (e.g. sha512), parseDigest throws this 406 ClientException with code UNSUPPORTED. This is a deliberate limitation of the registry implementation, not a transient failure.","triggerScenarios":"A Docker/OCI client sends a request whose path or header contains a digest with an algorithm prefix other than 'sha256:' — e.g. GET /v2/<name>/manifests/sha512:<hex> or a manifest list referencing sha512 blob digests.","commonSituations":"Using a container client configured (or a registry proxy negotiating) sha512 digest algorithm; copying artifacts between registries where the source stored non-sha256 digests; hand-crafted REST calls to the registry API using another algorithm.","solutions":["Change the request to use a sha256: digest (the default for docker/OCI tooling).","If a client is pushing/pulling sha512 digests, re-tag and re-push the image so digests are computed with sha256.","Check for a proxy/mirror in front of the registry rewriting digests to another algorithm and fix its configuration."],"exampleFix":"// before\ndocker pull registry.example.com/project@sha512:abcd...\n// after\ndocker pull registry.example.com/project@sha256:abcd...","handlingStrategy":"validation","validationCode":"if (!digestString.startsWith(\"sha256:\")) throw new IllegalArgumentException(\"only sha256 digests supported: \" + digestString);","typeGuard":"function isSha256Digest(d: string): boolean { return /^sha256:[a-f0-9]{64}$/.test(d); }","tryCatchPattern":null,"preventionTips":["Always compute image digests with sha256 (toolchain default).","Avoid registry proxies/mirrors that rewrite digests to other algorithms.","Validate digest format client-side before calling registry APIs."],"tags":["container-registry","http-406","digest","unsupported"],"backgroundTag":"unsupported-enum-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}