I'm exploring integrating buildkit with some internal tooling at my company, which including pushing container images to a private registry we've written in-house.

Buildkit fails to push with errors like:

error: failed to solve: failed commit on ref
"manifest-sha256:6ecb3bd918d6fc34639ec852f2f064b9fc20d22a63cb67b2c9a53afc295cc663":
got digest sha256:9660b67ae9e0c7b828f2c500367cd2f95cbeb703d2c1c164bec95d5ed5b48253,
expected sha256:6ecb3bd918d6fc34639ec852f2f064b9fc20d22a63cb67b2c9a53afc295cc663

This is actually the last step of the pushing process so the error can be ignored, but it got me wondering whether our registry implementation is wrong, or if this is a bug in buildkit.

Looking at this oci spec:

Upon successful completion of the request, the response MUST have code 201 Created and MUST have the following header:

Location:
With being a pullable blob URL.

I don't see any clear statement that the digest returned by the registry must match the one generated by the client. For the manifest in particular, there doesn't seem to be a canonical way to marshal it into JSON, which is why the digests differ between client and server in this case.

Am I missing something, or is the buildkit client too strict here?