What causes "Invalid digest or hash: " in quarkusio/quarkus?

Inspect the reported value in the message to see the malformed digest source

quarkusio/quarkus · error · DigestException

Invalid digest or hash:

Error message

Invalid digest or hash:

What it means

When inspecting an image already present in the local docker daemon, Quarkus patches Jib's DockerImageDetails and parses digests/diff-IDs. fromDigestOrHash accepts either a full digest (sha256:...) or a bare hex hash; anything else throws DigestException("Invalid digest or hash: " + value). This indicates malformed digest data coming from the docker daemon metadata, not user input directly.

Source

Thrown at extensions/container-image/container-image-jib/deployment/src/main/java/io/quarkus/container/image/jib/deployment/JibProcessor.java:1025

        private static class PatchedDockerImageDetails extends DockerImageDetails {

            /** Pattern matches a SHA-256 hash - 32 bytes in lowercase hexadecimal. */
            private static final String HASH_REGEX = String.format("[a-f0-9]{%d}", 64);

            /** The algorithm prefix for the digest string. */
            private static final String DIGEST_PREFIX = "sha256:";

            /** Pattern matches a SHA-256 digest - a SHA-256 hash prefixed with "sha256:". */
            private static final String DIGEST_REGEX = DIGEST_PREFIX + HASH_REGEX;

            private static DescriptorDigest fromDigestOrHash(String digestOrHash) throws DigestException {
                if (digestOrHash.matches(DIGEST_REGEX)) {
                    return fromDigest(digestOrHash);
                } else if (digestOrHash.matches(HASH_REGEX)) {
                    return fromHash(digestOrHash);
                }
                throw new DigestException("Invalid digest or hash: " + digestOrHash);
            }

            private final DockerImageDetails delegate;

            public PatchedDockerImageDetails(DockerImageDetails delegate) {
                this.delegate = delegate;
            }

            @Override
            public long getSize() {
                return delegate.getSize();
            }

            // this is method we actually need to override
            @Override
            public DescriptorDigest getImageId() throws DigestException {
                return fromDigestOrHash(getPrivateImageId());
            }

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the reported value in the message to see the malformed digest source
Remove and re-pull the offending image: docker rmi <image> && docker pull <image>
If using podman/containerd image store, switch to the classic docker store or update docker
Upgrade Quarkus — patched DockerImageDetails parsing has been adjusted across versions

Example fix

// before: corrupted cached base image
$ docker build ... # DigestException: Invalid digest or hash: sha256:zzz...
// after: purge and re-pull the base image
$ docker rmi registry.example.com/base:latest
$ docker pull registry.example.com/base:latest

Defensive patterns

Strategy: validation

Validate before calling

// validate digests reported by the local daemon before image-details processing
boolean isValidDigestOrHash(String v) {
    return v != null && (v.matches("sha256:[a-f0-9]{64}") || v.matches("[a-f0-9]{64}"));
}

Type guard

boolean isWellFormedDigest(String v) {
    return v != null && v.matches("sha256:[a-f0-9]{64}");
}

Try / catch

try {
    inspectDaemonImage();
} catch (RuntimeException e) {
    if (e.getCause() instanceof com.google.cloud.tools.jib.api.DescriptorDigest.DigestException) {
        // corrupted local image metadata — purge and re-pull
        throw new IllegalStateException("Re-pull the base image: docker rmi <img> && docker pull <img>", e);
    }
    throw e;
}

Prevention

Re-pull base images when daemon metadata looks corrupted
Avoid mixing podman/containerd image stores with jib docker builds
Keep docker daemon up to date
Prefer pulling from the registry during the build rather than relying on stale local images

When it happens

Trigger: quarkus.container-image.build with docker builder where Jib queries the local daemon for the base image and the daemon returns a RepoDigest/DiffId that matches neither the digest regex (sha256:<64 hex>) nor the hash regex (<64 hex>) — e.g. corrupted local image metadata, unusual registries, or nonstandard image stores.

Common situations: Corrupted/partially pulled images in the local docker cache, images from obscure registries with malformed digests, containerd image store or podman shim returning unexpected metadata formats, docker version mismatches.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/3d826f190d785c1c. Report an issue: GitHub.