OCI artifacts and referrers

OCI artifacts and referrers

Open Container Initiative (OCI) is responsible for multiple specifications:

• Runtime (how to talk to container runtime)
• Image (how to store a container image)
• Distribution (how to talk to image registries)
• Artifact (how to store arbitraty data in registries)

OCI is slowly replacing Docker media types

Version 1.1 is in the making

Distribution spec 1.1.0-rc.2 adds referrers

Referrers add relationships between digests

Implementations: regclient, trivy, oras, distribution, cosign

Demo

Upload demo image

Link SBOM

Link SARIF report (repeat daily)

Sign image

Sign SBOM

Sign SARIF