Distributing Supply Chain Artifacts with OCI & ORAS Artifacts
summary
Shows how existing OCI registries store images plus SBOMs, detached signatures and scan results by adding a manifest type and a subject link so an SBOM (example 200 MB) or claims file attaches to a specific image digest. Demonstrates ORAS tooling: push/discover/pull with the ORAS referrers API, copy an entire graph between registries, archive or delete all related artifacts together for compliance (example 18 month retention), and use the rs-go library and ORAS/Distribution patches to automate it.
AI-written summary · about
chapters (12)
- 0:00Supply chain artifacts
- 2:20Best practices and storage
- 4:49Lifecycle and access control
- 9:29The role of registries
- 11:56OCI distribution specs
- 16:21Artifact and tag anatomy
- 20:23Evolution of registries
- 22:55Associating metadata
- 25:07Implementing OCI reference
- 29:30Demonstration of features
- 33:47Referrers API technicalities
- 36:27Conclusion and resources
related talks
29mBuilding Signing, Distributing SPDX SBOMs as Artifact Reference Type
36mModifying the Immutable: Attaching Artifacts to OCI Images
44mModifying the Immutable: Attaching Artifacts to OCI Images
05mORAS: Create and Distribute a Multi-platform Image with Secu...
36mIt’s Complicated: Relationships Between Objects In OCI Registries
55mSecuring Container Supply Chain in CI/CD with Notary Project, ORAS and Harbor
32mBack to the Drawing Board: Building Containers with SBoMs
31mSign, Attest, and Verify! A Practical Guide for Software Supply...