Jason Hall

This is a known issue, add `--sbom=none` in the meantime until Quay.io is updated to accept these types by default. 🤷‍♂️

This might be available now? Does anybody feel like trying it out? 🙏

I'm going to close this issue, since I'm not sure there's a lot we can do until quay.io supports these types.

Hey @dmesser 👋 `ko` uses the sigstore-specified media types when pushing SBOMs. Previous versions of `ko` pushed `text/spdx`, but now push `text/spdx+json`, and IIRC push `application/vnd.cyclonedx+json` as well. If the...

Sure! My only real question is what do we want it to look like in `.ko.yaml`? A new top-level `repo:` field? Something else? Give me your ideas!

> Then I thought, how likely is it that multiple images should be pushed to different registries/locations? `ko` doesn't support this at all today. In the spirit of not scope-creeping...

What's your use case for wanting each image in a `ko resolve` to get different tags? 🤔 The typical use case for tags is associating images with a release (`:v1.2.3`),...

> oops, sorry. I'm interested in different tags for `ko publish` only. I was hoping I could generate/push multiple images with distinct tags. `ko build` only builds one image today...

Sounds good @developer-guy, thanks! We can discuss more specifics on the PR, or feel free to reach out if you have any questions.

This seems reasonable to me, I just don't know if any current maintainers have any time to prioritize it. Maybe if someone reading this feels like throwing together a PR...