Modifying the Immutable: Attaching Artifacts to OCI Images
summary
Explains how OCI now lets you attach SBOMs and signatures to an immutable image by pushing artifact manifests (examples: CycloneDX and SPDX) and linking them with a subject field; demos use regcuddle, two registries (an older cncf distribution v1 and a zot registry implementing the refers API), and show a fast copy between registries. Describes fallback via a digest-as-tag, client-managed tag races, registry garbage-collection rules, and why predictable media types matter.
AI-written summary · about
chapters (7)
- 0:00Fundamentals of OCI images
- 2:01OCI architecture explained
- 7:19The challenge of association
- 12:35Proposed technical solutions
- 17:02Practical implementation demo
- 21:53Querying and portability
- 26:43Next steps and conclusions
related talks
44mModifying the Immutable: Attaching Artifacts to OCI Images
36mIt’s Complicated: Relationships Between Objects In OCI Registries
40mDistributing Supply Chain Artifacts with OCI & ORAS Artifacts
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
36mContainer Images & Security 101: 5 Need to Know Facts
45mImage Layout: Stop Putting Everything in Registries
23mPanel: Expanding Argo CD Content Management Using OCI Artifacts
32mBack to the Drawing Board: Building Containers with SBoMs