Add support for OCI artifacts “attached” to an image via `subject` about image

[mtrmac]

Thanks for your report.

(What happens here is that this adds an artifact with a subject field that refers to the dev:test image, per https://github.com/opencontainers/image-spec/blob/main/artifact.md / https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers ).

5. Use cp to copy this oci image to another oci image

This really does nothing relevant; Skopeo is completely unaware of the attached artifact, but because this copy within the same oci: repository does not change the manifest digest, the artifact seems to stay attached.

---

The real issue is that Skopeo, and c/image in general, just does not support the concept of OCI artifacts indirectly attached using the subject field.

If you can identify those artifacts manually, you can probably copy them manually with skopeo copy, one artifact at a time, but a skopeo copy of an currently does not find nor copy any of such artifacts automatically.

We have some parts of the infrastructure for this now in c/image, for use-sigstore-attachments (which is a somewhat similar concept); but not exactly this.

---

This would have to be implemented in c/image, then Skopeo would automatically inherit the support. So, moving this RFE there.

[SamirPS]

Okay thanks for your answer

If you can identify those artifacts manually, you can probably copy them manually with skopeo copy, one artifact at a time, but a skopeo copy of an currently does not find nor copy any of such artifacts automatically.

But if I do this, the sbom file will not be attached to my oci image, or did I miss something?

[mtrmac]

The “attachment” is not a separate physical link that needs to be copied; it is a semantic feature purely caused by the artifact having a subject, and the registry, or the consumer of the OCI directory, looking for that link.

So you can upload that artifact to any registry (possibly having to invent a tag for that upload); once it is uploaded, registries that understand the “referrer” concept from the OCI distribution spec are expected to notice the reference, and allow querying it. Registries that don’t understand the “referrer” context would just store the artifact, and it would not be found, or it would have to be found by iterating all tags in that repo.