Jason Hall

> How much memory does it consume to use this? Good question. The whole csv.gz is `embed`ed [here](https://github.com/imjasonh/golicenses/blob/89ffd46a4f15309187ea0a8160288a68fedd0508/golicenses.go#L15) -- it's 3.6 MB zipped. The first time it's requested it's unzipped,...

Sorry, that was my fault, I meant to close it as "not planned".

I think in general we discovered there wasn't much user demand for the feature, even among our own usage. I wouldn't rule it out completely in the future, but emitting...

> if the referencing `subject` can only point at a manifest, then after the first `FROM`, the end user deployments can not easily discover them without traversing or something complicated....

I still haven't heard a strong use case for attaching manifests to blobs, and one didn't come up in the entire WG discussion about references. I'd like to reiterate my...

In theory there's nothing stopping you from including subpaths in your `image.source` value: ``` "org.opencontainers.image.source": "https://github.com/opencontainers/image-spec/path/to/sub/thing" ``` The spec language is pretty loose about how that's structured, it just says...

In general I interpret `source` and even `revision` as hints intended for humans, and not binding contracts for computers. If you happen to control both the producer and consumer of...

I'm not wholly opposed to adding the annotation key, but I would remove the example. The rest of the proposed meaning makes sense and is I think the the right...

I don't think it's a good fit for OCI to define an annotation for "are these the same thing" or "is this a replacement". The specifics of those statements are...

`crane` and `ko` have an `--insecure` flag, _and we hate it_. It conflates two things, "allow HTTP", and "allow HTTPS without verifying TLS", and users who only want one are...