diff --git a/artifact-manifest/artifact-manifest-bicep.json b/artifact-manifest/artifact-manifest-bicep.json deleted file mode 100644 index e00ff14..0000000 --- a/artifact-manifest/artifact-manifest-bicep.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schemaVersion": 2, - "mediaType": "application/vnd.oci.artifact.collection.v1+json", - "config": { - "mediaType": "application/vnd.azure.arm.bicep.config.v1+json", - "size": 7023, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" - }, - "references": [ - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 32654, - "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0" - }, - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 16724, - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b" - }, - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 73109, - "digest": "sha256:ec4b8955958665577945c89419d1af06b5f7636b4ac3da7f12184802ad867736" - }, - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - }, - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - }, - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - } - ] -} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-mysql-image-sbom copy.json b/artifact-manifest/artifact-manifest-mysql-image-sbom copy.json new file mode 100644 index 0000000..157adb6 --- /dev/null +++ b/artifact-manifest/artifact-manifest-mysql-image-sbom copy.json @@ -0,0 +1,28 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.openssf.sbom.v1+json", + "config": { + "mediaType": "application/vnd.openssf.sbom.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "openssf.sbom.author": "mysql" + } +} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-mysql-image-sbom.json b/artifact-manifest/artifact-manifest-mysql-image-sbom.json new file mode 100644 index 0000000..3bc8ebd --- /dev/null +++ b/artifact-manifest/artifact-manifest-mysql-image-sbom.json @@ -0,0 +1,28 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.openssf.sbom.v1", + "config": { + "mediaType": "application/vnd.openssf.sbom.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.config.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "openssf.sbom.author": "mysql" + } +} diff --git a/artifact-manifest/artifact-manifest-mysql-image-signature.json b/artifact-manifest/artifact-manifest-mysql-image-signature.json index bd182e6..1848120 100644 --- a/artifact-manifest/artifact-manifest-mysql-image-signature.json +++ b/artifact-manifest/artifact-manifest-mysql-image-signature.json @@ -1,26 +1,28 @@ { - "schemaVersion": 2, + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.notary.v2", + "artifactType": "application/vnd.cncf.notary.v2+json", "config": { - "mediaType": "application/vnd.cncf.notary.config.v2", + "mediaType": "application/vnd.cncf.notary.config.v2+json", "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", "size": 102 }, "blobs": [ { - "mediaType": "application/vnd.cncf.notary.v2.json", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", - "size": 32654, - "reference": "registry.wabbitnetworks.io" + "size": 32654 } ], - "dependencies": [ + "manifests": [ { - "mediaType": "application/vnd.oci.image.manifest.v1", + "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724, - "artifact": "mysql:3.1" + "size": 16724 } - ] -} + ], + "references": [], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-wordpress-cnab-signature copy.json b/artifact-manifest/artifact-manifest-wordpress-cnab-signature copy.json new file mode 100644 index 0000000..41424cd --- /dev/null +++ b/artifact-manifest/artifact-manifest-wordpress-cnab-signature copy.json @@ -0,0 +1,27 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-wordpress-cnab-signature.json b/artifact-manifest/artifact-manifest-wordpress-cnab-signature.json index e69de29..41424cd 100644 --- a/artifact-manifest/artifact-manifest-wordpress-cnab-signature.json +++ b/artifact-manifest/artifact-manifest-wordpress-cnab-signature.json @@ -0,0 +1,27 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-wordpress-cnab..json b/artifact-manifest/artifact-manifest-wordpress-cnab..json index 4b618d4..9dc174e 100644 --- a/artifact-manifest/artifact-manifest-wordpress-cnab..json +++ b/artifact-manifest/artifact-manifest-wordpress-cnab..json @@ -1,36 +1,37 @@ { - "schemaVersion": 2, + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.cnab.v1", + "artifactType": "application/vnd.cncf.cnab.v1+json.", "config": { "mediaType": "application/vnd.cncf.cnab.config.v1+json", - "size": 0, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 134 }, "blobs": [ { - "mediaType": "application/vnd.cncf.cnab.v1.tar", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", "size": 32654 - }, - { - "mediaType": "application/vnd.cncf.cnab.params.v1.json", - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724 } ], + "manifests": [], "references": [ { - "reference": "wordpress-chart:v5", - "mediaType": "application/vnd.cncf.helm.v1.config.json", - "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", - "size": 1510 + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.artifact": "helm-cli:3" + } }, { - "reference": "helm-cli:3", - "mediaType": "application/vnd.oci.image.manifest.v1.config.json", - "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", - "size": 1578 + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress-chart:v5" + } + } ] } \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-wordpress-helm-signature.json b/artifact-manifest/artifact-manifest-wordpress-helm-signature.json deleted file mode 100644 index ee49d80..0000000 --- a/artifact-manifest/artifact-manifest-wordpress-helm-signature.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "schemaVersion": 2, - "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.notary.v2", - "config": { - "mediaType": "application/vnd.cncf.notary.config.v2", - "size": 0, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" - }, - "blobs": [ - { - "mediaType": "application/vnd.cncf.notary.v2.json", - "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", - "size": 32654, - "reference": "registry.wabbitnetworks.io" - } - ], - "references": [ - { - "mediaType": "application/vnd.oci.image.index.v1.config.json", - "reference": "/wordpress:5.7" - # digest not necessary as the signature has the digest embedded in it - } - ] -} - - diff --git a/artifact-manifest/artifact-manifest-wordpress-helm.json b/artifact-manifest/artifact-manifest-wordpress-helm.json index a93db68..496ab8d 100644 --- a/artifact-manifest/artifact-manifest-wordpress-helm.json +++ b/artifact-manifest/artifact-manifest-wordpress-helm.json @@ -1,36 +1,36 @@ { - "schemaVersion": 2, + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.helm.v3", + "artifactType": "application/vnd.cncf.helm.v3+json", "config": { "mediaType": "application/vnd.cncf.helm.config.v1+json", - "size": 0, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 0 }, "blobs": [ { - "mediaType": "application/vnd.cncf.helm.chart.v1.tar", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", "size": 32654 - }, - { - "mediaType": "application/vnd.cncf.helm.values.v1.yaml", - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724 } ], + "manifests": [], "references": [ { - "reference": "wordpress:5.7", - "mediaType": "application/vnd.oci.image.manifest.v1.config.json", + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", - "size": 1510 + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress:5.7" + } }, { - "reference": "mysql:8", - "mediaType": "application/vnd.oci.image.manifest.v1.config.json", + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", - "size": 1578 + "size": 1578, + "annotations": { + "oci.distribution.artifact": "mysql:8" + } } ] } \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest-wordpress-image-signature.json b/artifact-manifest/artifact-manifest-wordpress-image-signature.json index 094ddab..e6fffcd 100644 --- a/artifact-manifest/artifact-manifest-wordpress-image-signature.json +++ b/artifact-manifest/artifact-manifest-wordpress-image-signature.json @@ -1,33 +1,28 @@ { - "schemaVersion": 2, + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.collection.v1+json", - "artifactType": "application/vnd.cncf.notary.v2", + "artifactType": "application/vnd.cncf.notary.v2+json", "config": { - "mediaType": "application/vnd.cncf.notary.config.v2", + "mediaType": "application/vnd.cncf.notary.config.v2+json", "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", - "size": 0 + "size": 120 }, - "dependencies": [ + "blobs": [ { - "mediaType": "application/vnd.cncf.notary.v2.json", - "refType": "blob", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", - "size": 32654, - "reference": "registry.wabbitnetworks.io" - }, + "size": 32654 + } + ], + "manifests": [ { - "mediaType": "application/vnd.oci.image.manifest.v1", - "digest": "wordpress@sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724, - "linkType": "hard|soft", - "linkType": "parent|child", - "reference": "/wordpress:5.7" - }, - "links": [ - { - "mediaType": "application/vnd.oci.image.index.v1.config.json", - "refType": "manifest", - "reference": "/wordpress:5.7" - } - ] + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } } \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest.json b/artifact-manifest/artifact-manifest.json deleted file mode 100644 index a197d91..0000000 --- a/artifact-manifest/artifact-manifest.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "schemaVersion": 2, - "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "config": { - "mediaType": "application/vnd.oci.artifact.manifest.config.v1+json", - "size": 7023, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" - }, - "blobs": [ - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 32654, - "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0" - }, - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 16724, - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b" - }, - { - "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", - "size": 73109, - "digest": "sha256:ec4b8955958665577945c89419d1af06b5f7636b4ac3da7f12184802ad867736" - } - ], - "dependencies":[ - { - - } - ], - "references": [ - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - }, - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - }, - { - "mediaType": "image|index|signature|helm|CNAB|...", - "digest": "---", - "refType": "hard|soft" - } - ], - "annotations": { - "org.opencontainers.artifact.created": "", - "org.opencontainers.artifact.authors": "", - "org.opencontainers.artifact.url": "opencontainers.org", - "org.opencontainers.artifact.documentation": "opencontainers.org", - "org.opencontainers.artifact.source": "https://github.com/opencontainers/artifacts", - "org.opencontainers.artifact.version": "v1.0", - "org.opencontainers.artifact.revision": "v1.1.0", - "org.opencontainers.artifact.vendor": "Open Containers Initiative", - "org.opencontainers.artifact.licenses": "MIT", - "org.opencontainers.artifact.title": "Open Containers Artifact Manifest", - "org.opencontainers.artifact.description": "A schema for defining artifacts" - } -} \ No newline at end of file diff --git a/artifact-manifest/artifact-manifest.md b/artifact-manifest/artifact-manifest.md index d9a5a86..30d5bf0 100644 --- a/artifact-manifest/artifact-manifest.md +++ b/artifact-manifest/artifact-manifest.md @@ -68,11 +68,17 @@ products.wabbit-networks.io\ To support artifact movement, the content that constitutes an artifact to individually represent itself must be maintained within the same registry. For example, the layers of an container image, or the signature blob of a Notary v2 signature artifact. +### Dependencies on Blobs and Other Artifacts + +A class of of artifacts will have content (blobs) that represent the artifact (eg: Notary, SBoM), however they are extensions of another artifact (eg: container image) which are dependencies on other `manifests`. The other manifests could be any OCI supported manifest, including `image-manifest`, `image-index` and other `oci.artifact.manifest` references. + +All extension artifacts are stored without tags, and must be stored in the same repository as the artifact they are extending. + ### Deferred Resolution To support artifact movement to various registry and namespace structures, the registry and path must not be embedded within the artifact definition. Client CLIs and configurations will provide default locations and mappings for where to find the referenced content. -Artifacts that reference other artifacts must include an OCI Artifact Descriptor which includes the `manifest type`, `digest`, `size` and `repo:tag` of the artifact, however it will defer resolution of the reference to client tools that MAY reconstitute the references from multiple repositories and/or registries. +Artifacts that reference other artifacts must include an OCI Descriptor which includes the `manifest type`, `digest` and `size`. An annotation will include the `repo:tag`, which may be used to resolve the name of the artifact. The resolution is defered to client tools that MAY reconstitute the references from multiple repositories and/or registries. Clients MAY choose to bind to specific digests, assuring they are testing and using the exact graph initially specified. Or, clients may choose to float to a newer version of a tag, benefiting from patches. In all cases, a Notary v2 signature may be used to assure the artifacts are true to their initial ownership and authors. @@ -82,19 +88,21 @@ Artifact manifest is intended to support the following artifact types: ### OCI Image -An OCI Image is based on the oci-image-manifest. It's shown as a comparison to the examples below. +An OCI Image is based on the oci-image-manifest. It's shown as a comparison to the examples below that may depend upon, or reference OCI images. Note: all references below may be made to oci-index as well as oci-manifest. ![OCI Image](media/wordpress-image-layers.svg) -### Notary v2 Signature Persistance +### Notary v2 Signatures and SBoM Persistance -A Notary v2 signature would persist as a manifest with a config object and a signature, persisted as a blob. However, the signature has no value unto itself. A signature is applied to a given artifact. It's said to be dependent upon another artifact to be complete. +A Notary v2 signature, or an SBoM document would persist as a manifest with a config object and a signature, persisted as a blob. However, neither the signature, nor the SBoM have value unto themselves. A signature and SBoM extend a given artifact. They're considered as dependent upon another artifact to be complete. ![notary v2 signature](media/notaryv2-signature.svg) -The Notary v2 signature would reference an artifact, such as the `wordpress:v5` image above. Notice the directionality of the references. One or more signatures may be added to a registry after the image was persisted. While an image knows of it's layers, and a Notary v2 signature knows of its config and blob, the Notary v2 signature declares a dependency to the artifact it's signing. The visualization indicates the references through solid lines as these reference types are said to be hard references. Just as the layers of an OCI Image are deleted (*ref-counted -1*), the blobs of a signature are deleted (*ref-counted -1*) when the signature is deleted. Likewise, when an artifact is deleted, the signature would be deleted (*ref-counted -1*) as the signatures have no value without the artifact they are signing. +![SBoM document](media/sbom-document.svg) -![wordpress image with layers](media/wordpress-image-layers-sig.svg) +The Notary v2 signature and SBoM would reference an artifact, such as the `wordpress:v5` image above. Notice the directionality of the references. One or more signatures may be added to a registry after the image was persisted. While an image knows of it's layers, and a Notary v2 signature knows of its config and blob, the Notary v2 signature declares a dependency to the artifact it's signing. The visualization indicates the references through solid lines as these reference types are said to be hard references. Just as the layers of an OCI Image are deleted (*ref-counted -1*), the blobs of a signature are deleted (*ref-counted -1*) when the signature is deleted. Likewise, when an artifact is deleted, the signatures and SBoM would be deleted (*ref-counted -1*) as the signatures and SBoMs have no value without the artifact they are signing. + +![wordpress image with layers](media/wordpress-image-layers-sig-sbom.svg) ### Helm Charts & CNAB @@ -111,8 +119,8 @@ A CNAB may also be persisted with configuration information, along with a refere The main scenarios include: 1. Discovery of content within a registry for content listing through a CLI and visualizations. -1. Copying within and across registries. -1. Deletion management, providing information to de-dupe content with reference counting. +1. Copying within and across registries, with the option to copy loose references, if resolved. +1. Deletion management, providing information to de-dupe content with reference counting, and the option to delete loose references. 1. Support enhancing information related to existing content. Such as adding a Notary v2 signature or SBoM artifacts. 1. Validation, with required and optional references. @@ -169,29 +177,32 @@ The above commands account for the image manifest and the associated layers. Not } ``` -### Container Image, with Signatures +### Container Image, with Signatures and an SBoM ![mysql image copy](./media/mysql-with-sigs-copy.svg) -In this scenario, Notary v2 signatures have been added. Note the directionality of the Notary v2 signatures references. The `mysql:8` image has no reference to the signatures. The signatures may be added to existing artifacts. The signatures declare a reference `-->` to the `mysql:8` image. This assure the `mysql:8` image tag and digest need not change to support signatures added throughout the secured supply chain. +In this scenario, Notary v2 signatures have been added. Note the directionality of the Notary v2 signatures references. The `mysql:8` image has no reference to the signatures. The signatures may be added to existing artifacts. The signatures declare a reference `-->` to the `mysql:8` image. This assures the `mysql:8` image tag and digest need not change to support signatures, nor SBoMs added throughout the secured supply chain. -From a user experience perspective, copying a container from a public registry to a private registry would likely be expected to copy the signatures alongside the artifact they've signed. +From a user experience perspective, copying a container from a public registry to a private registry would likely be expected to copy the signatures alongside the artifact they've signed, as well as other extension artifacts like SBoMs. -The `oci.artifact.manifest` supports the Notary v2 requirements, including: +The `oci.artifact.manifest` supports the Notary v2 and SBoM requirements, including: - support for additive signatures, assuring the target manifest digest and tag do not change - support for multiple signatures. In the above scenario, `mysql` signed the original image. As `mysql` was copied to Docker Hub, an additional `docker community signature` was added, providing certified content attestation. Once the image copy to ACME Rockets is completed, an additional `acme-rockets signature` is added providing assurance the `mysql:8` image was security scanned and verified it's applicable to the ACME Rockets environment. From a user experience, the signature artifacts have no unique value beyond the artifact they represent, therefore they would be persisted to a registry in a form by which they are known to copy with the artifact, and be deleted when the artifact they are associated with is deleted. -To support hard references, an additional dependencies collection is added to a new `application/vnd.oci.artifact.manifest.v1+json` schema. The `dependencies` collection declares the artifact the signature is dependent upon. Similar to pypi packages, the validation of dependencies are deferred. If the dependent artifacts are found, they are valid. Depending on the validation options, a signature may exist without its dependent artifact. +To support hard references, an additional dependencies collection is added to a new `application/vnd.oci.artifact.manifest.v1+json` schema. The `manifests` collection declares the artifact the signature is dependent upon. **A Notary v2 signature of the `mysql:8` image example:** +> **OPTION A** + ```json { + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.notary.v2", + "artifactType": "application/vnd.cncf.notary.v2+json", "config": { "mediaType": "application/vnd.cncf.notary.config.v2+json", "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", @@ -199,7 +210,7 @@ To support hard references, an additional dependencies collection is added to a }, "blobs": [ { - "mediaType": "application/vnd.cncf.notary.signature.v2+json", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", "size": 32654 } @@ -217,8 +228,41 @@ To support hard references, an additional dependencies collection is added to a "annotations": { "org.cncf.notary.v2.signature.subject": "docker.io" } +} ``` +> **OPTION B** + +```json +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} +``` In the above example, the signing entity is Docker, which is represented as a notary scoped annotation: `"org.cncf.notary.v2.signature.subject": "docker.io"` #### OCI-Registry CLI @@ -256,10 +300,13 @@ To support the loose references between artifacts, a `references` collection is **A `wordpress-chart:v5` Helm Chart example:** +> **OPTION A** + ```json { + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", - "artifactType": "application/vnd.cncf.helm.v3", + "artifactType": "application/vnd.cncf.helm.v3+json", "config": { "mediaType": "application/vnd.cncf.helm.config.v1+json", "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", @@ -267,41 +314,74 @@ To support the loose references between artifacts, a `references` collection is }, "blobs": [ { - "mediaType": "application/vnd.cncf.helm.chart.v1+tar", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", "size": 32654 - }, - { - "mediaType": "application/vnd.cncf.helm.values.v1+yaml", - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724 } ], "manifests": [ { - "mediaType": "application/vnd.oci.image.manifest.v1+json", + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", "size": 1510, "annotations": { "oci.distribution.relationship": "references", - "oci.distribution.artifact": "wordpress:5.7", - "oci.distribution.artifactType": "application/vnd.oci.image.v1" + "oci.distribution.artifact": "wordpress:5.7" } }, { - "mediaType": "application/vnd.oci.image.manifest.v1+json", + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", "size": 1578, "annotations": { "oci.distribution.relationship": "references", - "oci.distribution.artifact": "mysql:8", - "oci.distribution.artifactType": "application/vnd.oci.image.v1" + "oci.distribution.artifact": "mysql:8" } } ] } ``` +> **OPTION B** + +```json +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.helm.v3+json", + "config": { + "mediaType": "application/vnd.cncf.helm.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 0 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [], + "references": [ + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress:5.7" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.artifact": "mysql:8" + } + } + ] +} +``` #### CNAB Reference A CNAB is yet another reference artifact. While the current CNAB spec incorporates the helm-cli ahd helm chart within an invocation image, the `artifact.manifest` provides more natural package management experiences where the references can be resolved based on the users intent, while leveraging the capabilities of an OCI compliant registry to store all OCI Artifact types. @@ -312,53 +392,88 @@ Similar to the Helm example, a CNAB is copied from a public registry to the ACME As the `oci-reg copy` command is executed, the graph of references are expanded. As the copy proceeds, only those artifacts that don't already exist in the target registry are required to be copied. The references may be hard bound to the digest, or loosely bound to the `artifact:tag` enabling more recently patched versions of a given `artifact:tag`. The CNAB and Helm `artifact.manifest` may declare how strict they wish to couple their references to **stable tags** or **unique digests** +> **OPTION A** + ```json { + "schemaVersion": 1, "mediaType": "application/vnd.oci.artifact.manifest.v1+json", "artifactType": "application/vnd.cncf.cnab.v1", "config": { "mediaType": "application/vnd.cncf.cnab.config.v1+json", - "size": 0, - "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 134 }, "blobs": [ { - "mediaType": "application/vnd.cncf.cnab.v1+tar", + "mediaType": "application/tar", "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", "size": 32654 - }, - { - "mediaType": "application/vnd.cncf.cnab.params.v1+json", - "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", - "size": 16724 } ], "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.relationship": "references", + "oci.distribution.artifact": "helm-cli:3" + } + }, { "mediaType": "application/vnd.oci.artifact.manifest.v1+json", "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", "size": 1510, "annotations": { "oci.distribution.relationship": "references", - "oci.distribution.artifact": "wordpress-chart:v5", - "oci.distribution.artifactType": "application/vnd.cncf.helm.v3" + "oci.distribution.artifact": "wordpress-chart:v5" } - }, + } + ] +} +``` + +> **OPTION B** + +```json +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.cnab.v1+json.", + "config": { + "mediaType": "application/vnd.cncf.cnab.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 134 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [], + "references": [ { - "artifact": "helm-cli:3", "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", "size": 1578, "annotations": { - "oci.distribution.relationship": "references", - "oci.distribution.artifact": "helm-cli:3", - "oci.distribution.artifactType": "application/vnd.oci.image.manifest.v1" + "oci.distribution.artifact": "helm-cli:3" + } + }, + { + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress-chart:v5" } } ] } ``` - ### Deletion Distribution-spec APIs will provide standard delete operations, including options for deleting referenced artifacts, or blocking a delete as the artifact is referenced by other artifacts. The `oci.artifact.manifest` collection will provide the information, as defined by the artifact author` for how an artifact should be handled for delete operations. The registry, nor the `oci-reg` cli would need to know about specific artifact implementations. @@ -374,52 +489,19 @@ The deletion scenarios include: - deleting the mysql image should warn if referenced by any helm charts. However, based on the parameters of the cli, it may delete images referenced by helm charts within the registry as these references are considered loose references and may be resolved externally to the registry. - deleting the wordpress helm chart, wordpress image, or mysql image would delete the associated signatures as the signatures have no value unto themselves. The `oci-reg` cli may accomplish these delete steps without any knowledge of Notary v2 spec as the `oci-reg` delete cli will follow the rules of the `oci.artifact.manifest` collections. -## OCI Artifact Manifest Content Descriptor - -The OCI Artifact Manifest content descriptor is enhanced with an additional `artifact` property enabling loose or hard references between artifact types. - -- **`mediaType`** *string* - - This property identifies the OCI schema of the manifest being referenced. - An OCI v_ compliant registry must support at least the following schemas: - - - `"application/vnd.oci.image.manifest.v1+json"` - - `"application/vnd.oci.image.index.v1+json"` - - `"application/vnd.oci.artifact.manifest.v1+json"` - -- **`digest`** *string* - - This REQUIRED property is the digest of the targeted content, conforming to the requirements outlined in Digests. Retrieved content SHOULD be verified against this digest when consumed via untrusted sources. - -- **`size`** *int64* - - This REQUIRED property specifies the size, in bytes, of the raw content. This property exists so that a client will have an expected size for the content before processing. If the length of the retrieved content does not match the specified length, the content SHOULD NOT be trusted. - -- **`artifact-type`** *string* - - This property defines the OCI Artifact Type. In previous versions of the OCI Artifact spec, this was defined with `manifest.config.mediaType`. This property is lifted and formalized in the `oci.artifact.manifest` enabling filtering of references to those of a given `artifact-type`, such as returning a list of Notary v2 signatures. - -- **`artifact`** *string* - - This property provides a reference to the `artifact:tag`, enabling floating to a newer/patched version of a tag. An OCI Artifact Manifest content descriptor must include the digest to assure a client may validate the initially referenced artifact, however this is a client choice for binding to a specific digest, or newer version based on the `artifact:tag` named reference. - ## OCI Artifact Collections OCI Artifact Manifests provide the following types of references: - **Blobs:** Content that represents the artifact. These are analogues to layers from the OCI Image manifest and Config objects. Layers are renamed blobs as they represent a generic collection of content, as opposed to an ordered layered collection as defined by OCI Image Manifest. An artifact may treat them as ordered, but it is not required. -- **Dependencies** on other artifacts that enhance the content, such as a Notary v2 signature or an SBoM. These dependencies are *unknown* by the original artifact as they are added at a later time. A registry would need to index these references as registry apis would request all content related to the source artifact. +- **Manifests** are dependent references to other artifacts that enhance the content, such as a Notary v2 signature or an SBoM. These dependencies are *unknown* by the original artifact as they are added at a later time. A registry would need to index these references as registry apis would request all content related to the source artifact. - **References** to other artifacts, used to complete a scenario, but may not be stored within the same repository or registry. These references are defined by the source artifact and known at the time of upload to a registry, such as a Helm chart that references other images. These references are included in the manifest and computed in the digest of the manifest. ### Blobs Collection -All blobs are considered to be hard dependencies that must be resolvable within a registry. An artifact is considered invalid if the manifest blobs are not resolvable. Registries MAY implement de-duping, using ref-counting to assure at least one copy of the blob is resolvable for any given `oci.artifact.manifest`. OCI Artifact blobs are generalizations of the OCI Image Spec layers definition. - -## Manifests Collection +All `blobs` are considered to be hard dependencies that must be resolvable within a registry. An artifact is considered invalid if the manifest blobs are not resolvable. Registries MAY implement de-duping, using ref-counting to assure at least one copy of the blob is resolvable for any given `oci.artifact.manifest`. OCI Artifact blobs are generalizations of the OCI Image Spec layers definition. -> **NOTE!** Update to consolidate the Dependencies and References collections - -### Dependencies Collection +### Manifests Collection Alternate names: @@ -427,7 +509,7 @@ Alternate names: - `parents` - `enhances` -The dependencies collection is an optional collection of references to other artifacts. The artifact is said to enhance the dependent artifacts by adding additional content. The content may be added after the initial content was created or pushed to a registry. By supporting additional content, the referenced artifact can be enhanced without having to change the referenced artifacts manifest, digest or tag. +The `manifests` collection is an optional collection of references to other artifacts. The artifact is said to enhance the dependent artifacts by adding additional content. The content may be added after the initial content was created or pushed to a registry. By supporting additional content, the referenced artifact can be enhanced without having to change the referenced artifacts manifest, digest or tag. Examples include: @@ -435,7 +517,7 @@ Examples include: - SBoM documents - Artifact Meta-data -Dependencies are collections of OCI Artifact Content Descriptors. +`manifests` are collections of Content Descriptors. ### References Collection @@ -479,6 +561,24 @@ This specification defines the following annotation keys, intended for but not l - **org.opencontainers.artifact.title** Human-readable title of the artifact (string) - **org.opencontainers.artifact.description** Human-readable description of the software packaged in the artifact (string) +```json +{ + "annotations": { + "org.opencontainers.artifact.created": "", + "org.opencontainers.artifact.authors": "", + "org.opencontainers.artifact.url": "opencontainers.org", + "org.opencontainers.artifact.documentation": "opencontainers.org", + "org.opencontainers.artifact.source": "https://github.com/opencontainers/artifacts", + "org.opencontainers.artifact.version": "v1.0", + "org.opencontainers.artifact.revision": "v1.1.0", + "org.opencontainers.artifact.vendor": "Open Containers Initiative", + "org.opencontainers.artifact.licenses": "MIT", + "org.opencontainers.artifact.title": "Open Containers Artifact Manifest", + "org.opencontainers.artifact.description": "A schema for defining artifacts" + } +} +``` + ## Open Questions -Should the references collection support additional types, like loose urls +1. Should the references collection support additional types, like loose urls diff --git a/artifact-manifest/media/mysql-with-sigs-copy.svg b/artifact-manifest/media/mysql-with-sigs-copy.svg index 295ba78..56969f5 100644 --- a/artifact-manifest/media/mysql-with-sigs-copy.svg +++ b/artifact-manifest/media/mysql-with-sigs-copy.svg @@ -1 +1 @@ -mysql:8MySQL signatureDocker community signatureACME Rockets signatureLayer1Layer2ACME Rocketsmysql:8MySQL signatureDocker community signatureACME Rockets signatureArtifact ImportLayer1Layer2 \ No newline at end of file +ACME Rocketsmysql:8MySQL signatureDocker community signatureACME Rockets signatureArtifact ImportLayer1Layer2SBoMDocumentSBoMmysql:8MySQL signatureDocker community signatureLayer1Layer2SBoMDocumentSBoM \ No newline at end of file diff --git a/artifact-manifest/media/sbom-document.svg b/artifact-manifest/media/sbom-document.svg new file mode 100644 index 0000000..1d99c8d --- /dev/null +++ b/artifact-manifest/media/sbom-document.svg @@ -0,0 +1 @@ +SBoMSBoMconfig-blobSBoM-document-blob \ No newline at end of file diff --git a/artifact-manifest/media/wordpress-cnab.svg b/artifact-manifest/media/wordpress-cnab.svg index 7330757..d0d4300 100644 --- a/artifact-manifest/media/wordpress-cnab.svg +++ b/artifact-manifest/media/wordpress-cnab.svg @@ -1 +1 @@ -mysql:8MySQL signatureDocker community signatureACME Rockets signaturewordpress:v5Docker community signaturehelm-cli:v3Helm community signaturewordpress-chart:v5Helm community signaturewordpress-cnab:v5Helm community signature \ No newline at end of file +helm-cli:v3Helm community signaturewordpress-cnab:v5Helm community signaturemysql:8MySQL signatureDocker community signatureACME Rockets signaturewordpress:v5Docker community signaturewordpress-chart:v5Helm community signatureSBoMDocumentSBoMSBoMDocumentSBoMSBoMDocumentSBoMSBoMDocumentSBoMSBoMDocumentSBoM \ No newline at end of file diff --git a/artifact-manifest/media/wordpress-helm-chart.svg b/artifact-manifest/media/wordpress-helm-chart.svg index 591ca72..790d937 100644 --- a/artifact-manifest/media/wordpress-helm-chart.svg +++ b/artifact-manifest/media/wordpress-helm-chart.svg @@ -1 +1 @@ -mysql:8MySQL signatureDocker community signatureACME Rockets signaturewordpress:v5Docker community signaturewordpress-chart:v5Helm community signature \ No newline at end of file +mysql:8MySQL signatureDocker community signatureACME Rockets signaturewordpress:v5Docker community signaturewordpress-chart:v5Helm community signatureSBoMDocumentSBoMSBoMDocumentSBoMSBoMDocumentSBoM \ No newline at end of file diff --git a/artifact-manifest/media/wordpress-image-layers-sig-sbom.svg b/artifact-manifest/media/wordpress-image-layers-sig-sbom.svg new file mode 100644 index 0000000..cce5559 --- /dev/null +++ b/artifact-manifest/media/wordpress-image-layers-sig-sbom.svg @@ -0,0 +1 @@ +wordpress:v5Docker community signatureLayer1Layer2ACME Rockets signatureSBoMDocumentSBoM \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-mysql-image-sbom.json b/artifact-manifest/option-a/artifact-manifest-mysql-image-sbom.json new file mode 100644 index 0000000..e30fcdd --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-mysql-image-sbom.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.openssf.sbom.v1+json", + "config": { + "mediaType": "application/vnd.openssf.sbom.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724, + "annotations": { + "oci.distribution.relationship": "depends-on" + } + } + ], + "annotations": { + "openssf.sbom.author": "mysql" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-mysql-image-signature.json b/artifact-manifest/option-a/artifact-manifest-mysql-image-signature.json new file mode 100644 index 0000000..97b6e36 --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-mysql-image-signature.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724, + "annotations": { + "oci.distribution.relationship": "depends-on" + } + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-wordpress-cnab-signature.json b/artifact-manifest/option-a/artifact-manifest-wordpress-cnab-signature.json new file mode 100644 index 0000000..298b97c --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-wordpress-cnab-signature.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724, + "annotations": { + "oci.distribution.relationship": "depends-on" + } + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-wordpress-cnab..json b/artifact-manifest/option-a/artifact-manifest-wordpress-cnab..json new file mode 100644 index 0000000..b63a52c --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-wordpress-cnab..json @@ -0,0 +1,37 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.cnab.v1", + "config": { + "mediaType": "application/vnd.cncf.cnab.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 134 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.relationship": "references", + "oci.distribution.artifact": "helm-cli:3" + } + }, + { + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.relationship": "references", + "oci.distribution.artifact": "wordpress-chart:v5" + } + } + ] +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-wordpress-helm-signature.json b/artifact-manifest/option-a/artifact-manifest-wordpress-helm-signature.json new file mode 100644 index 0000000..298b97c --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-wordpress-helm-signature.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724, + "annotations": { + "oci.distribution.relationship": "depends-on" + } + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-wordpress-helm.json b/artifact-manifest/option-a/artifact-manifest-wordpress-helm.json new file mode 100644 index 0000000..e8c9147 --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-wordpress-helm.json @@ -0,0 +1,37 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.helm.v3+json", + "config": { + "mediaType": "application/vnd.cncf.helm.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 0 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.relationship": "references", + "oci.distribution.artifact": "wordpress:5.7" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.relationship": "references", + "oci.distribution.artifact": "mysql:8" + } + } + ] +} \ No newline at end of file diff --git a/artifact-manifest/option-a/artifact-manifest-wordpress-image-signature.json b/artifact-manifest/option-a/artifact-manifest-wordpress-image-signature.json new file mode 100644 index 0000000..dba2e46 --- /dev/null +++ b/artifact-manifest/option-a/artifact-manifest-wordpress-image-signature.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": 2, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 120 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724, + "annotations": { + "oci.distribution.relationship": "depends-on" + } + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-mysql-image-sbom.json b/artifact-manifest/option-b/artifact-manifest-mysql-image-sbom.json new file mode 100644 index 0000000..157adb6 --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-mysql-image-sbom.json @@ -0,0 +1,28 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.openssf.sbom.v1+json", + "config": { + "mediaType": "application/vnd.openssf.sbom.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "openssf.sbom.author": "mysql" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-mysql-image-signature.json b/artifact-manifest/option-b/artifact-manifest-mysql-image-signature.json new file mode 100644 index 0000000..1848120 --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-mysql-image-signature.json @@ -0,0 +1,28 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 102 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature copy.json b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature copy.json new file mode 100644 index 0000000..41424cd --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature copy.json @@ -0,0 +1,27 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature.json b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature.json new file mode 100644 index 0000000..41424cd --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab-signature.json @@ -0,0 +1,27 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 1303 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-wordpress-cnab..json b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab..json new file mode 100644 index 0000000..d573d64 --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-wordpress-cnab..json @@ -0,0 +1,36 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.cnab.v1+json.", + "config": { + "mediaType": "application/vnd.cncf.cnab.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 134 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [], + "references": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.artifact": "helm-cli:3" + } + }, + { + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress-chart:v5" + } + } + ] +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-wordpress-helm.json b/artifact-manifest/option-b/artifact-manifest-wordpress-helm.json new file mode 100644 index 0000000..496ab8d --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-wordpress-helm.json @@ -0,0 +1,36 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.manifest.v1+json", + "artifactType": "application/vnd.cncf.helm.v3+json", + "config": { + "mediaType": "application/vnd.cncf.helm.config.v1+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 0 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [], + "references": [ + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:5c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c82", + "size": 1510, + "annotations": { + "oci.distribution.artifact": "wordpress:5.7" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.config.v1+json", + "digest": "sha256:8c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c31", + "size": 1578, + "annotations": { + "oci.distribution.artifact": "mysql:8" + } + } + ] +} \ No newline at end of file diff --git a/artifact-manifest/option-b/artifact-manifest-wordpress-image-signature.json b/artifact-manifest/option-b/artifact-manifest-wordpress-image-signature.json new file mode 100644 index 0000000..e6fffcd --- /dev/null +++ b/artifact-manifest/option-b/artifact-manifest-wordpress-image-signature.json @@ -0,0 +1,28 @@ +{ + "schemaVersion": 1, + "mediaType": "application/vnd.oci.artifact.collection.v1+json", + "artifactType": "application/vnd.cncf.notary.v2+json", + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7", + "size": 120 + }, + "blobs": [ + { + "mediaType": "application/tar", + "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0", + "size": 32654 + } + ], + "manifests": [ + { + "mediaType": "application/vnd.oci.image.index.v1.config+json", + "digest": "sha256:3c3a4604a545cdc127456d94e421cd355bca5b528f4a9c1905b15da2eb4a4c6b", + "size": 16724 + } + ], + "references": [], + "annotations": { + "org.cncf.notary.v2.signature.subject": "docker.io" + } +} \ No newline at end of file