Add reference field

[dlorenc]

This accompanies a full proposal.

Fixes #827

Signed-off-by: Dan Lorenc dlorenc@google.com

[OR13]

this is the kind of place where multicodecs are useful https://github.com/multiformats/multicodec/blob/master/table.csv#L9

[SteveLasker]

This is largely a dupe of the oci.artifact.manifest proposal. The main difference here is the references property is placed on a descriptor, as opposed to being in the manifest. Contemplating how to track garbage collection on every descriptor is something we'd have to think about,
With the overview previously defined, I've added spec details:
opencontainers/artifacts#29

[dlorenc]

This is largely a dupe of the oci.artifact.manifest proposal. The main difference here is the references property is placed on a descriptor, as opposed to being in the manifest

I wouldn't really call it a dupe. They're complementary approaches with a few subtle but important differences. I've outlined those differences in the linked issue.

The main difference here is the references property is placed on a descriptor, as opposed to being in the manifest.

In my proposal it's placed on ALL the existing types. That means the descriptor, the manifest, and the index types, not only the manifest. The artifacts proposal only adds it to the proposed artifact type, IIUC.

[nishakm]

The reference seems to describe a 1:1 relationship with the descriptor and another mediaType. However there are situations where one needs to describe an n:1 relationship such as n SBoMs to one image or a 1:n relationship such as 1 artifact is linked to n other artifacts. Would a descriptor reference be able to handle this?

[nishakm]

"which is the subject of"

[nishakm]

Is a user supposed to read this as "this is the signature of the following manifest"? How would this work with "this is a list of SBoMs for the following manifest"? or "this is a list of signatures for the following manifest"?

[dlorenc]

FYI: I updated the tracking issue here with some details on testing/validation. I've been unable to break any clients with this so far, but I appreciate any help in trying!

[mikebrow]

It would be nice to have a single place in the spec where this feature is discussed... saying something like to add ___ capabilities.. the reference field was added to the base descriptor type. The following types inherit from descriptor.. ___ Thus the reference field is being added to these types. This allows ___.. Example:

[sudo-bmitch]

What is the use case of adding a reference to a descriptor? I understand it in the context of of a manifest or index object, but adding this field to the descriptor is creating lots of strange potential implementations where I'm not seeing the value add in present use cases. Is this being proposed in expectation of a descriptor as a manifest being approved, or are there other use cases?

[sudo-bmitch]

Closing this one since we've merged #934.