diff --git a/.golangci.yml b/.golangci.yml
index 32d2449c2c..981ada9bb2 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -230,10 +230,6 @@ linters:
         # makes this test flaky.
         path: private/buf/bufstudioagent/bufstudioagent_test.go
         text: missing the call to method parallel
-      - linters:
-          - gochecknoinits
-        # we actually want to use this init to create a protovalidate.Validator
-        path: private/bufpkg/bufcas/proto.go
       - linters:
           - gochecknoinits
         # we actually want to use init here
diff --git a/private/bufpkg/bufmodule/bufmoduleapi/convert.go b/private/bufpkg/bufmodule/bufmoduleapi/convert.go
index 624297f6c6..7d77b136c1 100644
--- a/private/bufpkg/bufmodule/bufmoduleapi/convert.go
+++ b/private/bufpkg/bufmodule/bufmoduleapi/convert.go
@@ -22,9 +22,9 @@ import (
 	modulev1 "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/module/v1"
 	modulev1beta1 "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/module/v1beta1"
 	"buf.build/go/standard/xslices"
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufmodule"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/storage"
 	"github.com/bufbuild/buf/private/pkg/uuidutil"
 	"github.com/google/uuid"
@@ -71,11 +71,11 @@ func V1ProtoToDigest(protoDigest *modulev1.Digest) (bufmodule.Digest, error) {
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.NewDigest(protoDigest.Value)
+	casDigest, err := cas.NewDigest(protoDigest.Value)
 	if err != nil {
 		return nil, err
 	}
-	return bufmodule.NewDigest(digestType, bufcasDigest)
+	return bufmodule.NewDigest(digestType, casDigest)
 }
 
 // DigestToV1Beta1Proto converts the given Digest to a proto Digest.
@@ -99,11 +99,11 @@ func V1Beta1ProtoToDigest(protoDigest *modulev1beta1.Digest) (bufmodule.Digest,
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.NewDigest(protoDigest.Value)
+	casDigest, err := cas.NewDigest(protoDigest.Value)
 	if err != nil {
 		return nil, err
 	}
-	return bufmodule.NewDigest(digestType, bufcasDigest)
+	return bufmodule.NewDigest(digestType, casDigest)
 }
 
 // *** PRIVATE ***
diff --git a/private/bufpkg/bufmodule/commit_key.go b/private/bufpkg/bufmodule/commit_key.go
index 4c0da286f0..90d742108d 100644
--- a/private/bufpkg/bufmodule/commit_key.go
+++ b/private/bufpkg/bufmodule/commit_key.go
@@ -42,7 +42,7 @@ type CommitKey interface {
 	CommitID() uuid.UUID
 	// DigestType returns the DigestType of the Commit.
 	//
-	// Note this is *not* a bufcas.Digest - this is a Digest. bufcas.Digests are a lower-level
+	// Note this is *not* a cas.Digest - this is a Digest. cas.Digests are a lower-level
 	// type that just deal in terms of files and content. A ModuleDigest is a specific algorithm
 	// applied to a set of files and dependencies.
 	DigestType() DigestType
diff --git a/private/bufpkg/bufmodule/digest.go b/private/bufpkg/bufmodule/digest.go
index af5d38e684..0e1ef5ae97 100644
--- a/private/bufpkg/bufmodule/digest.go
+++ b/private/bufpkg/bufmodule/digest.go
@@ -25,8 +25,8 @@ import (
 	"strings"
 
 	"buf.build/go/standard/xslices"
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/storage"
 	"github.com/bufbuild/buf/private/pkg/syserror"
 )
@@ -109,17 +109,17 @@ type Digest interface {
 }
 
 // NewDigest creates a new Digest.
-func NewDigest(digestType DigestType, bufcasDigest bufcas.Digest) (Digest, error) {
+func NewDigest(digestType DigestType, casDigest cas.Digest) (Digest, error) {
 	switch digestType {
 	case DigestTypeB4, DigestTypeB5:
-		if bufcasDigest.Type() != bufcas.DigestTypeShake256 {
+		if casDigest.Type() != cas.DigestTypeShake256 {
 			return nil, syserror.Newf(
 				"trying to create a %v Digest for a cas Digest of type %v",
 				digestType,
-				bufcasDigest.Type(),
+				casDigest.Type(),
 			)
 		}
-		return newDigest(digestType, bufcasDigest), nil
+		return newDigest(digestType, casDigest), nil
 	default:
 		// This is a system error.
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
@@ -165,11 +165,11 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	switch digestType {
 	case DigestTypeB4, DigestTypeB5:
-		bufcasDigest, err := bufcas.NewDigest(value)
+		casDigest, err := cas.NewDigest(value)
 		if err != nil {
 			return nil, err
 		}
-		return NewDigest(digestType, bufcasDigest)
+		return NewDigest(digestType, casDigest)
 	default:
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
 	}
@@ -196,19 +196,19 @@ func DigestEqual(a Digest, b Digest) bool {
 /// *** PRIVATE ***
 
 type digest struct {
-	digestType   DigestType
-	bufcasDigest bufcas.Digest
+	digestType DigestType
+	casDigest  cas.Digest
 	// Cache as we call String pretty often.
 	// We could do this lazily but not worth it.
 	stringValue string
 }
 
 // validation should occur outside of this function.
-func newDigest(digestType DigestType, bufcasDigest bufcas.Digest) *digest {
+func newDigest(digestType DigestType, casDigest cas.Digest) *digest {
 	return &digest{
-		digestType:   digestType,
-		bufcasDigest: bufcasDigest,
-		stringValue:  digestType.String() + ":" + hex.EncodeToString(bufcasDigest.Value()),
+		digestType:  digestType,
+		casDigest:   casDigest,
+		stringValue: digestType.String() + ":" + hex.EncodeToString(casDigest.Value()),
 	}
 }
 
@@ -217,7 +217,7 @@ func (d *digest) Type() DigestType {
 }
 
 func (d *digest) Value() []byte {
-	return d.bufcasDigest.Value()
+	return d.casDigest.Value()
 }
 
 func (d *digest) String() string {
@@ -232,7 +232,7 @@ func getB4Digest(
 	v1BufYAMLObjectData ObjectData,
 	v1BufLockObjectData ObjectData,
 ) (Digest, error) {
-	var fileNodes []bufcas.FileNode
+	var fileNodes []cas.FileNode
 	if err := storage.WalkReadObjects(
 		ctx,
 		// This is extreme defensive programming. We've gone out of our way to make sure
@@ -240,11 +240,11 @@ func getB4Digest(
 		storage.FilterReadBucket(bucketWithStorageMatcherApplied, getStorageMatcher(ctx, bucketWithStorageMatcherApplied)),
 		"",
 		func(readObject storage.ReadObject) error {
-			digest, err := bufcas.NewDigestForContent(readObject)
+			digest, err := cas.NewDigestForContent(readObject)
 			if err != nil {
 				return err
 			}
-			fileNode, err := bufcas.NewFileNode(readObject.Path(), digest)
+			fileNode, err := cas.NewFileNode(readObject.Path(), digest)
 			if err != nil {
 				return err
 			}
@@ -262,25 +262,25 @@ func getB4Digest(
 			// We may not have object data for one of these files, this is valid.
 			continue
 		}
-		digest, err := bufcas.NewDigestForContent(bytes.NewReader(objectData.Data()))
+		digest, err := cas.NewDigestForContent(bytes.NewReader(objectData.Data()))
 		if err != nil {
 			return nil, err
 		}
-		fileNode, err := bufcas.NewFileNode(objectData.Name(), digest)
+		fileNode, err := cas.NewFileNode(objectData.Name(), digest)
 		if err != nil {
 			return nil, err
 		}
 		fileNodes = append(fileNodes, fileNode)
 	}
-	manifest, err := bufcas.NewManifest(fileNodes)
+	manifest, err := cas.NewManifest(fileNodes)
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.ManifestToDigest(manifest)
+	casDigest, err := cas.ManifestToDigest(manifest)
 	if err != nil {
 		return nil, err
 	}
-	return NewDigest(DigestTypeB4, bufcasDigest)
+	return NewDigest(DigestTypeB4, casDigest)
 }
 
 func getB5DigestForBucketAndModuleDeps(
@@ -321,8 +321,8 @@ func getB5DigestForBucketAndDepModuleKeys(
 //
 // A Digest is a composite digest of all Module Files, and all Module dependencies.
 //
-// All Files are added to a bufcas.Manifest, which is then turned into a bufcas.Digest.
-// The file bufcas.Digest, along with all Digests of the dependencies, are then sorted,
+// All Files are added to a cas.Manifest, which is then turned into a cas.Digest.
+// The file cas.Digest, along with all Digests of the dependencies, are then sorted,
 // and then digested themselves as content.
 //
 // Note that the name of the Module and any of its dependencies has no effect on the Digest.
@@ -331,13 +331,13 @@ func getB5DigestForBucketAndDepDigests(
 	bucketWithStorageMatcherApplied storage.ReadBucket,
 	depDigests []Digest,
 ) (Digest, error) {
-	// First, compute the shake256 bufcas.Digest of the files. This will include a
+	// First, compute the shake256 cas.Digest of the files. This will include a
 	// sorted list of file names and their digests.
 	filesDigest, err := getFilesDigestForB5Digest(ctx, bucketWithStorageMatcherApplied)
 	if err != nil {
 		return nil, err
 	}
-	if filesDigest.Type() != bufcas.DigestTypeShake256 {
+	if filesDigest.Type() != cas.DigestTypeShake256 {
 		return nil, syserror.Newf("trying to compute b5 Digest with files digest of type %v", filesDigest.Type())
 	}
 	// Next, we get the b5 digests of all the dependencies and sort their string representations.
@@ -359,7 +359,7 @@ func getB5DigestForBucketAndDepDigests(
 	// Now, place the file digest first, then the sorted dependency digests afterwards.
 	digestStrings := append([]string{filesDigest.String()}, depDigestStrings...)
 	// Join these strings together with newlines, and make a new shake256 digest.
-	digestOfDigests, err := bufcas.NewDigestForContent(strings.NewReader(strings.Join(digestStrings, "\n")))
+	digestOfDigests, err := cas.NewDigestForContent(strings.NewReader(strings.Join(digestStrings, "\n")))
 	if err != nil {
 		return nil, err
 	}
@@ -371,8 +371,8 @@ func getB5DigestForBucketAndDepDigests(
 func getFilesDigestForB5Digest(
 	ctx context.Context,
 	bucketWithStorageMatcherApplied storage.ReadBucket,
-) (bufcas.Digest, error) {
-	var fileNodes []bufcas.FileNode
+) (cas.Digest, error) {
+	var fileNodes []cas.FileNode
 	if err := storage.WalkReadObjects(
 		ctx,
 		// This is extreme defensive programming. We've gone out of our way to make sure
@@ -380,11 +380,11 @@ func getFilesDigestForB5Digest(
 		storage.FilterReadBucket(bucketWithStorageMatcherApplied, getStorageMatcher(ctx, bucketWithStorageMatcherApplied)),
 		"",
 		func(readObject storage.ReadObject) error {
-			digest, err := bufcas.NewDigestForContent(readObject)
+			digest, err := cas.NewDigestForContent(readObject)
 			if err != nil {
 				return err
 			}
-			fileNode, err := bufcas.NewFileNode(readObject.Path(), digest)
+			fileNode, err := cas.NewFileNode(readObject.Path(), digest)
 			if err != nil {
 				return err
 			}
@@ -394,9 +394,9 @@ func getFilesDigestForB5Digest(
 	); err != nil {
 		return nil, err
 	}
-	manifest, err := bufcas.NewManifest(fileNodes)
+	manifest, err := cas.NewManifest(fileNodes)
 	if err != nil {
 		return nil, err
 	}
-	return bufcas.ManifestToDigest(manifest)
+	return cas.ManifestToDigest(manifest)
 }
diff --git a/private/bufpkg/bufmodule/module.go b/private/bufpkg/bufmodule/module.go
index f269c42b7b..065f3eafb2 100644
--- a/private/bufpkg/bufmodule/module.go
+++ b/private/bufpkg/bufmodule/module.go
@@ -109,7 +109,7 @@ type Module interface {
 
 	// Digest returns the Module digest for the given DigestType.
 	//
-	// Note this is *not* a bufcas.Digest - this is a Digest. bufcas.Digests are a lower-level
+	// Note this is *not* a cas.Digest - this is a Digest. cas.Digests are a lower-level
 	// type that just deal in terms of files and content. A Digest is a specific algorithm
 	// applied to a set of files and dependencies.
 	Digest(DigestType) (Digest, error)
diff --git a/private/bufpkg/bufmodule/module_key.go b/private/bufpkg/bufmodule/module_key.go
index 8c8e5b2888..e55d9aeb25 100644
--- a/private/bufpkg/bufmodule/module_key.go
+++ b/private/bufpkg/bufmodule/module_key.go
@@ -48,7 +48,7 @@ type ModuleKey interface {
 	CommitID() uuid.UUID
 	// Digest returns the Module digest.
 	//
-	// Note this is *not* a bufcas.Digest - this is a Digest. bufcas.Digests are a lower-level
+	// Note this is *not* a cas.Digest - this is a Digest. cas.Digests are a lower-level
 	// type that just deal in terms of files and content. A ModuleDigest is a specific algorithm
 	// applied to a set of files and dependencies.
 	Digest() (Digest, error)
diff --git a/private/bufpkg/bufplugin/bufpluginapi/convert.go b/private/bufpkg/bufplugin/bufpluginapi/convert.go
index 9dbf173674..3694980f14 100644
--- a/private/bufpkg/bufplugin/bufpluginapi/convert.go
+++ b/private/bufpkg/bufplugin/bufpluginapi/convert.go
@@ -18,8 +18,8 @@ import (
 	"fmt"
 
 	pluginv1beta1 "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/plugin/v1beta1"
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufplugin"
+	"github.com/bufbuild/buf/private/pkg/cas"
 )
 
 var (
@@ -37,11 +37,11 @@ func V1Beta1ProtoToDigest(protoDigest *pluginv1beta1.Digest) (bufplugin.Digest,
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.NewDigest(protoDigest.Value)
+	casDigest, err := cas.NewDigest(protoDigest.Value)
 	if err != nil {
 		return nil, err
 	}
-	return bufplugin.NewDigest(digestType, bufcasDigest)
+	return bufplugin.NewDigest(digestType, casDigest)
 }
 
 // *** PRIVATE ***
diff --git a/private/bufpkg/bufplugin/digest.go b/private/bufpkg/bufplugin/digest.go
index 424c80b1a7..029a6ebe16 100644
--- a/private/bufpkg/bufplugin/digest.go
+++ b/private/bufpkg/bufplugin/digest.go
@@ -22,8 +22,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/syserror"
 )
 
@@ -96,17 +96,17 @@ type Digest interface {
 }
 
 // NewDigest creates a new Digest.
-func NewDigest(digestType DigestType, bufcasDigest bufcas.Digest) (Digest, error) {
+func NewDigest(digestType DigestType, casDigest cas.Digest) (Digest, error) {
 	switch digestType {
 	case DigestTypeP1:
-		if bufcasDigest.Type() != bufcas.DigestTypeShake256 {
+		if casDigest.Type() != cas.DigestTypeShake256 {
 			return nil, syserror.Newf(
 				"trying to create a %v Digest for a cas Digest of type %v",
 				digestType,
-				bufcasDigest.Type(),
+				casDigest.Type(),
 			)
 		}
-		return newDigest(digestType, bufcasDigest), nil
+		return newDigest(digestType, casDigest), nil
 	default:
 		// This is a system error.
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
@@ -152,11 +152,11 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	switch digestType {
 	case DigestTypeP1:
-		bufcasDigest, err := bufcas.NewDigest(value)
+		casDigest, err := cas.NewDigest(value)
 		if err != nil {
 			return nil, err
 		}
-		return NewDigest(digestType, bufcasDigest)
+		return NewDigest(digestType, casDigest)
 	default:
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
 	}
@@ -183,19 +183,19 @@ func DigestEqual(a Digest, b Digest) bool {
 /// *** PRIVATE ***
 
 type digest struct {
-	digestType   DigestType
-	bufcasDigest bufcas.Digest
+	digestType DigestType
+	casDigest  cas.Digest
 	// Cache as we call String pretty often.
 	// We could do this lazily but not worth it.
 	stringValue string
 }
 
 // validation should occur outside of this function.
-func newDigest(digestType DigestType, bufcasDigest bufcas.Digest) *digest {
+func newDigest(digestType DigestType, casDigest cas.Digest) *digest {
 	return &digest{
-		digestType:   digestType,
-		bufcasDigest: bufcasDigest,
-		stringValue:  digestType.String() + ":" + hex.EncodeToString(bufcasDigest.Value()),
+		digestType:  digestType,
+		casDigest:   casDigest,
+		stringValue: digestType.String() + ":" + hex.EncodeToString(casDigest.Value()),
 	}
 }
 
@@ -204,7 +204,7 @@ func (d *digest) Type() DigestType {
 }
 
 func (d *digest) Value() []byte {
-	return d.bufcasDigest.Value()
+	return d.casDigest.Value()
 }
 
 func (d *digest) String() string {
diff --git a/private/bufpkg/bufplugin/plugin.go b/private/bufpkg/bufplugin/plugin.go
index 0a97848d6d..e2d33c6181 100644
--- a/private/bufpkg/bufplugin/plugin.go
+++ b/private/bufpkg/bufplugin/plugin.go
@@ -20,8 +20,8 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/syserror"
 	"github.com/google/uuid"
 )
@@ -75,8 +75,8 @@ type Plugin interface {
 	Description() string
 	// Digest returns the Plugin digest for the given DigestType.
 	//
-	// Note this is *not* a bufcas.Digest - this is a Digest.
-	// bufcas.Digests are a lower-level type that just deal in terms of
+	// Note this is *not* a cas.Digest - this is a Digest.
+	// cas.Digests are a lower-level type that just deal in terms of
 	// files and content. A Digest is a specific algorithm applied to the
 	// content of a Plugin.
 	//
@@ -309,10 +309,10 @@ func newGetDigestFuncForPluginAndDigestType(plugin *plugin, digestType DigestTyp
 		if err != nil {
 			return nil, err
 		}
-		bufcasDigest, err := bufcas.NewDigestForContent(bytes.NewReader(data))
+		casDigest, err := cas.NewDigestForContent(bytes.NewReader(data))
 		if err != nil {
 			return nil, err
 		}
-		return NewDigest(digestType, bufcasDigest)
+		return NewDigest(digestType, casDigest)
 	}
 }
diff --git a/private/bufpkg/bufplugin/plugin_data.go b/private/bufpkg/bufplugin/plugin_data.go
index a86bd8b34b..849ac8317b 100644
--- a/private/bufpkg/bufplugin/plugin_data.go
+++ b/private/bufpkg/bufplugin/plugin_data.go
@@ -19,7 +19,7 @@ import (
 	"context"
 	"sync"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
+	"github.com/bufbuild/buf/private/pkg/cas"
 )
 
 // PluginData presents the raw Plugin data read by PluginKey.
@@ -80,13 +80,13 @@ func newPluginData(
 		if err != nil {
 			return err
 		}
-		bufcasDigest, err := bufcas.NewDigestForContent(
+		casDigest, err := cas.NewDigestForContent(
 			bytes.NewReader(pluginData),
 		)
 		if err != nil {
 			return err
 		}
-		actualDigest, err := NewDigest(DigestTypeP1, bufcasDigest)
+		actualDigest, err := NewDigest(DigestTypeP1, casDigest)
 		if err != nil {
 			return err
 		}
diff --git a/private/bufpkg/bufplugin/plugin_key.go b/private/bufpkg/bufplugin/plugin_key.go
index 0f416b8dff..8512bdf98c 100644
--- a/private/bufpkg/bufplugin/plugin_key.go
+++ b/private/bufpkg/bufplugin/plugin_key.go
@@ -48,8 +48,8 @@ type PluginKey interface {
 	CommitID() uuid.UUID
 	// Digest returns the Plugin digest.
 	//
-	// Note this is *not* a bufcas.Digest - this is a Digest.
-	// bufcas.Digests are a lower-level type that just deal in terms of
+	// Note this is *not* a cas.Digest - this is a Digest.
+	// cas.Digests are a lower-level type that just deal in terms of
 	// files and content. A PluginDigest is a specific algorithm applied to
 	// the Plugin data.
 	Digest() (Digest, error)
diff --git a/private/bufpkg/bufpolicy/bufpolicyapi/convert.go b/private/bufpkg/bufpolicy/bufpolicyapi/convert.go
index a36c822347..5563b8371b 100644
--- a/private/bufpkg/bufpolicy/bufpolicyapi/convert.go
+++ b/private/bufpkg/bufpolicy/bufpolicyapi/convert.go
@@ -20,9 +20,9 @@ import (
 	policyv1beta1 "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/policy/v1beta1"
 	"buf.build/go/bufplugin/option"
 	"buf.build/go/standard/xslices"
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/bufbuild/buf/private/bufpkg/bufpolicy"
+	"github.com/bufbuild/buf/private/pkg/cas"
 )
 
 var (
@@ -40,11 +40,11 @@ func V1Beta1ProtoToDigest(protoDigest *policyv1beta1.Digest) (bufpolicy.Digest,
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.NewDigest(protoDigest.Value)
+	casDigest, err := cas.NewDigest(protoDigest.Value)
 	if err != nil {
 		return nil, err
 	}
-	return bufpolicy.NewDigest(digestType, bufcasDigest)
+	return bufpolicy.NewDigest(digestType, casDigest)
 }
 
 // V1Beta1ProtoToPolicyConfig converts the given proto PolicyConfig to a PolicyConfig.
diff --git a/private/bufpkg/bufpolicy/bufpolicystore/buf_policy_store.go b/private/bufpkg/bufpolicy/bufpolicystore/buf_policy_store.go
index 8fc5010e74..8261d4c4c1 100644
--- a/private/bufpkg/bufpolicy/bufpolicystore/buf_policy_store.go
+++ b/private/bufpkg/bufpolicy/bufpolicystore/buf_policy_store.go
@@ -22,9 +22,9 @@ import (
 	"log/slog"
 
 	policyv1beta1 "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/policy/v1beta1"
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufpolicy"
 	"github.com/bufbuild/buf/private/bufpkg/bufpolicy/bufpolicyapi"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/normalpath"
 	"github.com/bufbuild/buf/private/pkg/protoencoding"
 	"github.com/bufbuild/buf/private/pkg/storage"
@@ -127,7 +127,7 @@ func (p *policyDataStore) getPolicyDataForPolicyKey(
 			return nil, err
 		}
 		// Validate the digest, before parsing the config.
-		bufcasDigest, err := bufcas.NewDigestForContent(bytes.NewReader(data))
+		casDigest, err := cas.NewDigestForContent(bytes.NewReader(data))
 		if err != nil {
 			return nil, err
 		}
@@ -135,7 +135,7 @@ func (p *policyDataStore) getPolicyDataForPolicyKey(
 		if err != nil {
 			return nil, err
 		}
-		actualDigest, err := bufpolicy.NewDigest(expectedDigest.Type(), bufcasDigest)
+		actualDigest, err := bufpolicy.NewDigest(expectedDigest.Type(), casDigest)
 		if err != nil {
 			return nil, err
 		}
diff --git a/private/bufpkg/bufpolicy/digest.go b/private/bufpkg/bufpolicy/digest.go
index 844310ffdb..89e888f57e 100644
--- a/private/bufpkg/bufpolicy/digest.go
+++ b/private/bufpkg/bufpolicy/digest.go
@@ -22,8 +22,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
 	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/bufbuild/buf/private/pkg/syserror"
 )
 
@@ -96,17 +96,17 @@ type Digest interface {
 }
 
 // NewDigest creates a new Digest.
-func NewDigest(digestType DigestType, bufcasDigest bufcas.Digest) (Digest, error) {
+func NewDigest(digestType DigestType, casDigest cas.Digest) (Digest, error) {
 	switch digestType {
 	case DigestTypeO1:
-		if bufcasDigest.Type() != bufcas.DigestTypeShake256 {
+		if casDigest.Type() != cas.DigestTypeShake256 {
 			return nil, syserror.Newf(
 				"trying to create a %v Digest for a cas Digest of type %v",
 				digestType,
-				bufcasDigest.Type(),
+				casDigest.Type(),
 			)
 		}
-		return newDigest(digestType, bufcasDigest), nil
+		return newDigest(digestType, casDigest), nil
 	default:
 		// This is a system error.
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
@@ -152,11 +152,11 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	switch digestType {
 	case DigestTypeO1:
-		bufcasDigest, err := bufcas.NewDigest(value)
+		casDigest, err := cas.NewDigest(value)
 		if err != nil {
 			return nil, err
 		}
-		return NewDigest(digestType, bufcasDigest)
+		return NewDigest(digestType, casDigest)
 	default:
 		return nil, syserror.Newf("unknown DigestType: %v", digestType)
 	}
@@ -183,19 +183,19 @@ func DigestEqual(a Digest, b Digest) bool {
 /// *** PRIVATE ***
 
 type digest struct {
-	digestType   DigestType
-	bufcasDigest bufcas.Digest
+	digestType DigestType
+	casDigest  cas.Digest
 	// Cache as we call String pretty often.
 	// We could do this lazily but not worth it.
 	stringValue string
 }
 
 // validation should occur outside of this function.
-func newDigest(digestType DigestType, bufcasDigest bufcas.Digest) *digest {
+func newDigest(digestType DigestType, casDigest cas.Digest) *digest {
 	return &digest{
-		digestType:   digestType,
-		bufcasDigest: bufcasDigest,
-		stringValue:  digestType.String() + ":" + hex.EncodeToString(bufcasDigest.Value()),
+		digestType:  digestType,
+		casDigest:   casDigest,
+		stringValue: digestType.String() + ":" + hex.EncodeToString(casDigest.Value()),
 	}
 }
 
@@ -204,7 +204,7 @@ func (d *digest) Type() DigestType {
 }
 
 func (d *digest) Value() []byte {
-	return d.bufcasDigest.Value()
+	return d.casDigest.Value()
 }
 
 func (d *digest) String() string {
@@ -219,9 +219,9 @@ func getO1Digest(policyConfig PolicyConfig) (Digest, error) {
 	if err != nil {
 		return nil, err
 	}
-	bufcasDigest, err := bufcas.NewDigestForContent(bytes.NewReader(policyDataJSON))
+	casDigest, err := cas.NewDigestForContent(bytes.NewReader(policyDataJSON))
 	if err != nil {
 		return nil, err
 	}
-	return NewDigest(DigestTypeO1, bufcasDigest)
+	return NewDigest(DigestTypeO1, casDigest)
 }
diff --git a/private/bufpkg/bufcas/blob.go b/private/pkg/cas/blob.go
similarity index 99%
rename from private/bufpkg/bufcas/blob.go
rename to private/pkg/cas/blob.go
index d0c288488c..e7535356d0 100644
--- a/private/bufpkg/bufcas/blob.go
+++ b/private/pkg/cas/blob.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"bytes"
diff --git a/private/bufpkg/bufcas/blob_set.go b/private/pkg/cas/blob_set.go
similarity index 99%
rename from private/bufpkg/bufcas/blob_set.go
rename to private/pkg/cas/blob_set.go
index a1ea63bafa..94f32ad517 100644
--- a/private/bufpkg/bufcas/blob_set.go
+++ b/private/pkg/cas/blob_set.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"sort"
diff --git a/private/bufpkg/bufcas/blob_set_test.go b/private/pkg/cas/blob_set_test.go
similarity index 68%
rename from private/bufpkg/bufcas/blob_set_test.go
rename to private/pkg/cas/blob_set_test.go
index fbbc9a7b14..6fb7347641 100644
--- a/private/bufpkg/bufcas/blob_set_test.go
+++ b/private/pkg/cas/blob_set_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"fmt"
@@ -25,25 +25,35 @@ import (
 
 func TestNewBlobSet(t *testing.T) {
 	t.Parallel()
-	blobs := testNewBlobs(t, 10)
-	blobSet, err := NewBlobSet(blobs)
-	require.NoError(t, err)
-	testAssertBlobsEqual(t, blobs, blobSet.Blobs())
-	assert.Equal(t, blobs[0], blobSet.GetBlob(blobs[0].Digest()))
+	for _, digestType := range AllDigestTypes {
+		t.Run(digestType.String(), func(t *testing.T) {
+			t.Parallel()
+			blobs := testNewBlobs(t, 10, digestType)
+			blobSet, err := NewBlobSet(blobs)
+			require.NoError(t, err)
+			testAssertBlobsEqual(t, blobs, blobSet.Blobs())
+			assert.Equal(t, blobs[0], blobSet.GetBlob(blobs[0].Digest()))
+		})
+	}
 }
 
 func TestNewBlobSetDuplicatesValid(t *testing.T) {
 	t.Parallel()
-	blobs := testNewBlobs(t, 10)
-	_, err := NewBlobSet(append(blobs, blobs[0]))
-	require.NoError(t, err)
+	for _, digestType := range AllDigestTypes {
+		t.Run(digestType.String(), func(t *testing.T) {
+			t.Parallel()
+			blobs := testNewBlobs(t, 10, digestType)
+			_, err := NewBlobSet(append(blobs, blobs[0]))
+			require.NoError(t, err)
+		})
+	}
 }
 
-func testNewBlobs(t *testing.T, size int) []Blob {
+func testNewBlobs(t *testing.T, size int, digestType DigestType) []Blob {
 	var blobs []Blob
 	for i := range size {
 		content := fmt.Sprintf("some file content %d", i)
-		blob, err := NewBlobForContent(strings.NewReader(content))
+		blob, err := NewBlobForContent(strings.NewReader(content), BlobWithDigestType(digestType))
 		require.NoError(t, err)
 		blobs = append(blobs, blob)
 	}
diff --git a/private/bufpkg/bufcas/blob_test.go b/private/pkg/cas/blob_test.go
similarity index 98%
rename from private/bufpkg/bufcas/blob_test.go
rename to private/pkg/cas/blob_test.go
index 419d2b6a96..1dc53587db 100644
--- a/private/bufpkg/bufcas/blob_test.go
+++ b/private/pkg/cas/blob_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"strings"
diff --git a/private/bufpkg/bufcas/bufcas.go b/private/pkg/cas/cas.go
similarity index 97%
rename from private/bufpkg/bufcas/bufcas.go
rename to private/pkg/cas/cas.go
index 1f5e8abfa1..6762527a2f 100644
--- a/private/bufpkg/bufcas/bufcas.go
+++ b/private/pkg/cas/cas.go
@@ -12,4 +12,4 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
diff --git a/private/bufpkg/bufcas/digest.go b/private/pkg/cas/digest.go
similarity index 86%
rename from private/bufpkg/bufcas/digest.go
rename to private/pkg/cas/digest.go
index 7f593f90b6..54d651d189 100644
--- a/private/bufpkg/bufcas/digest.go
+++ b/private/pkg/cas/digest.go
@@ -12,10 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -23,7 +24,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/bufbuild/buf/private/pkg/shake256"
 	"github.com/bufbuild/buf/private/pkg/syserror"
 )
@@ -33,14 +33,23 @@ const (
 	//
 	// This is both the default and the only currently-known value for DigestType.
 	DigestTypeShake256 DigestType = iota + 1
+	// DigestTypeSha256 represents the sha256 digest type.
+	DigestTypeSha256
+
+	sha256DigestLength = 32
 )
 
 var (
+	// AllDigestTypes are all DigestTypes.
+	AllDigestTypes = []DigestType{DigestTypeShake256, DigestTypeSha256}
+
 	digestTypeToString = map[DigestType]string{
 		DigestTypeShake256: "shake256",
+		DigestTypeSha256:   "sha256",
 	}
 	stringToDigestType = map[string]DigestType{
 		"shake256": DigestTypeShake256,
+		"sha256":   DigestTypeSha256,
 	}
 )
 
@@ -60,11 +69,11 @@ func (d DigestType) String() string {
 //
 // This reverses DigestType.String().
 //
-// Returns an error of type *bufparse.ParseError if the string could not be parsed.
+// Returns an error of type *ParseError if the string could not be parsed.
 func ParseDigestType(s string) (DigestType, error) {
 	d, ok := stringToDigestType[s]
 	if !ok {
-		return 0, bufparse.NewParseError(
+		return 0, newParseError(
 			"digest type",
 			s,
 			fmt.Errorf("unknown type: %q", s),
@@ -109,6 +118,9 @@ func NewDigest(value []byte, options ...DigestOption) (Digest, error) {
 			return nil, err
 		}
 		return newDigest(DigestTypeShake256, shake256Digest.Value()), nil
+	case DigestTypeSha256:
+		sha256Digest := sha256.Sum256(value)
+		return newDigest(DigestTypeSha256, sha256Digest[:]), nil
 	default:
 		// This is a system error.
 		return nil, syserror.Newf("unknown DigestType: %v", digestOptions.digestType)
@@ -135,6 +147,12 @@ func NewDigestForContent(reader io.Reader, options ...DigestOption) (Digest, err
 			return nil, err
 		}
 		return newDigest(DigestTypeShake256, shake256Digest.Value()), nil
+	case DigestTypeSha256:
+		hash := sha256.New()
+		if _, err := io.Copy(hash, reader); err != nil {
+			return nil, err
+		}
+		return newDigest(DigestTypeSha256, hash.Sum(nil)[:]), nil
 	default:
 		// This is a system error.
 		return nil, syserror.Newf("unknown DigestType: %v", digestOptions.digestType)
@@ -168,7 +186,7 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	digestTypeString, hexValue, ok := strings.Cut(s, ":")
 	if !ok {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"digest",
 			s,
 			errors.New(`must in the form "digest_type:digest_hex_value"`),
@@ -176,7 +194,7 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	digestType, err := ParseDigestType(digestTypeString)
 	if err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"digest",
 			s,
 			err,
@@ -184,14 +202,14 @@ func ParseDigest(s string) (Digest, error) {
 	}
 	value, err := hex.DecodeString(hexValue)
 	if err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"digest",
 			s,
 			errors.New(`could not parse hex: must in the form "digest_type:digest_hex_value"`),
 		)
 	}
 	if err := validateDigestParameters(digestType, value); err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"digest",
 			s,
 			err,
@@ -266,6 +284,10 @@ func validateDigestParameters(digestType DigestType, value []byte) error {
 		if err != nil {
 			return err
 		}
+	case DigestTypeSha256:
+		if len(value) != sha256DigestLength {
+			return fmt.Errorf("invalid shake256 digest value: expected %d bytes, got %d", sha256DigestLength, len(value))
+		}
 	default:
 		// This is really always a system error, but little harm in including it here, even
 		// though it'll get converted into a bufparse.ParseError in parse.
diff --git a/private/bufpkg/bufcas/digest_test.go b/private/pkg/cas/digest_test.go
similarity index 52%
rename from private/bufpkg/bufcas/digest_test.go
rename to private/pkg/cas/digest_test.go
index 919d54094f..b0b5c90401 100644
--- a/private/bufpkg/bufcas/digest_test.go
+++ b/private/pkg/cas/digest_test.go
@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Making sure that ParseErrors work outside of the bufcas package.
-package bufcas_test
+// Making sure that ParseErrors work outside of the cas package.
+package cas_test
 
 import (
 	"bytes"
@@ -24,27 +24,36 @@ import (
 	"testing"
 	"testing/iotest"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufcas"
-	"github.com/bufbuild/buf/private/bufpkg/bufparse"
+	"github.com/bufbuild/buf/private/pkg/cas"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewDigestForContent(t *testing.T) {
 	t.Parallel()
-	digest, err := bufcas.NewDigestForContent(bytes.NewBuffer(nil))
+	digest, err := cas.NewDigestForContent(bytes.NewBuffer(nil))
 	require.NoError(t, err)
-	assert.NotEqual(t, bufcas.DigestType(0), digest.Type())
+	assert.Equal(t, cas.DigestTypeShake256, digest.Type())
 	assert.NotEmpty(t, digest.Value())
 
-	digest, err = bufcas.NewDigestForContent(strings.NewReader("some content"))
+	digest, err = cas.NewDigestForContent(strings.NewReader("some content"))
 	require.NoError(t, err)
-	assert.NotEqual(t, bufcas.DigestType(0), digest.Type())
+	assert.Equal(t, cas.DigestTypeShake256, digest.Type())
+	assert.NotEmpty(t, digest.Value())
+
+	digest, err = cas.NewDigestForContent(bytes.NewBuffer(nil), cas.DigestWithDigestType(cas.DigestTypeSha256))
+	require.NoError(t, err)
+	assert.Equal(t, cas.DigestTypeSha256, digest.Type())
+	assert.NotEmpty(t, digest.Value())
+
+	digest, err = cas.NewDigestForContent(strings.NewReader("some content"), cas.DigestWithDigestType(cas.DigestTypeSha256))
+	require.NoError(t, err)
+	assert.Equal(t, cas.DigestTypeSha256, digest.Type())
 	assert.NotEmpty(t, digest.Value())
 
 	// failing digesting content
 	expectedErr := errors.New("testing error")
-	digest, err = bufcas.NewDigestForContent(iotest.ErrReader(expectedErr))
+	digest, err = cas.NewDigestForContent(iotest.ErrReader(expectedErr))
 	assert.ErrorIs(t, err, expectedErr)
 	assert.Nil(t, digest)
 }
@@ -55,7 +64,9 @@ func TestParseDigestError(t *testing.T) {
 	testParseDigestError(t, "foo", true)
 	testParseDigestError(t, "shake256 foo", true)
 	testParseDigestError(t, "shake256:_", true)
-	validDigest, err := bufcas.NewDigestForContent(bytes.NewBuffer(nil))
+	testParseDigestError(t, "sha256 foo", true)
+	testParseDigestError(t, "sha256:_", true)
+	validDigest, err := cas.NewDigestForContent(bytes.NewBuffer(nil))
 	require.NoError(t, err)
 	validDigestHex := hex.EncodeToString(validDigest.Value())
 	testParseDigestError(t, fmt.Sprintf("%s:%s", validDigest.Type(), validDigestHex[:10]), true)
@@ -65,21 +76,28 @@ func TestParseDigestError(t *testing.T) {
 func TestDigestEqual(t *testing.T) {
 	t.Parallel()
 	fileContent := "one line\nanother line\nyet another one\n"
-	d1, err := bufcas.NewDigestForContent(strings.NewReader(fileContent))
+	d1, err := cas.NewDigestForContent(strings.NewReader(fileContent))
+	require.NoError(t, err)
+	d2, err := cas.NewDigestForContent(strings.NewReader(fileContent))
+	require.NoError(t, err)
+	d3, err := cas.NewDigestForContent(strings.NewReader(fileContent + "foo"))
 	require.NoError(t, err)
-	d2, err := bufcas.NewDigestForContent(strings.NewReader(fileContent))
+	d4, err := cas.NewDigestForContent(strings.NewReader(fileContent), cas.DigestWithDigestType(cas.DigestTypeSha256))
 	require.NoError(t, err)
-	d3, err := bufcas.NewDigestForContent(strings.NewReader(fileContent + "foo"))
+	d5, err := cas.NewDigestForContent(strings.NewReader(fileContent), cas.DigestWithDigestType(cas.DigestTypeSha256))
 	require.NoError(t, err)
-	assert.True(t, bufcas.DigestEqual(d1, d2))
-	assert.False(t, bufcas.DigestEqual(d1, d3))
-	assert.False(t, bufcas.DigestEqual(d2, d3))
+	assert.True(t, cas.DigestEqual(d1, d2))
+	assert.True(t, cas.DigestEqual(d4, d5))
+	assert.False(t, cas.DigestEqual(d1, d3))
+	assert.False(t, cas.DigestEqual(d1, d4))
+	assert.False(t, cas.DigestEqual(d2, d3))
+	assert.False(t, cas.DigestEqual(d2, d4))
 }
 
 func testParseDigestError(t *testing.T, digestString string, expectParseError bool) {
-	_, err := bufcas.ParseDigest(digestString)
+	_, err := cas.ParseDigest(digestString)
 	assert.Error(t, err)
-	parseError := &bufparse.ParseError{}
+	parseError := &cas.ParseError{}
 	isParseError := errors.As(err, &parseError)
 	if expectParseError {
 		assert.True(t, isParseError)
diff --git a/private/pkg/cas/errors.go b/private/pkg/cas/errors.go
new file mode 100644
index 0000000000..2c1b3f85ab
--- /dev/null
+++ b/private/pkg/cas/errors.go
@@ -0,0 +1,89 @@
+// Copyright 2020-2025 Buf Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cas
+
+import "strings"
+
+// ParseError is an error that occurred during parsing.
+//
+// This is returned by all Parse.* functions in this package.
+type ParseError struct {
+	// typeString is the user-consumable string representing of the type that was attempted to be parsed.
+	//
+	// Users cannot rely on this data being structured.
+	// Examples: "digest", "digest type".
+	typeString string
+	// input is the input string that was attempted to be parsed.
+	input string
+	// err is the underlying error.
+	//
+	// Err may be a *ParseError itself.
+	//
+	// This is an error we may give back to the user, use pretty strings that should
+	// be read.
+	err error
+}
+
+// newParseError returns a new ParseError.
+//
+// typeString is the user-consumable string representing of the type that was attempted to be parsed.
+// input is the input string that was attempted to be parsed.
+// err is the underlying error.
+func newParseError(typeString string, input string, err error) *ParseError {
+	return &ParseError{
+		typeString: typeString,
+		input:      input,
+		err:        err,
+	}
+}
+
+// Error implements the error interface.
+func (p *ParseError) Error() string {
+	if p == nil {
+		return ""
+	}
+	var builder strings.Builder
+	_, _ = builder.WriteString(`could not parse`)
+	if p.typeString != "" {
+		_, _ = builder.WriteString(` `)
+		_, _ = builder.WriteString(p.typeString)
+	}
+	if p.input != "" {
+		_, _ = builder.WriteString(` "`)
+		_, _ = builder.WriteString(p.input)
+		_, _ = builder.WriteString(`"`)
+	}
+	if p.err != nil {
+		_, _ = builder.WriteString(`: `)
+		_, _ = builder.WriteString(p.err.Error())
+	}
+	return builder.String()
+}
+
+// Unwrap returns the underlying error.
+func (p *ParseError) Unwrap() error {
+	if p == nil {
+		return nil
+	}
+	return p.err
+}
+
+// Input returns the input string that was attempted to be parsed.
+func (p *ParseError) Input() string {
+	if p == nil {
+		return ""
+	}
+	return p.input
+}
diff --git a/private/bufpkg/bufcas/file_node.go b/private/pkg/cas/file_node.go
similarity index 94%
rename from private/bufpkg/bufcas/file_node.go
rename to private/pkg/cas/file_node.go
index a47e6baa5e..5e8ccc190e 100644
--- a/private/bufpkg/bufcas/file_node.go
+++ b/private/pkg/cas/file_node.go
@@ -12,14 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"errors"
 	"fmt"
 	"strings"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/bufbuild/buf/private/pkg/normalpath"
 )
 
@@ -63,7 +62,7 @@ func NewFileNode(path string, digest Digest) (FileNode, error) {
 func ParseFileNode(s string) (FileNode, error) {
 	split := strings.Split(s, "  ")
 	if len(split) != 2 {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"file node",
 			s,
 			errors.New(`must in the form "digest[SP][SP]path"`),
@@ -71,7 +70,7 @@ func ParseFileNode(s string) (FileNode, error) {
 	}
 	digest, err := ParseDigest(split[0])
 	if err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"file node",
 			s,
 			err,
@@ -79,7 +78,7 @@ func ParseFileNode(s string) (FileNode, error) {
 	}
 	path := split[1]
 	if err := validateFileNodeParameters(path, digest); err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"file node",
 			s,
 			err,
diff --git a/private/bufpkg/bufcas/file_set.go b/private/pkg/cas/file_set.go
similarity index 99%
rename from private/bufpkg/bufcas/file_set.go
rename to private/pkg/cas/file_set.go
index aeac1c7930..b80fc3955d 100644
--- a/private/bufpkg/bufcas/file_set.go
+++ b/private/pkg/cas/file_set.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"context"
diff --git a/private/bufpkg/bufcas/manifest.go b/private/pkg/cas/manifest.go
similarity index 94%
rename from private/bufpkg/bufcas/manifest.go
rename to private/pkg/cas/manifest.go
index 359a35a06b..b292065707 100644
--- a/private/bufpkg/bufcas/manifest.go
+++ b/private/pkg/cas/manifest.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"bytes"
@@ -20,8 +20,6 @@ import (
 	"fmt"
 	"sort"
 	"strings"
-
-	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 )
 
 // Manifest is a set of FileNodes.
@@ -74,13 +72,13 @@ func NewManifest(fileNodes []FileNode) (Manifest, error) {
 //
 // This reverses Manifest.String().
 //
-// Returns an error of type *bufparse.ParseError if the string could not be parsed.
+// Returns an error of type *ParseError if the string could not be parsed.
 func ParseManifest(s string) (Manifest, error) {
 	var fileNodes []FileNode
 	original := s
 	if len(s) > 0 {
 		if s[len(s)-1] != '\n' {
-			return nil, bufparse.NewParseError(
+			return nil, newParseError(
 				"manifest",
 				original,
 				errors.New("did not end with newline"),
@@ -90,7 +88,7 @@ func ParseManifest(s string) (Manifest, error) {
 		for i, line := range strings.Split(s, "\n") {
 			fileNode, err := ParseFileNode(line)
 			if err != nil {
-				return nil, bufparse.NewParseError(
+				return nil, newParseError(
 					"manifest",
 					original,
 					fmt.Errorf("line %d: %w", i, err),
@@ -104,7 +102,7 @@ func ParseManifest(s string) (Manifest, error) {
 	// Validation occurs within getAndValidateManifestPathToFileNode, so we pass nil to that.
 	pathToFileNode, err := getAndValidateManifestPathToFileNode(fileNodes)
 	if err != nil {
-		return nil, bufparse.NewParseError(
+		return nil, newParseError(
 			"manifest",
 			original,
 			err,
@@ -123,15 +121,15 @@ func ManifestToBlob(manifest Manifest) (Blob, error) {
 // ManifestToDigest converts the string representation of the given Manifest into a Digest.
 //
 // The Manifest is assumed to be non-nil.
-func ManifestToDigest(manifest Manifest) (Digest, error) {
-	return NewDigestForContent(strings.NewReader(manifest.String()))
+func ManifestToDigest(manifest Manifest, options ...DigestOption) (Digest, error) {
+	return NewDigestForContent(strings.NewReader(manifest.String()), options...)
 }
 
 // BlobToManifest converts the given Blob representing the string representation of a Manifest into a Manifest.
 //
 // # The Blob is assumed to be non-nil
 //
-// This function returns an error of type *bufparse.ParseError since this is
+// This function returns an error of type *ParseError since this is
 // effectively parsing the blob.
 func BlobToManifest(blob Blob) (Manifest, error) {
 	return ParseManifest(string(blob.Content()))
diff --git a/private/bufpkg/bufcas/manifest_test.go b/private/pkg/cas/manifest_test.go
similarity index 58%
rename from private/bufpkg/bufcas/manifest_test.go
rename to private/pkg/cas/manifest_test.go
index f9cb7dd775..b6e4dd360c 100644
--- a/private/bufpkg/bufcas/manifest_test.go
+++ b/private/pkg/cas/manifest_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package bufcas
+package cas
 
 import (
 	"errors"
@@ -21,46 +21,50 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestManifest(t *testing.T) {
 	t.Parallel()
-	var digests []Digest
-	var fileNodes []FileNode
-	for i := range 10 {
-		digest, err := NewDigestForContent(strings.NewReader(fmt.Sprintf("content%d", i)))
-		require.NoError(t, err)
-		digests = append(digests, digest)
-		fileNode, err := NewFileNode(fmt.Sprintf("%d", i), digest)
-		require.NoError(t, err)
-		fileNodes = append(fileNodes, fileNode)
-	}
-	manifest, err := NewManifest(fileNodes)
-	require.NoError(t, err)
+	for _, digestType := range AllDigestTypes {
+		t.Run(digestType.String(), func(t *testing.T) {
+			t.Parallel()
+			var digests []Digest
+			var fileNodes []FileNode
+			for i := range 10 {
+				digest, err := NewDigestForContent(strings.NewReader(fmt.Sprintf("content%d", i)), DigestWithDigestType(digestType))
+				require.NoError(t, err)
+				digests = append(digests, digest)
+				fileNode, err := NewFileNode(fmt.Sprintf("%d", i), digest)
+				require.NoError(t, err)
+				fileNodes = append(fileNodes, fileNode)
+			}
+			manifest, err := NewManifest(fileNodes)
+			require.NoError(t, err)
 
-	sort.Slice(
-		fileNodes,
-		func(i int, j int) bool {
-			return fileNodes[i].Path() < fileNodes[j].Path()
-		},
-	)
-	manifestFileNodes := manifest.FileNodes()
-	for i := range 10 {
-		digest := manifest.GetDigest(fmt.Sprintf("%d", i))
-		require.NotNil(t, digest)
-		assert.Equal(t, digests[i], digest)
-		assert.Equal(t, fileNodes[i], manifestFileNodes[i])
-	}
+			sort.Slice(
+				fileNodes,
+				func(i int, j int) bool {
+					return fileNodes[i].Path() < fileNodes[j].Path()
+				},
+			)
+			manifestFileNodes := manifest.FileNodes()
+			for i := range 10 {
+				digest := manifest.GetDigest(fmt.Sprintf("%d", i))
+				require.NotNil(t, digest)
+				assert.Equal(t, digests[i], digest)
+				assert.Equal(t, fileNodes[i], manifestFileNodes[i])
+			}
 
-	manifestString := manifest.String()
-	parsedManifest, err := ParseManifest(manifestString)
-	require.NoError(t, err)
+			manifestString := manifest.String()
+			parsedManifest, err := ParseManifest(manifestString)
+			require.NoError(t, err)
 
-	// Do not use fileNodes, FileNodes() are sorted.
-	assert.Equal(t, manifestFileNodes, parsedManifest.FileNodes())
+			// Do not use fileNodes, FileNodes() are sorted.
+			assert.Equal(t, manifestFileNodes, parsedManifest.FileNodes())
+		})
+	}
 }
 
 func TestEmptyManifest(t *testing.T) {
@@ -90,7 +94,7 @@ func TestParseManifestError(t *testing.T) {
 func testParseManifestError(t *testing.T, manifestString string) {
 	_, err := ParseManifest(manifestString)
 	assert.Error(t, err)
-	parseError := &bufparse.ParseError{}
+	parseError := &ParseError{}
 	isParseError := errors.As(err, &parseError)
 	assert.True(t, isParseError)
 	assert.Equal(t, manifestString, parseError.Input())
diff --git a/private/bufpkg/bufcas/usage.gen.go b/private/pkg/cas/usage.gen.go
similarity index 97%
rename from private/bufpkg/bufcas/usage.gen.go
rename to private/pkg/cas/usage.gen.go
index b063064fee..1d2fbe5bc5 100644
--- a/private/bufpkg/bufcas/usage.gen.go
+++ b/private/pkg/cas/usage.gen.go
@@ -14,6 +14,6 @@
 
 // Generated. DO NOT EDIT.
 
-package bufcas
+package cas
 
 import _ "buf.build/go/bufprivateusage"