Modifying the Immutable: Attaching Artifacts to OCI Images
summary
OCI adds a way to attach arbitrary artifacts to an image digest by adding a subject field to manifests, an artifactType + annotations, and a server-side referrers API; regclient, ORAS and cosign demo three artifacts (CycloneDX, SPDX, cosign signature) tied to one manifest and successfully copied between registries (zot, Harbor), showing the API works. Client-side fallback uses special tags but has race conditions; server-managed referrers avoids that. Specs are in RC (image rc3, distribution rc2) and need broader registry support (Docker Hub, ECR pending).
AI-written summary · about
chapters (9)
- 0:00Introduction to OCI images
- 1:41OCI storage and manifests
- 3:51Multi-platform images
- 7:29Attaching artifacts to images
- 9:22The challenge of metadata
- 15:28Developing the OCI solution
- 19:05Registry demo and implementation
- 27:08Status of OCI specifications
- 35:10Q&A and future directions
related talks
36mModifying the Immutable: Attaching Artifacts to OCI Images
36mIt’s Complicated: Relationships Between Objects In OCI Registries
40mDistributing Supply Chain Artifacts with OCI & ORAS Artifacts
36mContainer Images & Security 101: 5 Need to Know Facts
36mHarbor - Enterprise Cloud Native Artifact Regi...
05mORAS: Create and Distribute a Multi-platform Image with Secu...
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
31mSigned, Sealed, Delivered - Sign and Verify All the Things