Epic Goal

• Quay and Quay.io implement support for OCI references

Why is this important?

• The OCI Working Group proposal for references has been merged:
  • image-spec changes: opencontainers/image-spec#934
  • distribution-spec changes: opencontainers/distribution-spec#335
  • artifact manifest spec: https://github.com/opencontainers/image-spec/blob/main/artifact.md 
• It is very likely that use cases for these references appear in clients, such as creating relation between signatures or SBOMs and containerized software artifacts - Quay should support these as part of seeking OCI compliance

Acceptance criteria

1. Quay supports OCI artifact manifests and references as per the spec
2. Quay does not limit the artifact media types used
3. Quay implements the referrers API

Acceptance Criteria

• CI - MUST be running successfully with tests automated
• Release Technical Enablement - Provide necessary release enablement details and documents.
• ...

Related:

1. https://github.com/sigstore/cosign/issues/1397#issuecomment-1272141442

Done Checklist

• CI - CI is running, tests are automated and merged.
• Release Enablement <link to Feature Enablement Presentation>
• DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
• DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
• DEV - Downstream build attached to advisory: <link to errata>
• QE - Test plans in Polarion: <link or reference to Polarion>
• QE - Automated tests merged: <link or reference to automated tests>
• DOC - Downstream documentation merged: <link to meaningful PR>