pkg/downloader/chart_downloader.go:134

• After decoding the digest, the code copies it into a fixed [32]byte buffer without validating the decoded length. If a non-SHA256 digest ever comes through (or any digest not exactly 32 bytes), this will silently truncate/pad and can lead to incorrect cache keys and potential collisions. Consider validating that the decoded digest is exactly sha256.Size bytes (and/or that any algorithm prefix is specifically sha256) before copying into digest32.

	var digest []byte
	var digest32 [32]byte
	if hash != "" {
		// if there is a hash, populate the other formats
		// Strip the algorithm prefix (e.g., "sha256:") if present
		digest, err = hex.DecodeString(stripDigestAlgorithm(hash))
		if err != nil {
			return "", nil, err
		}
		copy(digest32[:], digest)
		if pth, err := c.Cache.Get(digest32, CacheChart); err == nil {

pkg/downloader/chart_downloader.go:242

• Same issue as in DownloadTo: the decoded digest is copied into a fixed [32]byte buffer without checking the decoded length. This can silently truncate/pad non-32-byte digests and produce wrong cache keys; validate len(digest) == sha256.Size (or verify the algorithm prefix is sha256) before copying.

	// Strip the algorithm prefix (e.g., "sha256:") if present
	digest, err := hex.DecodeString(stripDigestAlgorithm(digestString))
	if err != nil {
		return "", nil, fmt.Errorf("unable to decode digest: %w", err)
	}
	var digest32 [32]byte
	copy(digest32[:], digest)

pkg/cmd/pull_test.go:551

• This strips the digest algorithm prefix using a fixed substring offset ([7:]), which assumes the digest always starts with sha256: and is long enough. Prefer parsing on : (e.g., via strings.Cut/SplitN) so the test is robust to digest algorithm/format changes and avoids a potential out-of-range panic if the digest string is unexpected.

		digestPart := result.PushedChart.Manifest.Digest[7:] // strip "sha256:"
		expectedFile = filepath.Join(outdir, fmt.Sprintf("oci-dependent-chart@sha256-%s.tgz", digestPart))