google / google/go-containerregistry

Include manifest in the v1 tarball? Or latest OCI image-spec?

Open
#651 21 comments 0 reactions 0 assignees View on GitHub
lifecycle/frozen
Dominant language
Go
Stars
4k
Forks
686
Avg merge
2d 12h
Merged PRs (30d)
26

Description

Per #255 and the reference PR, support for v1 tarball was added, which steps in this direction. However, it does not include multiple blobs, or the original manifest or index, which the spec at https://github.com/opencontainers/image-spec/blob/master/image-layout.md does do. This breaks the confirmation of software supply chain a little, makes it hard to see the entire piece.

For now, I have been hacking the v1 tar file by adding the original manifest after pulling, but I would far prefer to follow the spec.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.