Given any buf.yaml with dependencies and a buf.lock, we expect buf export --config buf.yaml --output . to fail if the digest is incorrect. However, if the digest is incorrect but malformed, the digest is simply ignored.

i.e. If you replace a character of the digest with a valid incorrect character, buf will warn that the digest does not match. But if you just delete a character of the digest, buf will ignore the digest and run the command successfully.

IMO this should still fail.