[Bug] Docker pull/push to the same registry changes image digest

Description

Docker pull/push to the same registry changes image digest pushed by another tool. looks like docker reformats manifest the way it like.
The bug breaks docker trust sign process as digest is already used in other systems.
Combined with session nature docker login makes it hurts any CI process badly, as only docker push can be used for consistent pushing\signing

Describe the results you expected:
My understanding is that docker push\pull to the same repo have to leave docekr digest the same.

Steps to reproduce the issue:

docker run -d -p 5000:5000 --restart=always --name registry registry:2

curl -L https://github.com/GoogleContainerTools/jib/releases/download/v0.8.0-cli/jib-jre-0.8.0.zip -o jib.zip && unzip jib.zip

./build.yaml

apiVersion: jib/v1alpha1
kind: BuildFile

from:
  image: scratch

layers:
  entries:
    - name: scripts
      files:
        - properties:
            filePermissions: 755
          src: build.yaml
          dest: /build.yaml

jib-0.8.0/bin/jib build -c `pwd` -b build.yaml -t registry://localhost:5000/test --allow-insecure-registries --image-metadata-out=meta.json

$ cat meta.json 
{"image":"localhost:5000/test","imageId":"sha256:8a3b3ebf46ea72d4c4859e18147485204d7144e3e82dd5b6416b167af9f25a86","imageDigest":"sha256:40b9754190108932d81362bc2b845fb6176b20d5ac99312abf2a1f149309e39e","tags":["latest"]}

$ docker --version
Docker version 20.10.12, build e91ed57

$ docker pull localhost:5000/test
Using default tag: latest
latest: Pulling from test
cf51c3f692e5: Pull complete 
Digest: sha256:40b9754190108932d81362bc2b845fb6176b20d5ac99312abf2a1f149309e39e
Status: Downloaded newer image for localhost:5000/test:latest
localhost:5000/test:latest

$ docker push localhost:5000/test
Using default tag: latest
The push refers to repository [localhost:5000/test]
77ef8d169f22: Layer already exists 
latest: digest: sha256:340a8be0c6d5d9ec54e49f484a88a3a92290ad8ade703da654265cafa3c8e315 size: 52

The docker imageDigest is changed
from: sha256:40b9754190108932d81362bc2b845fb6176b20d5ac99312abf2a1f149309e39e
to: sha256:340a8be0c6d5d9ec54e49f484a88a3a92290ad8ade703da654265cafa3c8e315

Reproduce the issue using the provided registry:2 setup, Jib build, and docker pull/push commands, then compare the reported image digests. Trace the Docker CLI pull and push entry points involved in manifest handling; done means pushing the pulled image to the same repository preserves the original digest and the relevant regression coverage passes.