We have found that skopeo/podman might, under certain conditions, create manifests that have negative layer sizes. These manifests are currently accepted by Quay (and possibly other registries) because our validation schema does not check layer size information, only that the manifest is properly formatted.

Quay should reject manifests with negative layer sizes and raise a 400 when that happens.