►
From YouTube: It’s Complicated: Relationships Between Objects In OCI Registries - Josh Dolitsky & Sajay Antony
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
It’s Complicated: Relationships Between Objects In OCI Registries - Josh Dolitsky, Chainguard & Sajay Antony, Microsoft
Speakers: Josh Dolitsky, Sajay Antony
The limitations of the current OCI spec are causing people to come up with all sorts of wild hacks to connect objects in a registry. For example, tools like cosign push image signatures to the registry using a long, cryptic tag suffixed with “.sig”. There must be a better way! To solve this issue, all of the major registries have come together to form the OCI Reference Types Working Group. This group has been tasked with determining how to describe and query relationships between objects stored in an OCI registry. This means potential changes to the registry HTTP API (distribution-spec) and/or associated JSON schema (image-spec). Josh and Sajay will describe the ways in which the OCI plans to address these topics with backwards compatibility in mind. Beyond the technical details, hear about various challenges and techniques used within the working group to successfully bring people together to agree on changes to a critical spec that hasn’t been modified for years.
A
A
How
do
you
connect
different
things
inside
of
a
registry?
So,
if
you're,
if
you're
in
this
space
or
if
you're
in
this
talk
right
now
in
this
room,
you
probably
know
that
people
have
been
putting
things
into
Registries
in
questionable
ways
and
that's
an
issue
because
tooling
doesn't
know
how
to
work
with
that,
and
so
so
it's
really
a
two-part.
It's
really
a
two-part
issue.
One
is
what
I
just
said:
how
do
you
get
a
list
of
these
things
that
point
to
an
image?
A
How
do
you
find
out
basically
given
an
image?
What
are
the
s-bombs
that
point
to
it
signatures
or
anything
else?
Really,
you
can.
You
should
be
able
to
attach
any
type
of
metadata
without
modifying
the
digest
of
an
image,
because
that's
what
makes
you
know
container
Registries
secure
and
let
you
know
that
nothing
has
been
tampered
with,
so
always
use
digests.
A
So
exactly
how
are
we
going
to
get
this
list
in?
The
second
part
of
that
question
is
like
an
implied
it's
it's
kind
of
implied
of
like
you
know
there.
People
are
putting
these
things
in
here,
but
how
do
you
actually
do
that?
How
are
you
supposed
to
do
that
in
a
way
that
has
sort
of
been
blessed
by
the
open
container
initiative
and
is
like
the
recommended
approach,
because
there's
been
a
few
different
ways
and
some
are
trying
to
be
change.
A
A
I
can't
see,
and
then,
but
how
do
we
actually
do
that
with
the
community,
and
so
you
know
for
the
people
here
who
have
worked
in
open
source?
You
can
you
know
that
there's
a
people
that
the
harder
part
is
working
with
people.
Anyone
can
write
an
amazing
API
and
an
amazing
tool.
But
how
do
you
get
people
to
agree
on
it?
So
we
broke
it
down.
A
This
talk
into
two
parts
with
the
speakers,
so
I
will
be
talking
about
number
two,
because
to
me
that's
that's
actually
the
interesting
thing
here.
If
you
want
to
step
out
and
get
a
coffee
and
come
back
in
about
10
minutes,
you
can
see
the
code
and
that's
when
Sanjay
will
appear
on
the
screen,
then
so
a
lot
of
people.
A
A
lot
of
people
are
acutely
aware
of
issues
in
oci,
but
it
really
helps
to
paint
a
picture
of
why
oci
is
the
way
that
it
is
so
there's
context
to
which
or
like
there's
things
to
which
I
do
not
have
the
context.
But
there
are
several
people
in
the
oci
community
who
have
been
around
for
several
years
from
the
beginning
really
and
they
still
attend
the
calls
and
every
time
you
bring
up
well
what
what's
going
on
here.
A
They
kind
of
all
just
kind
of
you
know
just
kind
of
like
rub
their
heads
and
it
comes
down
to
the
reason
oci
exists
is
so
people
wouldn't
Sue
each
other.
It
really
is
I
mean
like
Docker
was
doing
things.
Core
OS
was
doing
things
and
something
happened
where
someone
needed
some
legal
something,
and
so
then
the
oci
existed
and
we
codified
all
the
things
that
Docker
did
to
make
it
an
open
standard,
and
so
it
wasn't
just
Docker
that
gets
to.
A
The
registry,
like
the
docker
registry,
if
you,
if
you
are
familiar
with
that
project,
it's
called
distribution,
it's
a
cncf
project.
Now
that
was
then
turned
into
a
spec
in
2018,
and
that's
a
little
bit
after
that
is
around
the
time
that
I
got
involved
in
this.
So
I
kind
of
come
into
this
and
I'm
really
confused.
Why
it's
very
slow,
but
it
really
helps
to
understand
that
it.
A
A
A
It's
really
actually
one
of
the
pieces
in
technology
that
it
it
really
is
ubiquitous
and
and
works,
works
well,
so
kind
of
a
lot
of
the
the
reasons
why
people
don't
like
to
move
things
is
because
like
why
would
you
break
it
or
why
would
you
fix
it
if
it
ain't
broken
and
then
also
there's
competition?
There's
there's
quite
a
bit
of
and
I,
don't
think
this
is
specific
to
oci,
but
kinda
Maybe.
A
A
The
other
thing
is
that,
even
if
you
don't
codify
it,
things
end
up
doing
this
anyway.
So
you
know
these
these
three
tools-
Scorpio
or
us
and
cosine
in
varying
degrees
in
different
ways.
They
have
the
ability
to
kind
of
either
publish
non-container
things
to
a
registry
or
attach
them
together,
and
then
these
things
get
used
by
ecosystem
tools.
So
a
great
example
is
Homebrew.
A
What's
what's
the
proper
way
to
do
this,
one
note
on
cosine
and
I
only
bring
it
up
because
it
was
mentioned
in
the
talk
description
is
that
cosine
is
like
a
fantastic
tool
and
it
has
solved
all
these
problems,
but
really
it's
it's
doing
a
hack
on
the
current
oci,
specs
and,
of
course
like.
If
the
image
on
the
right
is
like
from
GitHub
registry
page,
where
you've
pushed
a
bunch
of
signatures.
You
end
up
with
these
bizarrely
names.
A
A
If
you
want
to
go
on
GitHub
and
read
the
series
of
historical
content
of
why
this
all
happened,
you
can
I,
don't
recommend
it,
but
at
some
point
in
time
there
is
conversations
and
discussions
and
suggestions
and
the
Tob
of
oci
decided.
Let's
do
a
working
group
to
finally
fix
this,
because
there's
camps
over
here
that
want
to
do
this
way
camps
that
want
to
do
this
way.
A
So,
with
the
help
of
Linux
foundation's
legal
team,
they,
you
know,
put
the
right
words
into
the
charter,
which
remember
was
really
created
to
prevent
people
from
suing
each
other
so
like
we
want
to
still
prevent
that,
and
so
they
helped.
You
know
organize
us
to
be
able
to
do
this
and
then
so
that
was,
let
me
see
from
May
to
August.
A
A
And
then
we
ended
up
on
a
zoom
call
and
we
were
kind
of
like
what
do
I
do
here
now
and
Lachlan
who's
from
Microsoft
had
a
fantastic
idea
where,
on
the
call,
we
all
sit
down-
and
we
say
what
do
I
think
I'm
here
to
do
right
now
and
we
wrote
These
down
and
we
finally
came
to
consensus
on
what
we're
here
to
do,
and
that
was
that
first
slide,
which
is
proposed.
How
to
describe
and
query
relationships
between
objects
stored
in
an
oci
registry.
A
A
A
So
that
worked
out
pretty
well
and
within
a
few
weeks
we
had
we
had
four
proposals
on
the
table
and
they
were
all
kind
of
similar
with
the
exception
of
D,
which
was
like,
let's
just
do
cosine
and
people
like.
Obviously
that
was
it
wasn't
like
you
know
it
was
a
legitimate
proposal,
but
obviously
we
formed
a
working
group.
So
that's
not
what
we're
going
to
do,
but
cosine
did
do
things
in
an
interesting
way
and
you
know
it
it's
working,
so
maybe
don't
try
to
break
it.
A
But
again,
there's
a
reason
we're
here.
After
that
we
were
kind
of
like
you
know.
There
are
parts
of
all
of
these
that
we
like
and
they're
actually
pretty
similar.
So
let's
combine
them
and
a
big
shout
out
to
Brandon
Mitchell,
who
first
of
all
just
did
a
lot
in
this
group,
but
put
together
this,
which
was
a
combination
of
all
of
them
kind
of
took
the
best
of
it
and
we
were
and
then
we
were
ready
to
go
and
it
was
we
were
celebrating.
A
We
were
popping
champagne,
actually
not
yet,
but
so
we
we
decided
we're
going
to
do
e
and
then
all
of
a
sudden
kind
of
out
of
the
woods
comes
proposal.
F,
which
is
sort
of
like
also
don't
do
anything
but
like
abuse,
oci
in
a
different
way,
and
there
was
value
to
that
and
it
had
support
from
the
the
docker
team,
and
so
we
were
kind
of
like
in
this.
A
Like
kind
of
we
were
kind
of
like
we
thought
we
had
it
down,
and
then
it
got
to
this
one
and
we're
all
kind
of
looking
around
the
room.
Like
oh,
come
on
now
we're
here
again,
so
we
came
up
with
this
idea
where
you
will
vote
on
we'll
just
gonna,
say:
Okay,
ER,
F,
all
right
and
we'll
just
do
democracy,
and
you
know
people
thought
that
would
you
know,
be
abused
and
make
a
bod
and
I'd
vote
for
like
it.
A
Just
never
happened
like
people
were
pretty
Cooperative
with
this,
and
so
we
open
up
an
issue
and
say:
hey
put
a
thumbs
up
on
this
one.
If
you
want
e
thumbs
up
on
this,
one
for
f
and
E
ended
up
having
majority
of
support.
So
finally
we
got
to
that
point
and
from
there
this
is,
you
know
it
was
kind
of
like
all
right.
We
have
the
proposal,
but
how
do
we
get
this
in
a
form
that
we
can
give
it
to
oci?
A
One
of
the
other
things
that
we
did
is
we
created
an
organization
called
oci
playground?
No
one
has
sued
us
for
this.
Yet,
but
basically,
we
gave
admin
to
anyone
who
was
involved
in
the
working
group,
and
we
just
like
over
the
course
of
like
two
months
staged
these
PRS
and
did
PRS
in
the
fork
to
come
up
with
what
we
would
finally
submit
to
the
oci.
Like
main
branch.
B
B
We
had
gathered
a
lot
of
feedback
and
it
was
the
collaboration
from
the
different
community
members
that
made
this
possible
before
I
jump
into
the
specification
details.
I
would
like
to
thank
Brandon
Mitchell,
who
had
created
the
initial
set
of
diagrams
that
were
used
during
the
calls
to
kind
of
like
even
talk
through
them
and
I'm.
Basing
my
content
of
that
and
now,
let's
jump
into
the
specification
details.
B
Let's
start
with
the
tag,
a
tag
or
a
reference
to
an
image,
typically
points
to
an
image
manifest
or
an
image
index.
The
index
is
a
collection
of
manifests
of
different
platforms,
and
whereas
the
image
manifest
itself
is
a
definition
of
what
an
image
is,
it
encapsulates
things
like
layers
and
the
config
of
the
image
we
needed
a
way
in
which
we
could
Define
another
type.
B
B
B
B
B
B
B
B
We
have
an
image,
the
artifact
associated
with
the
image,
and
we
create
a
link
using
the
OCR
artifact
manifest,
and
we
attach
them
using
the
subject
property.
We
could
go
ahead
and
attach
more
and
more
of
these
to
that
specific
image.
But
now
the
next
interesting
question
is:
how
do
we
actually
access
these
things
that
are
attached
to
that
that
digest?
So
for
that
the
distribution
spec
has
a
new
API
called
the
reference
API
you
can
think
of
it
as
an
API
in
which
you
can
query
for
relationships
to
that
specific
digest.
B
You
can
see
that
it
follows
the
specification
of
the
image
index
and
this
is
important
because,
as
you
would
see
in
the
fallback,
the
same
similar
specification
or
the
index
objects
is
used
to
link
the
objects
as
well.
And
if
you
pay
attention
to
it,
it
stores
an
image
manifest
and
an
artifact
manifest,
and
the
response
would
actually
enable
us
to
link
different
types
of
artifacts
together.
B
B
And
let's
go
ahead
and
attach
it
to
another
text
file.
Do
that
so
now
you
have
another
manifest
that
was
created
if
I
go
ahead
and
query
the
reference
API
this
time,
I
see
that
there
are
two
manifests,
the
one
and
so,
as
you
keep
attaching
more
and
more
content,
this
API
will
return
you
all
the
linked
artifacts
to
that
hello
world
latest
manifest
now
for
making
sure
that
you
don't
get
everything.
B
The
specification
also
supports
introducing
a
filtering
of
that
specific
artifact
type.
So
you
can
ask
it
show
me
only
the
signatures
or
show
me
only
the
artifacts
that
are
of
this
specific
type
and
pagination
is
by
a
standard
link
header
as
well
all
right.
So
now,
let's
get
to
how
do
you
use
this
today?
B
B
A
couple
of
things
that
we
want
to
keep
in
mind
is
the
fallback
has
to
use
an
image
manifest
for
achieving
similar
results
and,
as
I
spoke
before,
the
reference
response
is
a
dynamically
generated
index
and
instead
we
depend
on
a
statically
client
created
index.
For
this.
Let's
see
that
in
action
now.
B
B
The
fallback
specification
describes
how
we
can
use
an
image
manifest
to
construct
an
artifact
and
push
that
to
the
registry,
and
it
also
talks
about
how
you
can
use
a
digest
tag
that
would
describe
a
response
very
similar
to
the
referrals
API
now
for
this
I'm
going
to
be
using
a
client
called
red
CTL.
That
has
support
for
this
fallback
part
of
the
specification
so
for
the
what
I
can
do
is
I
can
now
push
an
artifact
that
has
the
subject,
which
is
the
image
that
we
just
copied.
B
B
As
you
can
see,
this
is
an
image
manifest.
It
has
a
config
media
type
that
maps
to
the
artifact
tag
that
we
specified.
It's
got
the
layers
of
the
cap
picture
and
the
subject
is
the
subject
of
the
image
that
we
had
initially
copied.
So
you
can
see
that,
even
though
the
registry
does
not
have
the
support
for
the
reference
API,
you
can
use
a
digest
tag
to
formulate
a
manifest,
and
it
should
be
very
similar
to
how
the
reference
API
should
function,
and
this
can
be
done
all
on
the
client
side
today.
B
And
this
time
I'm
going
to
attach
the
text
file
we
attached.
Similarly,
and
if
we
were
to
look
at
the
tags,
we
see
that
we
still
only
have
the
single
digest
tag
so,
each
time
an
artifact
is
attached,
it
doesn't
change
the
dice
tag,
because
the
image
manifest
digest
is
the
same.
What
we
can
do
is
look
at
the
Manifest
that
now
what
this
digest
tag
points
to.
B
And
now
we
can
see
that
there
are
two
manifests
in
this
digest
tag
so
very
similar
to
how
the
reference
would
actually
return
all
the
attached
manifests.
We
can
clearly
see
that
the
clients
can
formulate
a
very
similar
index
and
push
them
today.
I
I
think
the
community
would
benefit
from
others.
Looking
at
the
specification,
giving
us
feedback
we're
very
grateful
for
all
the
contributors
to
making
this
happen
and
with
more
feedback.
I
hope
that
we
can
make
this
even
better.
B
I
also
hope
that
we
see
operators
rolling
this
out
so
that
the
Manifest
API
and
the
referrals
API
can
be
used
to
attach
more
things
and
achieve
more
things
in
the
supply
chain
security
world
as
well,
and
it
helps
the
community
adopt
the
registry
as
a
standard
model
of
storage
as
well,
and
with
that
I
want
to
thank
everybody
for
the
contributions
that
you've
made
and
hope.
We
see
this
improve
over
time.
I
would
like
to
hand
it
back
to
you
Josh.
Thank
you.
A
A
Let's
hear
it
for
oci
yeah,
so
our
changes
were
accepted
and
yeah.
So,
basically,
all
we
have
left
to
do
is
cut
the
1.1
release,
we're
kind
of
working
out
a
few.
You
know
we
were
changing
words
here
and
there
we
want
to
get
conformance
tests
to
be.
You
know
to
let
you
know
which
Registries
support
this
new
stuff.
A
We
want
other
cncf
projects,
so
if
you're
a
maintainer
on
one
of
these
projects,
please
please
talk
with
oci.
We
somehow
have
our
own
slack
and
we
love
to
help
you
on
board
with
that,
and
also
just
this
was
kind
of
it
felt
Monumental
to
us,
even
though
we
added
just
one
API
endpoint.
So
thank
you
to
everyone.
I
know,
there's
several
of
you
in
the
room
today
and
just
you
know,
it
really
means
a
lot
to
see
this.
This
kind
of
all
come
together
after
many.
A
Many
actually,
several
years
of
you
know
kind
of
arguing
online
about
this,
and
thank
you
for
being
here
today
and
this
link
here
is
the
demo
that
Sanjay
gave
we
made
it.
You
know
you
can
just
run
those
Forks
of
orus
and
reg
CTL
in
a
container,
and
you
can
try
out
the
exact
exact
thing
of
the
demo
so
and
with
that
I
strategically
left
no
time
for
questions
and
thank
you.