images.go 27.6 KB
Newer Older
1
2
3
4
package server

import (
	"bytes"
Michael Yang's avatar
Michael Yang committed
5
	"cmp"
6
	"context"
7
	"crypto/sha256"
8
	"encoding/base64"
Patrick Devine's avatar
Patrick Devine committed
9
	"encoding/hex"
10
11
12
13
14
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log"
15
	"log/slog"
16
	"net/http"
Michael Yang's avatar
Michael Yang committed
17
	"net/url"
18
19
	"os"
	"path/filepath"
Michael Yang's avatar
Michael Yang committed
20
	"runtime"
21
	"slices"
Michael Yang's avatar
Michael Yang committed
22
	"strconv"
23
24
	"strings"

25
	"github.com/ollama/ollama/api"
26
	"github.com/ollama/ollama/auth"
Michael Yang's avatar
Michael Yang committed
27
	"github.com/ollama/ollama/envconfig"
Michael Yang's avatar
Michael Yang committed
28
	"github.com/ollama/ollama/format"
29
	"github.com/ollama/ollama/llama"
30
	"github.com/ollama/ollama/llm"
31
	"github.com/ollama/ollama/parser"
Michael Yang's avatar
Michael Yang committed
32
	"github.com/ollama/ollama/template"
33
	"github.com/ollama/ollama/types/errtypes"
Michael Yang's avatar
Michael Yang committed
34
	"github.com/ollama/ollama/types/model"
35
	"github.com/ollama/ollama/version"
36
37
)

38
39
40
41
42
43
var (
	errCapabilities         = errors.New("does not support")
	errCapabilityCompletion = errors.New("completion")
	errCapabilityTools      = errors.New("tools")
	errCapabilityInsert     = errors.New("insert")
)
Michael Yang's avatar
Michael Yang committed
44

Michael Yang's avatar
Michael Yang committed
45
46
type Capability string

Michael Yang's avatar
tools  
Michael Yang committed
47
48
49
const (
	CapabilityCompletion = Capability("completion")
	CapabilityTools      = Capability("tools")
50
	CapabilityInsert     = Capability("insert")
Michael Yang's avatar
tools  
Michael Yang committed
51
)
Michael Yang's avatar
Michael Yang committed
52

Michael Yang's avatar
Michael Yang committed
53
54
55
56
57
type registryOptions struct {
	Insecure bool
	Username string
	Password string
	Token    string
58
59

	CheckRedirect func(req *http.Request, via []*http.Request) error
Michael Yang's avatar
Michael Yang committed
60
61
}

62
type Model struct {
Michael Yang's avatar
Michael Yang committed
63
	Name           string `json:"name"`
64
	Config         ConfigV2
Michael Yang's avatar
Michael Yang committed
65
66
	ShortName      string
	ModelPath      string
67
	ParentModel    string
Michael Yang's avatar
Michael Yang committed
68
69
70
71
72
73
	AdapterPaths   []string
	ProjectorPaths []string
	System         string
	License        []string
	Digest         string
	Options        map[string]interface{}
Michael Yang's avatar
Michael Yang committed
74
	Messages       []api.Message
Michael Yang's avatar
Michael Yang committed
75
76

	Template *template.Template
77
78
}

Michael Yang's avatar
Michael Yang committed
79
80
81
82
// CheckCapabilities checks if the model has the specified capabilities returning an error describing
// any missing or unknown capabilities
func (m *Model) CheckCapabilities(caps ...Capability) error {
	var errs []error
Michael Yang's avatar
Michael Yang committed
83
84
85
	for _, cap := range caps {
		switch cap {
		case CapabilityCompletion:
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
			f, err := os.Open(m.ModelPath)
			if err != nil {
				slog.Error("couldn't open model file", "error", err)
				continue
			}
			defer f.Close()

			// TODO(mxyng): decode the GGML into model to avoid doing this multiple times
			ggml, _, err := llm.DecodeGGML(f, 0)
			if err != nil {
				slog.Error("couldn't decode ggml", "error", err)
				continue
			}

			if _, ok := ggml.KV()[fmt.Sprintf("%s.pooling_type", ggml.KV().Architecture())]; ok {
Michael Yang's avatar
Michael Yang committed
101
				errs = append(errs, errCapabilityCompletion)
Michael Yang's avatar
Michael Yang committed
102
			}
Michael Yang's avatar
tools  
Michael Yang committed
103
104
		case CapabilityTools:
			if !slices.Contains(m.Template.Vars(), "tools") {
105
106
107
108
109
110
				errs = append(errs, errCapabilityTools)
			}
		case CapabilityInsert:
			vars := m.Template.Vars()
			if !slices.Contains(vars, "suffix") {
				errs = append(errs, errCapabilityInsert)
Michael Yang's avatar
tools  
Michael Yang committed
111
			}
Michael Yang's avatar
Michael Yang committed
112
113
		default:
			slog.Error("unknown capability", "capability", cap)
Michael Yang's avatar
Michael Yang committed
114
			return fmt.Errorf("unknown capability: %s", cap)
Michael Yang's avatar
Michael Yang committed
115
116
117
		}
	}

Michael Yang's avatar
Michael Yang committed
118
	if err := errors.Join(errs...); err != nil {
119
		return fmt.Errorf("%w %w", errCapabilities, errors.Join(errs...))
Michael Yang's avatar
Michael Yang committed
120
121
122
	}

	return nil
123
124
}

Michael Yang's avatar
Michael Yang committed
125
func (m *Model) String() string {
126
	var modelfile parser.File
Michael Yang's avatar
Michael Yang committed
127

128
	modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
129
130
131
		Name: "model",
		Args: m.ModelPath,
	})
132

Michael Yang's avatar
Michael Yang committed
133
	for _, adapter := range m.AdapterPaths {
134
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
135
136
			Name: "adapter",
			Args: adapter,
Michael Yang's avatar
Michael Yang committed
137
		})
138
139
	}

Michael Yang's avatar
Michael Yang committed
140
	for _, projector := range m.ProjectorPaths {
141
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
142
143
			Name: "model",
			Args: projector,
Michael Yang's avatar
Michael Yang committed
144
		})
145
146
	}

Michael Yang's avatar
Michael Yang committed
147
	if m.Template != nil {
148
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
149
			Name: "template",
Michael Yang's avatar
Michael Yang committed
150
			Args: m.Template.String(),
Michael Yang's avatar
Michael Yang committed
151
		})
152
153
	}

Michael Yang's avatar
Michael Yang committed
154
	if m.System != "" {
155
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
156
157
			Name: "system",
			Args: m.System,
Michael Yang's avatar
Michael Yang committed
158
		})
159
160
161
162
163
164
	}

	for k, v := range m.Options {
		switch v := v.(type) {
		case []any:
			for _, s := range v {
165
				modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
166
167
168
					Name: k,
					Args: fmt.Sprintf("%v", s),
				})
169
170
			}
		default:
171
			modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
172
173
174
				Name: k,
				Args: fmt.Sprintf("%v", v),
			})
175
176
177
178
		}
	}

	for _, license := range m.License {
179
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
180
181
182
			Name: "license",
			Args: license,
		})
183
184
185
	}

	for _, msg := range m.Messages {
186
		modelfile.Commands = append(modelfile.Commands, parser.Command{
Michael Yang's avatar
Michael Yang committed
187
			Name: "message",
Michael Yang's avatar
Michael Yang committed
188
			Args: fmt.Sprintf("%s: %s", msg.Role, msg.Content),
Michael Yang's avatar
Michael Yang committed
189
		})
190
191
	}

Michael Yang's avatar
Michael Yang committed
192
	return modelfile.String()
193
194
}

195
type ConfigV2 struct {
196
197
198
199
200
201
	ModelFormat   string   `json:"model_format"`
	ModelFamily   string   `json:"model_family"`
	ModelFamilies []string `json:"model_families"`
	ModelType     string   `json:"model_type"`
	FileType      string   `json:"file_type"`

202
	// required by spec
203
204
	Architecture string `json:"architecture"`
	OS           string `json:"os"`
205
	RootFS       RootFS `json:"rootfs"`
206
207
208
209
210
211
212
}

type RootFS struct {
	Type    string   `json:"type"`
	DiffIDs []string `json:"diff_ids"`
}

Michael Yang's avatar
Michael Yang committed
213
func GetManifest(mp ModelPath) (*Manifest, string, error) {
214
	fp, err := mp.GetManifestPath()
215
	if err != nil {
Patrick Devine's avatar
Patrick Devine committed
216
		return nil, "", err
217
	}
218

Michael Yang's avatar
Michael Yang committed
219
	f, err := os.Open(fp)
220
	if err != nil {
Michael Yang's avatar
Michael Yang committed
221
		return nil, "", err
222
	}
Michael Yang's avatar
Michael Yang committed
223
	defer f.Close()
224

Michael Yang's avatar
Michael Yang committed
225
	sha256sum := sha256.New()
Patrick Devine's avatar
Patrick Devine committed
226

Michael Yang's avatar
Michael Yang committed
227
228
	var manifest Manifest
	if err := json.NewDecoder(io.TeeReader(f, sha256sum)).Decode(&manifest); err != nil {
Patrick Devine's avatar
Patrick Devine committed
229
		return nil, "", err
230
231
	}

Michael Yang's avatar
Michael Yang committed
232
	return &manifest, hex.EncodeToString(sha256sum.Sum(nil)), nil
233
234
235
}

func GetModel(name string) (*Model, error) {
236
	mp := ParseModelPath(name)
Patrick Devine's avatar
Patrick Devine committed
237
	manifest, digest, err := GetManifest(mp)
238
239
240
241
242
	if err != nil {
		return nil, err
	}

	model := &Model{
243
244
245
		Name:      mp.GetFullTagname(),
		ShortName: mp.GetShortTagname(),
		Digest:    digest,
Michael Yang's avatar
Michael Yang committed
246
		Template:  template.DefaultTemplate,
247
248
	}

249
250
251
252
253
	if manifest.Config.Digest != "" {
		filename, err := GetBlobsPath(manifest.Config.Digest)
		if err != nil {
			return nil, err
		}
254

255
256
257
258
259
		configFile, err := os.Open(filename)
		if err != nil {
			return nil, err
		}
		defer configFile.Close()
260

261
262
263
		if err := json.NewDecoder(configFile).Decode(&model.Config); err != nil {
			return nil, err
		}
264
265
	}

266
	for _, layer := range manifest.Layers {
Patrick Devine's avatar
Patrick Devine committed
267
		filename, err := GetBlobsPath(layer.Digest)
268
269
270
271
		if err != nil {
			return nil, err
		}

272
273
274
		switch layer.MediaType {
		case "application/vnd.ollama.image.model":
			model.ModelPath = filename
275
			model.ParentModel = layer.From
276
		case "application/vnd.ollama.image.embed":
277
278
			// Deprecated in versions  > 0.1.2
			// TODO: remove this warning in a future version
279
			slog.Info("WARNING: model contains embeddings, but embeddings in modelfiles have been deprecated and will be ignored.")
280
281
		case "application/vnd.ollama.image.adapter":
			model.AdapterPaths = append(model.AdapterPaths, filename)
Michael Yang's avatar
Michael Yang committed
282
283
		case "application/vnd.ollama.image.projector":
			model.ProjectorPaths = append(model.ProjectorPaths, filename)
Michael Yang's avatar
Michael Yang committed
284
285
		case "application/vnd.ollama.image.prompt",
			"application/vnd.ollama.image.template":
286
287
288
289
290
			bts, err := os.ReadFile(filename)
			if err != nil {
				return nil, err
			}

Michael Yang's avatar
Michael Yang committed
291
			model.Template, err = template.Parse(string(bts))
292
293
294
			if err != nil {
				return nil, err
			}
Michael Yang's avatar
Michael Yang committed
295
		case "application/vnd.ollama.image.system":
296
297
298
299
300
			bts, err := os.ReadFile(filename)
			if err != nil {
				return nil, err
			}

Michael Yang's avatar
Michael Yang committed
301
			model.System = string(bts)
302
		case "application/vnd.ollama.image.params":
Michael Yang's avatar
Michael Yang committed
303
304
305
306
307
			params, err := os.Open(filename)
			if err != nil {
				return nil, err
			}
			defer params.Close()
308

309
			// parse model options parameters into a map so that we can see which fields have been specified explicitly
310
			if err = json.NewDecoder(params).Decode(&model.Options); err != nil {
311
312
				return nil, err
			}
313
314
315
316
317
318
319
320
321
322
		case "application/vnd.ollama.image.messages":
			msgs, err := os.Open(filename)
			if err != nil {
				return nil, err
			}
			defer msgs.Close()

			if err = json.NewDecoder(msgs).Decode(&model.Messages); err != nil {
				return nil, err
			}
Patrick Devine's avatar
Patrick Devine committed
323
324
325
326
327
328
		case "application/vnd.ollama.image.license":
			bts, err := os.ReadFile(filename)
			if err != nil {
				return nil, err
			}
			model.License = append(model.License, string(bts))
329
330
331
332
333
334
		}
	}

	return model, nil
}

Michael Yang's avatar
Michael Yang committed
335
func realpath(rel, from string) string {
336
	abspath, err := filepath.Abs(from)
Michael Yang's avatar
Michael Yang committed
337
	if err != nil {
338
		return from
339
340
	}

Michael Yang's avatar
Michael Yang committed
341
	home, err := os.UserHomeDir()
342
	if err != nil {
Michael Yang's avatar
Michael Yang committed
343
		return abspath
344
345
	}

346
	if from == "~" {
Michael Yang's avatar
Michael Yang committed
347
		return home
348
349
350
351
	} else if strings.HasPrefix(from, "~/") {
		return filepath.Join(home, from[2:])
	}

Michael Yang's avatar
Michael Yang committed
352
	if _, err := os.Stat(filepath.Join(rel, from)); err == nil {
353
		// this is a file relative to the Modelfile
Michael Yang's avatar
Michael Yang committed
354
		return filepath.Join(rel, from)
355
356
	}

Michael Yang's avatar
Michael Yang committed
357
358
359
	return abspath
}

360
func CreateModel(ctx context.Context, name model.Name, modelFileDir, quantization string, modelfile *parser.File, fn func(resp api.ProgressResponse)) (err error) {
361
362
	config := ConfigV2{
		OS:           "linux",
Michael Yang's avatar
Michael Yang committed
363
		Architecture: "amd64",
Michael Yang's avatar
Michael Yang committed
364
365
366
		RootFS: RootFS{
			Type: "layers",
		},
367
368
	}

Michael Yang's avatar
Michael Yang committed
369
370
	var messages []*api.Message
	parameters := make(map[string]any)
Michael Yang's avatar
Michael Yang committed
371

372
	var layers []Layer
373
	var baseLayers []*layerGGML
Michael Yang's avatar
Michael Yang committed
374
	for _, c := range modelfile.Commands {
Michael Yang's avatar
Michael Yang committed
375
		mediatype := fmt.Sprintf("application/vnd.ollama.image.%s", c.Name)
376
		command := c.Name
Michael Yang's avatar
Michael Yang committed
377

378
		switch command {
Michael Yang's avatar
Michael Yang committed
379
		case "model", "adapter":
380
			if name := model.ParseName(c.Args); name.IsValid() && command == "model" {
Michael Yang's avatar
Michael Yang committed
381
				baseLayers, err = parseFromModel(ctx, name, fn)
Michael Yang's avatar
Michael Yang committed
382
383
384
				if err != nil {
					return err
				}
Michael Yang's avatar
Michael Yang committed
385
			} else if strings.HasPrefix(c.Args, "@") {
386
				digest := strings.TrimPrefix(c.Args, "@")
Michael Yang's avatar
Michael Yang committed
387
388
				if ib, ok := intermediateBlobs[digest]; ok {
					p, err := GetBlobsPath(ib)
389
390
391
392
393
394
395
396
397
					if err != nil {
						return err
					}

					if _, err := os.Stat(p); errors.Is(err, os.ErrNotExist) {
						// pass
					} else if err != nil {
						return err
					} else {
Michael Yang's avatar
Michael Yang committed
398
399
						fn(api.ProgressResponse{Status: fmt.Sprintf("using cached layer %s", ib)})
						digest = ib
400
401
402
403
					}
				}

				blobpath, err := GetBlobsPath(digest)
Michael Yang's avatar
Michael Yang committed
404
				if err != nil {
Michael Yang's avatar
Michael Yang committed
405
					return err
406
				}
407

Michael Yang's avatar
Michael Yang committed
408
				blob, err := os.Open(blobpath)
Michael Yang's avatar
Michael Yang committed
409
410
411
				if err != nil {
					return err
				}
Michael Yang's avatar
Michael Yang committed
412
				defer blob.Close()
Michael Yang's avatar
Michael Yang committed
413

414
				baseLayers, err = parseFromFile(ctx, command, baseLayers, blob, digest, fn)
Michael Yang's avatar
Michael Yang committed
415
416
417
				if err != nil {
					return err
				}
Michael Yang's avatar
Michael Yang committed
418
419
			} else if file, err := os.Open(realpath(modelFileDir, c.Args)); err == nil {
				defer file.Close()
Michael Yang's avatar
Michael Yang committed
420

421
				baseLayers, err = parseFromFile(ctx, command, baseLayers, file, "", fn)
Michael Yang's avatar
Michael Yang committed
422
				if err != nil {
Michael Yang's avatar
Michael Yang committed
423
424
					return err
				}
Michael Yang's avatar
Michael Yang committed
425
426
427
			} else {
				return fmt.Errorf("invalid model reference: %s", c.Args)
			}
Michael Yang's avatar
Michael Yang committed
428

Michael Yang's avatar
Michael Yang committed
429
			for _, baseLayer := range baseLayers {
Michael Yang's avatar
Michael Yang committed
430
431
432
433
				if quantization != "" &&
					baseLayer.MediaType == "application/vnd.ollama.image.model" &&
					baseLayer.GGML != nil &&
					baseLayer.GGML.Name() == "gguf" {
Michael Yang's avatar
Michael Yang committed
434
					want, err := llm.ParseFileType(quantization)
435
					if err != nil {
Michael Yang's avatar
Michael Yang committed
436
						return err
437
					}
Michael Yang's avatar
Michael Yang committed
438

Michael Yang's avatar
Michael Yang committed
439
440
					ft := baseLayer.GGML.KV().FileType()
					if !slices.Contains([]string{"F16", "F32"}, ft.String()) {
Michael Yang's avatar
Michael Yang committed
441
						return errors.New("quantization is only supported for F16 and F32 models")
Michael Yang's avatar
Michael Yang committed
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
					} else if want != ft {
						fn(api.ProgressResponse{Status: fmt.Sprintf("quantizing %s model to %s", ft, quantization)})

						blob, err := GetBlobsPath(baseLayer.Digest)
						if err != nil {
							return err
						}

						temp, err := os.CreateTemp(filepath.Dir(blob), quantization)
						if err != nil {
							return err
						}
						defer temp.Close()
						defer os.Remove(temp.Name())

457
						if err := llama.Quantize(blob, temp.Name(), uint32(want)); err != nil {
Michael Yang's avatar
Michael Yang committed
458
459
460
							return err
						}

Michael Yang's avatar
Michael Yang committed
461
						layer, err := NewLayer(temp, baseLayer.MediaType)
Michael Yang's avatar
Michael Yang committed
462
463
464
						if err != nil {
							return err
						}
Michael Yang's avatar
Michael Yang committed
465

Michael Yang's avatar
Michael Yang committed
466
467
468
469
						if _, err := temp.Seek(0, io.SeekStart); err != nil {
							return err
						}

470
						ggml, _, err := llm.DecodeGGML(temp, 0)
Michael Yang's avatar
Michael Yang committed
471
472
						if err != nil {
							return err
Michael Yang's avatar
Michael Yang committed
473
474
						}

Michael Yang's avatar
Michael Yang committed
475
476
						baseLayer.Layer = layer
						baseLayer.GGML = ggml
Michael Yang's avatar
Michael Yang committed
477
					}
478
				}
479

Michael Yang's avatar
Michael Yang committed
480
481
482
483
				if baseLayer.GGML != nil {
					config.ModelFormat = cmp.Or(config.ModelFormat, baseLayer.GGML.Name())
					config.ModelFamily = cmp.Or(config.ModelFamily, baseLayer.GGML.KV().Architecture())
					config.ModelType = cmp.Or(config.ModelType, format.HumanNumber(baseLayer.GGML.KV().ParameterCount()))
Michael Yang's avatar
Michael Yang committed
484
					config.FileType = cmp.Or(config.FileType, baseLayer.GGML.KV().FileType().String())
Michael Yang's avatar
Michael Yang committed
485
					config.ModelFamilies = append(config.ModelFamilies, baseLayer.GGML.KV().Architecture())
486
487
				}

Michael Yang's avatar
Michael Yang committed
488
				layers = append(layers, baseLayer.Layer)
489
			}
Michael Yang's avatar
Michael Yang committed
490
		case "license", "template", "system":
Josh's avatar
Josh committed
491
492
493
494
495
496
			if c.Name == "template" {
				if _, err := template.Parse(c.Args); err != nil {
					return fmt.Errorf("%w: %s", errBadTemplate, err)
				}
			}

Michael Yang's avatar
Michael Yang committed
497
498
			if c.Name != "license" {
				// replace
499
				layers = slices.DeleteFunc(layers, func(layer Layer) bool {
500
501
502
503
504
505
506
507
508
					if layer.MediaType != mediatype {
						return false
					}

					if err := layer.Remove(); err != nil {
						return false
					}

					return true
Michael Yang's avatar
Michael Yang committed
509
				})
Michael Yang's avatar
Michael Yang committed
510
511
			}

512
513
514
515
516
517
			blob := strings.NewReader(c.Args)
			layer, err := NewLayer(blob, mediatype)
			if err != nil {
				return err
			}

Michael Yang's avatar
Michael Yang committed
518
519
520
521
522
523
524
525
526
527
			layers = append(layers, layer)
		case "message":
			role, content, ok := strings.Cut(c.Args, ": ")
			if !ok {
				return fmt.Errorf("invalid message: %s", c.Args)
			}

			messages = append(messages, &api.Message{Role: role, Content: content})
		default:
			ps, err := api.FormatParams(map[string][]string{c.Name: {c.Args}})
528
			if err != nil {
Michael Yang's avatar
Michael Yang committed
529
				return err
530
			}
Bruce MacDonald's avatar
Bruce MacDonald committed
531

Michael Yang's avatar
Michael Yang committed
532
533
534
535
536
537
538
539
540
541
542
			for k, v := range ps {
				if ks, ok := parameters[k].([]string); ok {
					parameters[k] = append(ks, v.([]string)...)
				} else if vs, ok := v.([]string); ok {
					parameters[k] = vs
				} else {
					parameters[k] = v
				}
			}
		}
	}
Michael Yang's avatar
Michael Yang committed
543

Michael Yang's avatar
Michael Yang committed
544
	var err2 error
545
	layers = slices.DeleteFunc(layers, func(layer Layer) bool {
Michael Yang's avatar
Michael Yang committed
546
547
548
549
550
551
552
553
554
555
556
		switch layer.MediaType {
		case "application/vnd.ollama.image.message":
			// if there are new messages, remove the inherited ones
			if len(messages) > 0 {
				return true
			}

			return false
		case "application/vnd.ollama.image.params":
			// merge inherited parameters with new ones
			r, err := layer.Open()
Bruce MacDonald's avatar
Bruce MacDonald committed
557
			if err != nil {
Michael Yang's avatar
Michael Yang committed
558
559
				err2 = err
				return false
Bruce MacDonald's avatar
Bruce MacDonald committed
560
			}
Michael Yang's avatar
Michael Yang committed
561
			defer r.Close()
Bruce MacDonald's avatar
Bruce MacDonald committed
562

Michael Yang's avatar
Michael Yang committed
563
564
565
566
567
			var ps map[string]any
			if err := json.NewDecoder(r).Decode(&ps); err != nil {
				err2 = err
				return false
			}
Michael Yang's avatar
Michael Yang committed
568

Michael Yang's avatar
Michael Yang committed
569
570
571
572
			for k, v := range ps {
				if _, ok := parameters[k]; !ok {
					parameters[k] = v
				}
573
			}
574

Michael Yang's avatar
Michael Yang committed
575
			return true
576
		default:
Michael Yang's avatar
Michael Yang committed
577
			return false
578
		}
Michael Yang's avatar
Michael Yang committed
579
580
581
582
	})

	if err2 != nil {
		return err2
583
584
	}

585
586
	if len(messages) > 0 {
		var b bytes.Buffer
Michael Yang's avatar
Michael Yang committed
587
		if err := json.NewEncoder(&b).Encode(messages); err != nil {
588
589
590
591
592
593
594
595
			return err
		}

		layer, err := NewLayer(&b, "application/vnd.ollama.image.messages")
		if err != nil {
			return err
		}

Michael Yang's avatar
Michael Yang committed
596
		layers = append(layers, layer)
597
598
	}

Michael Yang's avatar
Michael Yang committed
599
	if len(parameters) > 0 {
Michael Yang's avatar
Michael Yang committed
600
		var b bytes.Buffer
Michael Yang's avatar
Michael Yang committed
601
		if err := json.NewEncoder(&b).Encode(parameters); err != nil {
602
603
604
			return err
		}

Michael Yang's avatar
Michael Yang committed
605
		layer, err := NewLayer(&b, "application/vnd.ollama.image.params")
606
		if err != nil {
Michael Yang's avatar
Michael Yang committed
607
			return err
608
		}
Michael Yang's avatar
Michael Yang committed
609

Michael Yang's avatar
Michael Yang committed
610
		layers = append(layers, layer)
611
612
	}

Michael Yang's avatar
Michael Yang committed
613
614
	digests := make([]string, len(layers))
	for i, layer := range layers {
Michael Yang's avatar
Michael Yang committed
615
		digests[i] = layer.Digest
616
617
	}

Michael Yang's avatar
Michael Yang committed
618
	config.RootFS.DiffIDs = digests
Michael Yang's avatar
Michael Yang committed
619

Michael Yang's avatar
Michael Yang committed
620
621
	var b bytes.Buffer
	if err := json.NewEncoder(&b).Encode(config); err != nil {
622
623
624
		return err
	}

625
	configLayer, err := NewLayer(&b, "application/vnd.docker.container.image.v1+json")
Michael Yang's avatar
Michael Yang committed
626
	if err != nil {
627
628
629
		return err
	}

630
	for _, layer := range append(layers, configLayer) {
Michael Yang's avatar
Michael Yang committed
631
632
		if layer.status != "" {
			fn(api.ProgressResponse{Status: layer.status})
633
		}
Michael Yang's avatar
Michael Yang committed
634
	}
635

636
	old, _ := ParseNamedManifest(name)
637

Michael Yang's avatar
Michael Yang committed
638
	fn(api.ProgressResponse{Status: "writing manifest"})
639
	if err := WriteManifest(name, configLayer, layers); err != nil {
640
641
		return err
	}
642

Michael Yang's avatar
bool  
Michael Yang committed
643
	if !envconfig.NoPrune() && old != nil {
644
		if err := old.RemoveLayers(); err != nil {
Michael Yang's avatar
Michael Yang committed
645
			return err
646
647
648
		}
	}

Michael Yang's avatar
Michael Yang committed
649
650
	fn(api.ProgressResponse{Status: "success"})
	return nil
651
652
}

Michael Yang's avatar
Michael Yang committed
653
func CopyModel(src, dst model.Name) error {
654
655
656
657
658
659
660
	if !dst.IsFullyQualified() {
		return model.Unqualified(dst)
	}
	if !src.IsFullyQualified() {
		return model.Unqualified(src)
	}

661
662
663
664
	if src.Filepath() == dst.Filepath() {
		return nil
	}

Michael Yang's avatar
Michael Yang committed
665
	manifests, err := GetManifestPath()
666
667
668
669
	if err != nil {
		return err
	}

670
	dstpath := filepath.Join(manifests, dst.Filepath())
Michael Yang's avatar
Michael Yang committed
671
	if err := os.MkdirAll(filepath.Dir(dstpath), 0o755); err != nil {
672
673
		return err
	}
Patrick Devine's avatar
Patrick Devine committed
674

675
	srcpath := filepath.Join(manifests, src.Filepath())
Michael Yang's avatar
Michael Yang committed
676
	srcfile, err := os.Open(srcpath)
Patrick Devine's avatar
Patrick Devine committed
677
678
679
	if err != nil {
		return err
	}
Michael Yang's avatar
Michael Yang committed
680
	defer srcfile.Close()
Patrick Devine's avatar
Patrick Devine committed
681

Michael Yang's avatar
Michael Yang committed
682
	dstfile, err := os.Create(dstpath)
Patrick Devine's avatar
Patrick Devine committed
683
684
685
	if err != nil {
		return err
	}
Michael Yang's avatar
Michael Yang committed
686
	defer dstfile.Close()
Patrick Devine's avatar
Patrick Devine committed
687

Michael Yang's avatar
Michael Yang committed
688
689
	_, err = io.Copy(dstfile, srcfile)
	return err
Patrick Devine's avatar
Patrick Devine committed
690
691
}

Michael Yang's avatar
Michael Yang committed
692
693
func deleteUnusedLayers(deleteMap map[string]struct{}) error {
	manifests, err := Manifests()
694
695
696
	if err != nil {
		return err
	}
Michael Yang's avatar
Michael Yang committed
697

Michael Yang's avatar
Michael Yang committed
698
	for _, manifest := range manifests {
Michael Yang's avatar
Michael Yang committed
699
700
701
702
703
		for _, layer := range manifest.Layers {
			delete(deleteMap, layer.Digest)
		}

		delete(deleteMap, manifest.Config.Digest)
Michael Yang's avatar
Michael Yang committed
704
	}
705
706

	// only delete the files which are still in the deleteMap
Michael Yang's avatar
Michael Yang committed
707
708
709
	for k := range deleteMap {
		fp, err := GetBlobsPath(k)
		if err != nil {
710
			slog.Info(fmt.Sprintf("couldn't get file path for '%s': %v", k, err))
Michael Yang's avatar
Michael Yang committed
711
712
			continue
		}
713
714
715
		if err := os.Remove(fp); err != nil {
			slog.Info(fmt.Sprintf("couldn't remove file '%s': %v", fp, err))
			continue
716
717
718
		}
	}

719
720
721
722
	return nil
}

func PruneLayers() error {
Michael Yang's avatar
Michael Yang committed
723
	deleteMap := make(map[string]struct{})
724
725
726
727
728
729
730
	p, err := GetBlobsPath("")
	if err != nil {
		return err
	}

	blobs, err := os.ReadDir(p)
	if err != nil {
731
		slog.Info(fmt.Sprintf("couldn't read dir '%s': %v", p, err))
732
733
734
735
736
		return err
	}

	for _, blob := range blobs {
		name := blob.Name()
737
		name = strings.ReplaceAll(name, "-", ":")
738
739
740
741
742
743
744
745
746
747
748

		_, err := GetBlobsPath(name)
		if err != nil {
			if errors.Is(err, ErrInvalidDigestFormat) {
				// remove invalid blobs (e.g. partial downloads)
				if err := os.Remove(filepath.Join(p, blob.Name())); err != nil {
					slog.Error("couldn't remove blob", "blob", blob.Name(), "error", err)
				}
			}

			continue
Michael Yang's avatar
Michael Yang committed
749
		}
750
751

		deleteMap[name] = struct{}{}
752
753
	}

754
	slog.Info(fmt.Sprintf("total blobs: %d", len(deleteMap)))
755

Michael Yang's avatar
Michael Yang committed
756
	if err := deleteUnusedLayers(deleteMap); err != nil {
757
		slog.Error(fmt.Sprintf("couldn't remove unused layers: %v", err))
758
		return nil
759
760
	}

761
	slog.Info(fmt.Sprintf("total unused blobs removed: %d", len(deleteMap)))
762
763
764
765

	return nil
}

Michael Yang's avatar
Michael Yang committed
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
func PruneDirectory(path string) error {
	info, err := os.Lstat(path)
	if err != nil {
		return err
	}

	if info.IsDir() && info.Mode()&os.ModeSymlink == 0 {
		entries, err := os.ReadDir(path)
		if err != nil {
			return err
		}

		for _, entry := range entries {
			if err := PruneDirectory(filepath.Join(path, entry.Name())); err != nil {
				return err
			}
		}

		entries, err = os.ReadDir(path)
		if err != nil {
			return err
		}

		if len(entries) > 0 {
			return nil
		}

		return os.Remove(path)
	}

	return nil
}

Michael Yang's avatar
Michael Yang committed
799
func PushModel(ctx context.Context, name string, regOpts *registryOptions, fn func(api.ProgressResponse)) error {
800
	mp := ParseModelPath(name)
801
802
	fn(api.ProgressResponse{Status: "retrieving manifest"})

803
	if mp.ProtocolScheme == "http" && !regOpts.Insecure {
Michael Yang's avatar
lint  
Michael Yang committed
804
		return errors.New("insecure protocol http")
805
806
	}

Patrick Devine's avatar
Patrick Devine committed
807
	manifest, _, err := GetManifest(mp)
808
	if err != nil {
809
		fn(api.ProgressResponse{Status: "couldn't retrieve manifest"})
810
811
812
		return err
	}

813
	var layers []Layer
Jeffrey Morgan's avatar
Jeffrey Morgan committed
814
	layers = append(layers, manifest.Layers...)
815
	if manifest.Config.Digest != "" {
816
		layers = append(layers, manifest.Config)
817
	}
818
819

	for _, layer := range layers {
Michael Yang's avatar
Michael Yang committed
820
		if err := uploadBlob(ctx, mp, layer, regOpts, fn); err != nil {
821
			slog.Info(fmt.Sprintf("error uploading blob: %v", err))
822
823
			return err
		}
824
825
	}

826
	fn(api.ProgressResponse{Status: "pushing manifest"})
Michael Yang's avatar
Michael Yang committed
827
828
	requestURL := mp.BaseURL()
	requestURL = requestURL.JoinPath("v2", mp.GetNamespaceRepository(), "manifests", mp.Tag)
829
830
831
832
833
834

	manifestJSON, err := json.Marshal(manifest)
	if err != nil {
		return err
	}

Michael Yang's avatar
Michael Yang committed
835
836
	headers := make(http.Header)
	headers.Set("Content-Type", "application/vnd.docker.distribution.manifest.v2+json")
Michael Yang's avatar
Michael Yang committed
837
	resp, err := makeRequestWithRetry(ctx, http.MethodPut, requestURL, headers, bytes.NewReader(manifestJSON), regOpts)
838
839
840
841
842
	if err != nil {
		return err
	}
	defer resp.Body.Close()

843
	fn(api.ProgressResponse{Status: "success"})
844
845
846
847

	return nil
}

Michael Yang's avatar
Michael Yang committed
848
func PullModel(ctx context.Context, name string, regOpts *registryOptions, fn func(api.ProgressResponse)) error {
849
850
	mp := ParseModelPath(name)

851
	// build deleteMap to prune unused layers
Michael Yang's avatar
Michael Yang committed
852
	deleteMap := make(map[string]struct{})
Michael Yang's avatar
Michael Yang committed
853
854
855
856
857
858
859
860
	manifest, _, err := GetManifest(mp)
	if errors.Is(err, os.ErrNotExist) {
		// noop
	} else if err != nil && !errors.Is(err, os.ErrNotExist) {
		return err
	} else {
		for _, l := range manifest.Layers {
			deleteMap[l.Digest] = struct{}{}
861
		}
Michael Yang's avatar
Michael Yang committed
862
863
		if manifest.Config.Digest != "" {
			deleteMap[manifest.Config.Digest] = struct{}{}
864
865
866
		}
	}

867
	if mp.ProtocolScheme == "http" && !regOpts.Insecure {
Michael Yang's avatar
lint  
Michael Yang committed
868
		return errors.New("insecure protocol http")
869
	}
870

871
	fn(api.ProgressResponse{Status: "pulling manifest"})
872

873
	manifest, err = pullModelManifest(ctx, mp, regOpts)
874
	if err != nil {
875
		return fmt.Errorf("pull model manifest: %s", err)
876
877
	}

878
	var layers []Layer
Bruce MacDonald's avatar
Bruce MacDonald committed
879
	layers = append(layers, manifest.Layers...)
880
	if manifest.Config.Digest != "" {
881
		layers = append(layers, manifest.Config)
882
	}
883

884
	skipVerify := make(map[string]bool)
885
	for _, layer := range layers {
886
887
888
889
890
891
892
		cacheHit, err := downloadBlob(ctx, downloadOpts{
			mp:      mp,
			digest:  layer.Digest,
			regOpts: regOpts,
			fn:      fn,
		})
		if err != nil {
893
894
			return err
		}
895
		skipVerify[layer.Digest] = cacheHit
896
		delete(deleteMap, layer.Digest)
897
	}
898
	delete(deleteMap, manifest.Config.Digest)
899

Michael Yang's avatar
Michael Yang committed
900
901
	fn(api.ProgressResponse{Status: "verifying sha256 digest"})
	for _, layer := range layers {
902
903
904
		if skipVerify[layer.Digest] {
			continue
		}
Michael Yang's avatar
Michael Yang committed
905
		if err := verifyBlob(layer.Digest); err != nil {
906
907
908
909
910
911
912
913
			if errors.Is(err, errDigestMismatch) {
				// something went wrong, delete the blob
				fp, err := GetBlobsPath(layer.Digest)
				if err != nil {
					return err
				}
				if err := os.Remove(fp); err != nil {
					// log this, but return the original error
914
					slog.Info(fmt.Sprintf("couldn't remove file with digest mismatch '%s': %v", fp, err))
915
916
				}
			}
Michael Yang's avatar
Michael Yang committed
917
918
919
920
			return err
		}
	}

921
	fn(api.ProgressResponse{Status: "writing manifest"})
922

923
	manifestJSON, err := json.Marshal(manifest)
924
925
926
927
	if err != nil {
		return err
	}

928
	fp, err := mp.GetManifestPath()
929
930
931
	if err != nil {
		return err
	}
932
933
934
	if err := os.MkdirAll(filepath.Dir(fp), 0o755); err != nil {
		return err
	}
935

Bruce MacDonald's avatar
Bruce MacDonald committed
936
	err = os.WriteFile(fp, manifestJSON, 0o644)
937
	if err != nil {
938
		slog.Info(fmt.Sprintf("couldn't write to %s", fp))
939
940
941
		return err
	}

Michael Yang's avatar
Michael Yang committed
942
943
	if !envconfig.NoPrune() && len(deleteMap) > 0 {
		fn(api.ProgressResponse{Status: "removing unused layers"})
Michael Yang's avatar
Michael Yang committed
944
		if err := deleteUnusedLayers(deleteMap); err != nil {
945
			fn(api.ProgressResponse{Status: fmt.Sprintf("couldn't remove unused layers: %v", err)})
946
947
948
		}
	}

949
	fn(api.ProgressResponse{Status: "success"})
950
951
952
953

	return nil
}

Michael Yang's avatar
Michael Yang committed
954
func pullModelManifest(ctx context.Context, mp ModelPath, regOpts *registryOptions) (*Manifest, error) {
Michael Yang's avatar
Michael Yang committed
955
	requestURL := mp.BaseURL().JoinPath("v2", mp.GetNamespaceRepository(), "manifests", mp.Tag)
956

Michael Yang's avatar
Michael Yang committed
957
958
	headers := make(http.Header)
	headers.Set("Accept", "application/vnd.docker.distribution.manifest.v2+json")
Michael Yang's avatar
Michael Yang committed
959
	resp, err := makeRequestWithRetry(ctx, http.MethodGet, requestURL, headers, nil, regOpts)
960
961
962
963
964
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

Michael Yang's avatar
Michael Yang committed
965
	var m Manifest
966
967
968
969
	if err := json.NewDecoder(resp.Body).Decode(&m); err != nil {
		return nil, err
	}

Michael Yang's avatar
Michael Yang committed
970
	return &m, err
971
972
973
}

// GetSHA256Digest returns the SHA256 hash of a given buffer and returns it, and the size of buffer
Michael Yang's avatar
Michael Yang committed
974
func GetSHA256Digest(r io.Reader) (string, int64) {
Michael Yang's avatar
Michael Yang committed
975
976
977
978
979
980
	h := sha256.New()
	n, err := io.Copy(h, r)
	if err != nil {
		log.Fatal(err)
	}

Michael Yang's avatar
Michael Yang committed
981
	return fmt.Sprintf("sha256:%x", h.Sum(nil)), n
982
983
}

Michael Yang's avatar
lint  
Michael Yang committed
984
var errUnauthorized = errors.New("unauthorized: access denied")
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013

// getTokenSubject returns the subject of a JWT token, it does not validate the token
func getTokenSubject(token string) string {
	parts := strings.Split(token, ".")
	if len(parts) != 3 {
		return ""
	}

	payload := parts[1]
	payloadBytes, err := base64.RawURLEncoding.DecodeString(payload)
	if err != nil {
		slog.Error(fmt.Sprintf("failed to decode jwt payload: %v", err))
		return ""
	}

	var payloadMap map[string]interface{}
	if err := json.Unmarshal(payloadBytes, &payloadMap); err != nil {
		slog.Error(fmt.Sprintf("failed to unmarshal payload JSON: %v", err))
		return ""
	}

	sub, ok := payloadMap["sub"]
	if !ok {
		slog.Error("jwt does not contain 'sub' field")
		return ""
	}

	return fmt.Sprintf("%s", sub)
}
1014

Michael Yang's avatar
Michael Yang committed
1015
func makeRequestWithRetry(ctx context.Context, method string, requestURL *url.URL, headers http.Header, body io.ReadSeeker, regOpts *registryOptions) (*http.Response, error) {
1016
	anonymous := true // access will default to anonymous if no user is found associated with the public key
Michael Yang's avatar
lint  
Michael Yang committed
1017
	for range 2 {
Michael Yang's avatar
Michael Yang committed
1018
		resp, err := makeRequest(ctx, method, requestURL, headers, body, regOpts)
Michael Yang's avatar
Michael Yang committed
1019
		if err != nil {
Michael Yang's avatar
Michael Yang committed
1020
			if !errors.Is(err, context.Canceled) {
1021
				slog.Info(fmt.Sprintf("request failed: %v", err))
Michael Yang's avatar
Michael Yang committed
1022
1023
			}

Michael Yang's avatar
Michael Yang committed
1024
1025
			return nil, err
		}
Michael Yang's avatar
Michael Yang committed
1026
1027
1028

		switch {
		case resp.StatusCode == http.StatusUnauthorized:
1029
1030
			resp.Body.Close()

Michael Yang's avatar
Michael Yang committed
1031
			// Handle authentication error with one retry
Michael Yang's avatar
Michael Yang committed
1032
1033
			challenge := parseRegistryChallenge(resp.Header.Get("www-authenticate"))
			token, err := getAuthorizationToken(ctx, challenge)
Michael Yang's avatar
Michael Yang committed
1034
1035
1036
			if err != nil {
				return nil, err
			}
1037
			anonymous = getTokenSubject(token) == "anonymous"
Michael Yang's avatar
Michael Yang committed
1038
1039
1040
1041
1042
1043
1044
1045
			regOpts.Token = token
			if body != nil {
				_, err = body.Seek(0, io.SeekStart)
				if err != nil {
					return nil, err
				}
			}
		case resp.StatusCode == http.StatusNotFound:
1046
			resp.Body.Close()
Michael Yang's avatar
Michael Yang committed
1047
1048
			return nil, os.ErrNotExist
		case resp.StatusCode >= http.StatusBadRequest:
1049
			defer resp.Body.Close()
Michael Yang's avatar
Michael Yang committed
1050
1051
1052
1053
1054
1055
1056
			responseBody, err := io.ReadAll(resp.Body)
			if err != nil {
				return nil, fmt.Errorf("%d: %s", resp.StatusCode, err)
			}
			return nil, fmt.Errorf("%d: %s", resp.StatusCode, responseBody)
		default:
			return resp, nil
Michael Yang's avatar
Michael Yang committed
1057
1058
1059
		}
	}

1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
	if anonymous {
		// no user is associated with the public key, and the request requires non-anonymous access
		pubKey, nestedErr := auth.GetPublicKey()
		if nestedErr != nil {
			slog.Error(fmt.Sprintf("couldn't get public key: %v", nestedErr))
			return nil, errUnauthorized
		}
		return nil, &errtypes.UnknownOllamaKey{Key: pubKey}
	}
	// user is associated with the public key, but is not authorized to make the request
Michael Yang's avatar
Michael Yang committed
1070
	return nil, errUnauthorized
Michael Yang's avatar
Michael Yang committed
1071
1072
}

Michael Yang's avatar
Michael Yang committed
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
func makeRequest(ctx context.Context, method string, requestURL *url.URL, headers http.Header, body io.Reader, regOpts *registryOptions) (*http.Response, error) {
	if requestURL.Scheme != "http" && regOpts != nil && regOpts.Insecure {
		requestURL.Scheme = "http"
	}

	req, err := http.NewRequestWithContext(ctx, method, requestURL.String(), body)
	if err != nil {
		return nil, err
	}

	if headers != nil {
		req.Header = headers
	}

	if regOpts != nil {
		if regOpts.Token != "" {
			req.Header.Set("Authorization", "Bearer "+regOpts.Token)
		} else if regOpts.Username != "" && regOpts.Password != "" {
			req.SetBasicAuth(regOpts.Username, regOpts.Password)
		}
	}

1095
	req.Header.Set("User-Agent", fmt.Sprintf("ollama/%s (%s %s) Go/%s", version.Version, runtime.GOARCH, runtime.GOOS, runtime.Version()))
Michael Yang's avatar
Michael Yang committed
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105

	if s := req.Header.Get("Content-Length"); s != "" {
		contentLength, err := strconv.ParseInt(s, 10, 64)
		if err != nil {
			return nil, err
		}

		req.ContentLength = contentLength
	}

1106
1107
1108
	resp, err := (&http.Client{
		CheckRedirect: regOpts.CheckRedirect,
	}).Do(req)
Michael Yang's avatar
Michael Yang committed
1109
1110
1111
1112
1113
1114
1115
	if err != nil {
		return nil, err
	}

	return resp, nil
}

Patrick Devine's avatar
Patrick Devine committed
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
func getValue(header, key string) string {
	startIdx := strings.Index(header, key+"=")
	if startIdx == -1 {
		return ""
	}

	// Move the index to the starting quote after the key.
	startIdx += len(key) + 2
	endIdx := startIdx

	for endIdx < len(header) {
		if header[endIdx] == '"' {
			if endIdx+1 < len(header) && header[endIdx+1] != ',' { // If the next character isn't a comma, continue
				endIdx++
				continue
			}
			break
		}
		endIdx++
	}
	return header[startIdx:endIdx]
}

Michael Yang's avatar
Michael Yang committed
1139
func parseRegistryChallenge(authStr string) registryChallenge {
Patrick Devine's avatar
Patrick Devine committed
1140
1141
	authStr = strings.TrimPrefix(authStr, "Bearer ")

Michael Yang's avatar
Michael Yang committed
1142
	return registryChallenge{
Patrick Devine's avatar
Patrick Devine committed
1143
1144
1145
1146
1147
1148
		Realm:   getValue(authStr, "realm"),
		Service: getValue(authStr, "service"),
		Scope:   getValue(authStr, "scope"),
	}
}

1149
var errDigestMismatch = errors.New("digest mismatch, file must be downloaded again")
1150

Michael Yang's avatar
Michael Yang committed
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
func verifyBlob(digest string) error {
	fp, err := GetBlobsPath(digest)
	if err != nil {
		return err
	}

	f, err := os.Open(fp)
	if err != nil {
		return err
	}
	defer f.Close()

	fileDigest, _ := GetSHA256Digest(f)
	if digest != fileDigest {
1165
		return fmt.Errorf("%w: want %s, got %s", errDigestMismatch, digest, fileDigest)
Michael Yang's avatar
Michael Yang committed
1166
1167
1168
1169
	}

	return nil
}