Jon Johnson

> We might be able to do this without a flag, e.g. by checking for TestGoFiles instead of IsCommand here. I think you could just do this part and it...

> It certainly please you to learn that I (albeit for different reasons) already changed to "two-step" monolithic uploads > > Already done, too :-) > > will do :-)...

> Let us know if you're interested in working on it and we can help get you started. I can take a stab at it if you can point me...

As an example: ``` $ curl -L https://packages.wolfi.dev/os/aarch64/renovate-37.151.0-r0.apk | tar -Oxz var/lib/db/sbom/renovate-37.151.0-r0.spdx.json > sbom.spdx.json $ wc -c sbom.spdx.json 36350622 sbom.spdx.json $ cat sbom.spdx.json | jq '.files[]' -c | wc -l...

I've update the PR with changes from @paulgibert that seem better than what I came up with :)

How would you feel about something like this instead? https://github.com/spdx/tools-python/pull/800 I suspect just changing those function signatures is probably not what we want to do (I assume it's a breaking...

I think this would be great to add as an option/flag, but I'm reluctant to make it the default. We want building (and rebuilding) images to be fast during development...

> But I have no idea if the ecosystem of where images are executed can support that. I feel like the major runtimes (containerd, mostly) probably already support zstd, but...

To add a little context, when attempting a cross-repository mount from a non-existent source repository (the `from` parameter), harbor fails and returns a 401 with `UNAUTHORIZED: project examplegroup not found:...

It seems like this only affects `docker-credential-gcr gcr-login` invocations that set `-no-browser`? And there's no other alternative for desktop applications (if I'm reading [this](https://developers.google.com/identity/protocols/oauth2/native-app#manual-copypaste) right) besides using the browser flow....