Assume sha256 if digest algo is missing

GoogleContainerTools/kaniko#298

pkg/v1/remote/image.go

@@ -146,8 +146,12 @@ func (r *remoteImage) RawManifest() ([]byte, error) {
 		}
 	} else if checksum := resp.Header.Get("Docker-Content-Digest"); checksum != "" && checksum != digest.String() {
 		err := fmt.Errorf("manifest digest: %q does not match Docker-Content-Digest: %q for %q", digest, checksum, r.ref)
+
+		// Wall of registry shame:
 		if r.ref.Context().RegistryStr() == name.DefaultRegistry {
 			// TODO(docker/distribution#2395): Remove this check.
+		} else if "sha256:"+checksum == digest.String() {
+			// Assume sha256 if algo is missing, see GoogleContainerTools/kaniko#298.
 		} else {
 			// When pulling by tag, we can only validate that the digest matches what the registry told us it should be.
 			return nil, err

pkg/v1/remote/image_test.go

@@ -20,6 +20,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/google/go-containerregistry/pkg/name"
@@ -107,6 +108,12 @@ func TestRawManifestDigests(t *testing.T) {
 		responseBody:  mustRawManifest(t, img),
 		contentDigest: mustDigest(t, img).String(),
 		wantErr:       false,
+	}, {
+		name:          "normal pull, by tag, missing algo in digest",
+		ref:           "latest",
+		responseBody:  mustRawManifest(t, img),
+		contentDigest: strings.Split(mustDigest(t, img).String(), ":")[1],
+		wantErr:       false,
 	}, {
 		name:          "normal pull, by digest",
 		ref:           mustDigest(t, img).String(),