Function drain_splitdirfdstream_verified 

pub fn drain_splitdirfdstream_verified<ObjectID: FsVerityHashValue>(
    repo: Arc<Repository<ObjectID>>,
    pipe_read: OwnedFd,
    dir_fds: Vec<OwnedFd>,
    diff_id: &OciDigest,
    zerocopy: bool,
    ctx: ImportContext,
) -> Result<(ObjectID, ImportStats, ImportContext), VerifiedDrainError>

Like drain_splitdirfdstream, but additionally verifies that the reconstructed (uncompressed tar) content hashes to diff_id, and only commits the layer splitstream to the repository if it matches.

On mismatch the partially-written stream is discarded and VerifiedDrainError::DiffIdMismatch is returned.

Integrity model

The diff_id is the sha256 of the uncompressed tar bytes — the same byte stream that cat on the splitstream produces. As chunks are processed, every logical byte is fed into a running SHA-256 hasher:

• Inline chunks: hash the raw bytes verbatim.
• External chunks: hash the full object file (all length bytes) via positioned reads, then pass the same fd to process_file_content. Using positioned reads (read_at) means the fd cursor is not consumed, so process_file_content can read the file independently.

Note on partial objects

If verification fails, large external objects that were already written to the objects/ directory of the destination repo are left in place. They are orphaned (not referenced by any committed splitstream) and will be reclaimed by the next GC run. We do NOT attempt to clean them up here because doing so correctly (without racing with concurrent imports) would be complex and the GC already handles this case.