pulp-container 2.28.0__tar.gz → 2.29.0__tar.gz

{pulp_container-2.28.0 → pulp_container-2.29.0}/CHANGES.md

@@ -8,6 +8,45 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.29.0 (2026-08-10) {: #2.29.0 }
+
+#### Features {: #2.29.0-feature }
+
+- Enable DELETE on the Docker v2 manifest endpoint so users can delete manifests by digest.
+  [#480](https://github.com/pulp/pulp_container/issues/480)
+- Enable DELETE on the Docker v2 blob endpoint so users can delete blobs by digest.
+  [#481](https://github.com/pulp/pulp_container/issues/481)
+- Added support for retrieving blob upload status via `GET /v2/<name>/blobs/uploads/<uuid>`.
+  [#483](https://github.com/pulp/pulp_container/issues/483)
+- Added a `migrate` endpoint on push repositories that converts a legacy `ContainerPushRepository`
+  into a `ContainerRepository` in place. The repository primary key and version history are
+  preserved; only the repository type changes.
+- Added support for cancelling blob uploads via `DELETE /v2/<name>/blobs/uploads/<uuid>`.
+- Changed the default created repository on push to be a ContainerRepository instead of a ContainerPushRepository. ContainerPushRepository will eventually be phased out in future releases.
+
+#### Bugfixes {: #2.29.0-bugfix }
+
+- Fixed tag-based manifest pulls returning 404 when the client's `Accept` header listed the tagged manifest's media type together with parameters such as q-values, since the media type comparison did not strip them and had no support for the `*/*` wildcard.
+  [#2417](https://github.com/pulp/pulp_container/issues/2417)
+- Add transparent repair code during Manifest sync to redownload the raw data in case it was lost during an upgrade.
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+- Raised a proper `PulpException` subclass instead of a bare `Exception` when building or pushing an OCI image fails, so the error is not sanitized away by pulpcore in a future release.
+
+#### Improved Documentation {: #2.29.0-doc }
+
+- Rewrote the RBAC documentation to be more comprehensive and detailed.
+
+---
+
+## 2.28.1 (2026-07-22) {: #2.28.1 }
+
+#### Bugfixes {: #2.28.1-bugfix }
+
+- Add transparent repair code during Manifest sync to redownload the raw data in case it was lost during an upgrade.
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
 ## 2.28.0 (2026-05-29) {: #2.28.0 }
 
 #### Features {: #2.28.0-feature }
@@ -59,6 +98,21 @@
 
 ---
 
+## 2.27.11 (2026-07-29) {: #2.27.11 }
+
+No significant changes.
+
+---
+
+## 2.27.10 (2026-06-08) {: #2.27.10 }
+
+#### Bugfixes {: #2.27.10-bugfix }
+
+- Add transparent repair code during Manifest sync to redownload the raw data in case it was lost during an upgrade.
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
 ## 2.27.9 (2026-05-14) {: #2.27.9 }
 
 #### Bugfixes {: #2.27.9-bugfix }
@@ -163,7 +217,22 @@ No significant changes.
 
 #### Misc {: #2.27.0-misc }
 
-- 
+
+---
+
+## 2.26.16 (2026-06-08) {: #2.26.16 }
+
+#### Bugfixes {: #2.26.16-bugfix }
+
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
+## 2.26.15 (2026-06-02) {: #2.26.15 }
+
+#### Bugfixes {: #2.26.15-bugfix }
+
+- Readded backwards compatibility for manifests that haven't been migrated to new data field. Sync will try to update them to the new format and repair manifests that are missing their artifact, but it is recommended that you run the `pulpcore-manager container-handle-image-data` command to fix all manifests at once. The command has been updated to report broken manifests by repository. Broken manifests in pushed repositories need to be deleted and re-pushed.
 
 ---
 
@@ -292,6 +361,8 @@ No significant changes.
 
 ## 2.26.0 (2025-08-14) {: #2.26.0 }
 
+**WARNING:** If your installation pre-dates pulp_container 2.20, make sure that you run `pulpcore-manager container-handle-image-data` before upgrading to (or past) this release. If your installation began after pulp_container 2.20, or if you have already run this command at some point, this is not necessary.
+
 #### Features {: #2.26.0-feature }
 
 - Bump pulpcore upperbound to <3.100. pulp_container is now a Python >=3.11 project.
@@ -329,6 +400,8 @@ No significant changes.
 
 ## 2.25.0 (2025-04-15) {: #2.25.0 }
 
+**WARNING:** If your installation pre-dates pulp_container 2.20, make sure that you run `pulpcore-manager container-handle-image-data` before upgrading to (or past) this release. If your installation began after pulp_container 2.20, or if you have already run this command at some point, this is not necessary.
+
 #### Features {: #2.25.0-feature }
 
 - Added full support for domains.
@@ -353,6 +426,14 @@ No significant changes.
 
 ---
 
+## 2.24.12 (2026-07-21) {: #2.24.12 }
+
+#### Bugfixes {: #2.24.12-bugfix }
+
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
 ## 2.24.11 (2026-04-29) {: #2.24.11 }
 
 #### Bugfixes {: #2.24.11-bugfix }
@@ -483,6 +564,23 @@ No significant changes.
 
 ---
 
+## 2.22.10 (2026-07-23) {: #2.22.10 }
+
+#### Bugfixes {: #2.22.10-bugfix }
+
+- Fixed OS and architecture filters being silently ignored when filtering manifest lists in the flatpak index.
+- Fixed a serialization issue with the FlatpakIndex cache.
+
+---
+
+## 2.22.9 (2026-07-21) {: #2.22.9 }
+
+#### Bugfixes {: #2.22.9-bugfix }
+
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
 ## 2.22.8 (2026-04-24) {: #2.22.8 }
 
 No significant changes.
@@ -659,6 +757,23 @@ No significant changes.
 
 ---
 
+## 2.20.11 (2026-07-27) {: #2.20.11 }
+
+#### Bugfixes {: #2.20.11-bugfix }
+
+- Fixed OS and architecture filters being silently ignored when filtering manifest lists in the flatpak index.
+- Fixed a serialization issue with the FlatpakIndex cache.
+
+---
+
+## 2.20.10 (2026-07-21) {: #2.20.10 }
+
+#### Bugfixes {: #2.20.10-bugfix }
+
+- Added OCI manifest as an allowed media type in the Docker manifest list schema.
+
+---
+
 ## 2.20.9 (2026-04-24) {: #2.20.9 }
 
 No significant changes.
@@ -749,6 +864,8 @@ No significant changes.
 
 ## 2.20.0 (2024-05-06) {: #2.20.0 }
 
+**NOTICE:** If you are upgrading from a previous version of pulp_container, make sure that you run `pulpcore-manager container-handle-image-data` at some point before or shortly after upgrading. This is required in order to complete the transition away from storing Manifest data as artifacts. This must be done to avoid the potential for issues with later releases of pulp_container.
+
 ### Features
 
 -   Updated the Manifest model to no longer rely on artifacts, storing all manifest data internally
@@ -777,7 +894,22 @@ No significant changes.
 
 ### Misc
 
--   
+-
+
+---
+
+## 2.19.13 (2026-07-27) {: #2.19.13 }
+
+#### Bugfixes {: #2.19.13-bugfix }
+
+- Fixed OS and architecture filters being silently ignored when filtering manifest lists in the flatpak index.
+- Fixed a serialization issue with the FlatpakIndex cache.
+
+---
+
+## 2.19.12 (2026-06-08) {: #2.19.12 }
+
+No significant changes.
 
 ---
 

{pulp_container-2.28.0 → pulp_container-2.29.0}/MANIFEST.in

@@ -1,11 +1,13 @@
-include LICENSE
 include pulp_container/app/webserver_snippets/*
-include pyproject.toml
+include pulp_container/tests/unit/fixtures/*
+include LICENSE
 include CHANGES.md
 include COMMITMENT
 include COPYRIGHT
+include pyproject.toml
 include functest_requirements.txt
 include test_requirements.txt
 include unittest_requirements.txt
 exclude CONTRIBUTING.md
 exclude releasing.md
+exclude Makefile

{pulp_container-2.28.0 → pulp_container-2.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.28.0
+Version: 2.29.0
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.115,>=3.111.0
+Requires-Dist: pulpcore<3.130,>=3.111.0
 Requires-Dist: pyjwt[crypto]<2.14,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.33
 Dynamic: license-file

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.28.0"
+    version = "2.29.0"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/authorization.py

@@ -24,7 +24,7 @@ from pulp_container.app.models import (
     ContainerPullThroughDistribution,
 )
 
-TOKEN_EXPIRATION_TIME = settings.get("TOKEN_EXPIRATION_TIME", 300)
+TOKEN_EXPIRATION_TIME = getattr(settings, "TOKEN_EXPIRATION_TIME", 300)
 
 FakeView = namedtuple("FakeView", "action, get_object, get_serializer")
 
@@ -295,7 +295,6 @@ class PermissionChecker:
         if not domain:
             return False
 
-        print("Checking push permissions for path ", path, "and domain ", domain.name)
         try:
             distribution = ContainerDistribution.objects.get(base_path=path, pulp_domain=domain)
         except ContainerDistribution.DoesNotExist:

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/exceptions.py

@@ -1,5 +1,7 @@
 from rest_framework.exceptions import APIException, NotFound, ParseError
 
+from pulpcore.plugin.exceptions import PulpException
+
 
 class BadGateway(APIException):
     status_code = 502
@@ -90,6 +92,24 @@ class BlobInvalid(ParseError):
         )
 
 
+class BlobUploadUnknown(NotFound):
+    """Exception to render a 404 with the code 'BLOB_UPLOAD_UNKNOWN'"""
+
+    def __init__(self, uuid):
+        """Initialize the exception with the upload uuid."""
+        super().__init__(
+            detail={
+                "errors": [
+                    {
+                        "code": "BLOB_UPLOAD_UNKNOWN",
+                        "message": "blob upload unknown to registry",
+                        "detail": {"uuid": uuid},
+                    }
+                ]
+            }
+        )
+
+
 class ManifestNotFound(NotFound):
     """Exception to render a 404 with the code 'MANIFEST_UNKNOWN'"""
 
@@ -144,6 +164,19 @@ class ManifestSignatureInvalid(ParseError):
         )
 
 
+class ContainerBuildError(PulpException):
+    """Exception to signal that building or pushing an OCI image failed."""
+
+    error_code = "CON0001"
+
+    def __init__(self, message):
+        """Initialize the exception with the decoded stderr of the failed podman command."""
+        self.message = message
+
+    def __str__(self):
+        return self.message
+
+
 class InvalidRequest(ParseError):
     """An exception to render an HTTP 400 response."""
 

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/global_access_conditions.py

@@ -28,9 +28,10 @@ def has_namespace_obj_perms(request, view, action, permission):
     if type(obj) is models.ContainerDistribution:
         namespace = obj.namespace
         return request.user.has_perm(permission, namespace)
-    elif type(obj) is models.ContainerPushRepository:
+    elif type(obj) is models.ContainerPushRepository or type(obj) is models.ContainerRepository:
         for dist in obj.distributions.all():
-            if request.user.has_perm(permission, dist.cast().namespace):
+            namespace = dist.cast().namespace
+            if namespace and request.user.has_perm(permission, namespace):
                 return True
     elif type(obj) is models.ContainerPullThroughDistribution:
         namespace = obj.namespace

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/json_schemas.py

@@ -124,6 +124,7 @@ DOCKER_MANIFEST_LIST_V2_SCHEMA = {
                         "enum": [
                             MEDIA_TYPE.MANIFEST_V2,
                             MEDIA_TYPE.MANIFEST_V1,
+                            MEDIA_TYPE.MANIFEST_OCI,
                         ],
                     },
                     "size": {"type": "number"},

pulp_container-2.29.0/pulp_container/app/migrations/0050_alter_containernamespace_options.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.13 on 2026-06-03 19:16
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('container', '0049_manifestsignature_fingerprint'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='containernamespace',
+            options={'permissions': [('namespace_add_containerdistribution', 'Add any distribution to a namespace'), ('namespace_delete_containerdistribution', 'Delete any distribution from a namespace'), ('namespace_view_containerdistribution', 'View any distribution in a namespace'), ('namespace_pull_containerdistribution', 'Pull from any distribution in a namespace'), ('namespace_push_containerdistribution', 'Push to any distribution in a namespace'), ('namespace_change_containerdistribution', 'Change any distribution in a namespace'), ('namespace_view_containerpushrepository', 'View any push repository in a namespace'), ('namespace_view_containerrepository', 'View any repository in a namespace'), ('namespace_modify_content_containerpushrepository', 'Modify content in any push repository in a namespace'), ('namespace_modify_content_containerrepository', 'Modify content in any repository in a namespace'), ('namespace_change_containerpushrepository', 'Update any existing push repository in a namespace'), ('namespace_change_containerrepository', 'Change any repository in a namespace'), ('manage_roles_containernamespace', 'Can manage role assignments on container namespace')]},
+        ),
+    ]

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/models.py

@@ -2,7 +2,6 @@ import json
 import os
 import re
 import tempfile
-import time
 from gettext import gettext as _
 from logging import getLogger
 
@@ -458,6 +457,7 @@ class ContainerNamespace(BaseModel, AutoAddObjPermsMixin):
             ("namespace_push_containerdistribution", "Push to any distribution in a namespace"),
             ("namespace_change_containerdistribution", "Change any distribution in a namespace"),
             ("namespace_view_containerpushrepository", "View any push repository in a namespace"),
+            ("namespace_view_containerrepository", "View any repository in a namespace"),
             (
                 "namespace_modify_content_containerpushrepository",
                 "Modify content in any push repository in a namespace",
@@ -470,6 +470,7 @@ class ContainerNamespace(BaseModel, AutoAddObjPermsMixin):
                 "namespace_change_containerpushrepository",
                 "Update any existing push repository in a namespace",
             ),
+            ("namespace_change_containerrepository", "Change any repository in a namespace"),
             (
                 "manage_roles_containernamespace",
                 "Can manage role assignments on container namespace",
@@ -947,8 +948,7 @@ INCOMPLETE_EXT = ".part"
 
 def generate_filename(instance, filename):
     """Method for generating upload file name"""
-    filename = os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
-    return time.strftime(filename)
+    return os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
 
 
 class Upload(CoreUpload):

{pulp_container-2.28.0 → pulp_container-2.29.0}/pulp_container/app/registry_api.py

@@ -45,7 +45,13 @@ from rest_framework.viewsets import ViewSet
 from pulpcore.plugin import pulp_hashlib
 from pulpcore.plugin.exceptions import TimeoutException
 from pulpcore.plugin.files import PulpTemporaryUploadedFile
-from pulpcore.plugin.models import Artifact, ContentArtifact, RemoteArtifact, UploadChunk
+from pulpcore.plugin.models import (
+    Artifact,
+    ContentArtifact,
+    RemoteArtifact,
+    Repository,
+    UploadChunk,
+)
 from pulpcore.plugin.tasking import dispatch
 from pulpcore.plugin.util import get_domain, get_objects_for_user, get_url
 
@@ -60,6 +66,7 @@ from pulp_container.app.exceptions import (
     BadGateway,
     BlobInvalid,
     BlobNotFound,
+    BlobUploadUnknown,
     GatewayTimeout,
     InvalidRequest,
     ManifestInvalid,
@@ -73,7 +80,7 @@ from pulp_container.app.redirects import (
     FileStorageRedirects,
     S3StorageRedirects,
 )
-from pulp_container.app.tasks import aadd_and_remove, download_image_data
+from pulp_container.app.tasks import aadd_and_remove, download_image_data, recursive_remove_content
 from pulp_container.app.token_verification import (
     RegistryAuthentication,
     RegistryPermission,
@@ -88,6 +95,7 @@ from pulp_container.app.utils import (
     get_accepted_media_types,
     get_full_path,
     has_task_completed,
+    is_media_type_accepted,
     validate_manifest,
 )
 from pulp_container.constants import (
@@ -159,11 +167,11 @@ class ManifestResponse(Response):
         manifest_media_type = manifest.media_type
         if request:
             accepted_media_types = get_accepted_media_types(request.headers)
-            if (
-                manifest_media_type not in accepted_media_types
-                and manifest_media_type != MEDIA_TYPE.MANIFEST_V1
+            if accepted_media_types and not is_media_type_accepted(
+                accepted_media_types, manifest_media_type
             ):
-                raise ManifestNotFound(reference=tag.name)
+                if manifest_media_type != MEDIA_TYPE.MANIFEST_V1:
+                    raise ManifestNotFound(reference=tag.name)
 
         # Schema v1 manifests are always returned with the signed content type
         if manifest_media_type == MEDIA_TYPE.MANIFEST_V1:
@@ -279,7 +287,7 @@ class ContainerRegistryApiMixin:
         This allows deployments to use custom authentication backends (e.g. remote
         header-based auth) alongside standard Basic auth for container registry operations.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [RegistryAuthentication, *api_settings.DEFAULT_AUTHENTICATION_CLASSES]
         return [TokenAuthentication]
 
@@ -288,7 +296,7 @@ class ContainerRegistryApiMixin:
         """
         List of permission classes to check for this view.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [RegistryPermission]
         return [TokenPermission]
 
@@ -436,11 +444,9 @@ class ContainerRegistryApiMixin:
             repository = distribution.repository
             if repository:
                 repository = repository.cast()
-                if not repository.PUSH_ENABLED:
-                    raise RepositoryInvalid(name=path, message="Repository is read-only.")
             elif create:
                 with transaction.atomic():
-                    repository = serializers.ContainerPushRepositorySerializer.get_or_create(
+                    repository = serializers.ContainerRepositorySerializer.get_or_create(
                         {"name": path, "pulp_domain": domain}
                     )
                     distribution.repository = repository
@@ -451,11 +457,22 @@ class ContainerRegistryApiMixin:
 
     def create_dr(self, path, request):
         domain = get_domain()
+        repository_types = [
+            models.ContainerRepository.get_pulp_type(),
+            models.ContainerPushRepository.get_pulp_type(),
+        ]
         with transaction.atomic():
             try:
-                repository = serializers.ContainerPushRepositorySerializer.get_or_create(
-                    {"name": path, "pulp_domain": domain}
-                )
+                # Handle new default of ContainerRepository and fallback old ContainerPushRepository
+                repository = Repository.objects.filter(name=path, pulp_domain=domain).first()
+                if repository:
+                    if repository.pulp_type not in repository_types:
+                        raise RepositoryInvalid(name=path, message="Repository is read-only.")
+                    repository = repository.cast()
+                else:
+                    repository = serializers.ContainerRepositorySerializer.get_or_create(
+                        {"name": path, "pulp_domain": domain}
+                    )
                 distribution = serializers.ContainerDistributionSerializer.get_or_create(
                     {"base_path": path, "name": path, "pulp_domain": domain},
                     {"repository": get_url(repository)},
@@ -464,9 +481,10 @@ class ContainerRegistryApiMixin:
                 raise RepositoryInvalid(name=path, message="Repository is read-only.")
 
             if distribution.repository:
-                dist_repository = distribution.repository.cast()
-                if not dist_repository.PUSH_ENABLED or repository != dist_repository:
-                    raise RepositoryInvalid(name=path, message="Repository is read-only.")
+                if repository.pk != distribution.repository.pk:
+                    raise RepositoryInvalid(
+                        name=path, message="Repository is not available for push."
+                    )
             else:
                 distribution.repository = repository
                 distribution.save()
@@ -517,7 +535,7 @@ class VersionView(ContainerRegistryApiMixin, APIView):
         """
         List of permission classes to check for this view.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [IsAuthenticated]
         return [TokenPermission]
 
@@ -609,7 +627,7 @@ class CatalogView(ContainerRegistryApiMixin, ListAPIView):
         distribution_permission = "container.pull_containerdistribution"
         namespace_permission = "container.namespace_pull_containerdistribution"
 
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return queryset
 
         public_repositories = queryset.filter(private=False)
@@ -1014,6 +1032,30 @@ class BlobUploads(ContainerRegistryApiMixin, ViewSet):
 
         return UploadResponse(upload=upload, path=path, request=request)
 
+    def get(self, request, path, pk=None):
+        """
+        Retrieve the status of an upload.
+        """
+        _, repository = self.get_dr_push(request, path)
+        upload = get_object_or_404(models.Upload, repository=repository, pk=pk)
+        return UploadResponse(upload=upload, path=path, request=request, status=204)
+
+    def head(self, request, path, pk=None):
+        """Respond to HEAD requests about blob uploads."""
+        return self.get(request, path, pk=pk)
+
+    def destroy(self, request, path, pk=None):
+        """
+        Cancel an outstanding blob upload.
+        """
+        _, repository = self.get_dr_push(request, path)
+        try:
+            upload = models.Upload.objects.get(repository=repository, pk=pk)
+        except models.Upload.DoesNotExist:
+            raise BlobUploadUnknown(uuid=pk)
+        upload.delete()
+        return Response(status=204)
+
     def put(self, request, path, pk=None):
         """
         Create a blob from uploaded chunks.
@@ -1185,6 +1227,34 @@ class Blobs(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
                 raise BlobNotFound(digest=pk)
         return blob_url
 
+    def destroy(self, request, path, pk=None):
+        """
+        Delete a blob identified by digest.
+        """
+        if not pk.startswith("sha256:"):
+            raise InvalidRequest(message="A blob can only be deleted by digest.")
+
+        _, repository = self.get_dr_push(request, path)
+        latest_version = repository.latest_version()
+
+        if blob := models.Blob.objects.filter(digest=pk, pk__in=latest_version.content).first():
+            dispatch(
+                aadd_and_remove,
+                exclusive_resources=[repository],
+                kwargs={
+                    "repository_pk": str(repository.pk),
+                    "add_content_units": [],
+                    "remove_content_units": [str(blob.pk)],
+                },
+                immediate=True,
+                deferred=True,
+            )
+        elif pending_blob := repository.pending_blobs.filter(digest=pk).first():
+            repository.pending_blobs.remove(pending_blob)
+        else:
+            raise BlobNotFound(digest=pk)
+        return Response(status=202)
+
 
 class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
     """
@@ -1329,6 +1399,36 @@ class Manifests(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         # Fallthrough catchall, no manifest or tag found
         raise ManifestNotFound(reference=pk)
 
+    def destroy(self, request, path, pk=None):
+        """
+        Delete a manifest identified by digest.
+        """
+        if not pk.startswith("sha256:"):
+            raise InvalidRequest(message="A manifest can only be deleted by digest.")
+
+        _, repository = self.get_dr_push(request, path)
+        latest_version = repository.latest_version()
+
+        manifest = models.Manifest.objects.filter(digest=pk, pk__in=latest_version.content).first()
+        if not manifest:
+            manifest = repository.pending_manifests.filter(digest=pk).first()
+            if not manifest:
+                raise ManifestNotFound(reference=pk)
+            repository.pending_manifests.remove(manifest)
+
+        tags = models.Tag.objects.filter(tagged_manifest=manifest, pk__in=latest_version.content)
+        content_units = [str(manifest.pk)] + [str(tag.pk) for tag in tags]
+
+        dispatch(
+            recursive_remove_content,
+            exclusive_resources=[repository],
+            kwargs={
+                "repository_pk": str(repository.pk),
+                "content_units": content_units,
+            },
+        )
+        return Response(status=202)
+
     def get_content_units_to_add(self, manifest, tag=None):
         add_content_units = [str(manifest.pk)]
         if tag: