Don't shortcircuit content validation for empty response

Signed-off-by: Judah Rand <17158624+judahrand@users.noreply.github.com>

Author: judahrand

oras/provider.py

@@ -539,12 +539,6 @@ def download_blob(
                 )
 
             os.replace(staged, outfile)
-
-        # Allow an empty layer to fail and return /dev/null
-        except Exception as e:
-            if digest == oras.defaults.blank_hash:
-                return os.devnull
-            raise e
         finally:
             try:
                 os.remove(staged)

oras/tests/test_provider.py

@@ -163,6 +163,104 @@ def test_pull_validates_registered_digest(monkeypatch, tmp_path, algorithm):
     assert outfile.read_bytes() == content
 
 
+def test_download_blob_validates_empty_blob(monkeypatch, tmp_path):
+    client = oras.provider.Registry(insecure=True)
+    response = requests.Response()
+    response.status_code = 200
+    response._content = b""
+    response._content_consumed = True
+    monkeypatch.setattr(client, "get_blob", lambda *args, **kwargs: response)
+    staged = tmp_path / "staged"
+    staged.touch()
+    monkeypatch.setattr(oras.utils, "get_tmpfile", lambda: str(staged))
+    outfile = tmp_path / "empty"
+
+    result = client.download_blob(
+        "registry.example/repository:tag",
+        oras.defaults.blank_hash,
+        str(outfile),
+        size=0,
+    )
+
+    assert result == str(outfile)
+    assert outfile.read_bytes() == b""
+    assert not staged.exists()
+
+
+@pytest.mark.parametrize("status_code", [401, 404])
+def test_download_empty_blob_propagates_http_error(monkeypatch, tmp_path, status_code):
+    client = oras.provider.Registry(insecure=True)
+    response = requests.Response()
+    response.status_code = status_code
+    response.url = "https://registry.example/v2/repository/blobs/empty"
+    response._content = b""
+    response._content_consumed = True
+    monkeypatch.setattr(client, "get_blob", lambda *args, **kwargs: response)
+    staged = tmp_path / "staged"
+    staged.touch()
+    monkeypatch.setattr(oras.utils, "get_tmpfile", lambda: str(staged))
+    outfile = tmp_path / "empty"
+    outfile.write_bytes(b"existing content")
+
+    with pytest.raises(requests.HTTPError):
+        client.download_blob(
+            "registry.example/repository:tag",
+            oras.defaults.blank_hash,
+            str(outfile),
+            size=0,
+        )
+
+    assert outfile.read_bytes() == b"existing content"
+    assert not staged.exists()
+
+
+def test_download_empty_blob_propagates_transport_error(monkeypatch, tmp_path):
+    client = oras.provider.Registry(insecure=True)
+
+    def get_blob(*args, **kwargs):
+        raise requests.ConnectionError("download failed")
+
+    monkeypatch.setattr(client, "get_blob", get_blob)
+    staged = tmp_path / "staged"
+    staged.touch()
+    monkeypatch.setattr(oras.utils, "get_tmpfile", lambda: str(staged))
+    outfile = tmp_path / "empty"
+
+    with pytest.raises(requests.ConnectionError, match="download failed"):
+        client.download_blob(
+            "registry.example/repository:tag",
+            oras.defaults.blank_hash,
+            str(outfile),
+            size=0,
+        )
+
+    assert not outfile.exists()
+    assert not staged.exists()
+
+
+def test_download_empty_blob_rejects_nonempty_content(monkeypatch, tmp_path):
+    client = oras.provider.Registry(insecure=True)
+    response = requests.Response()
+    response.status_code = 200
+    response._content = b"not empty"
+    response._content_consumed = True
+    monkeypatch.setattr(client, "get_blob", lambda *args, **kwargs: response)
+    staged = tmp_path / "staged"
+    staged.touch()
+    monkeypatch.setattr(oras.utils, "get_tmpfile", lambda: str(staged))
+    outfile = tmp_path / "empty"
+
+    with pytest.raises(ValueError, match="Downloaded blob digest mismatch"):
+        client.download_blob(
+            "registry.example/repository:tag",
+            oras.defaults.blank_hash,
+            str(outfile),
+        )
+
+    assert not outfile.exists()
+    assert not staged.exists()
+
+
 def test_pull_rejects_digest_mismatch_without_replacing_file(monkeypatch, tmp_path):
     expected_content = b"expected content"
     downloaded_content = b"corrupt! content"