Jason Hall

This change looks good to me! Can you rebase so that CI runs and I can approve and merge? 👍

There's an important distinction between labels and annotations. OCI recommends these annotations, but AIUI images in the daemon can't (currently?) be annotated, only labeled. Talking to @ekcasey about this a...

> @imjasonh - updated to annotations conditional on the registry. Thanks, this looks great to me. 👍

It's not a great answer, but `ko_image` resources are cheap and disposable -- can you change the name of the `ko_image` resource to something new, so `terraform plan` considers it...

Is there anything we might want `ko_image` to do if it can tell that the ECR repo has immutable tags? ``` resource "ko_image" "image" { image_tag_immutability = aws_ecr_repository.foo.image_tag_immutability } ```

@jonjohnsonjr makes a good point that we should have a `descriptor` type that encompasses `digest`+`size` and all the other [descriptor fields](https://pkg.go.dev/github.com/google/go-containerregistry/pkg/v1#Descriptor). I think we probably want a `media_type` type that...

After https://github.com/chainguard-dev/terraform-provider-oci/pull/6 we have most of the types/schemas we need. That adds an internal [`Manifest.FromDescriptor(*remote.Descriptor)`](https://github.com/chainguard-dev/terraform-provider-oci/blob/86da26cb49740c08ad07e53c629ea30b2c5718c6/internal/provider/types.go#L29), which we can either: 1. make external and do a `remote.Get` on the just-pushed image...

> The only thing that gives me pause is it's not very transparent; if it was a bash script it's a lot easier to see what's going on. I think...

Sorry I missed this message! Yeah @erikaheidi any changes you think we should make, send a PR and I'll take a look. If there are more tests we can add...

Should we have one (or both?) of those packages do a `no-provides` so Melange SCA doesn't try to detect and report that `cmd`? Do they both provide the _same_ `cmd=vlan=1.4.0-r1`?...