Function ensure_correct_composefs_digest 

pub(crate) fn ensure_correct_composefs_digest(
    repo: &Arc<Repository<Sha512HashValue>>,
    manifest_digest: &OciDigest,
    computed_id: Sha512HashValue,
    expected_ids: ExpectedBootImageIds,
    entries: &[BootEntry<Sha512HashValue>],
) -> Result<RecoveredBootImage>

Validates that the freshly-generated boot image digest computed_id matches what’s embedded in the UKI (if any), and if not, searches for an [composefs_oci::XattrFiltering] mode whose boot image digest does match via [composefs_oci::find_matching_boot_image], before giving up.

This handles images built with older (or newer) composefs-rs tooling that computed their embedded UKI digest using a different default xattr filtering mode or EROFS format than the one bootc’s own build used.