Silvano Cirujano Cuesta

I cannot reproduce it. I have created an image with two layers and the manifest of the referrer providing the signature does not list them.

LGTM. We could then adapt some of the validations to be strict on w3curie.

Would it be possible to have something like w3safecurie too as a subtype of curie? That way we could have something like [URIorSafeCURIE](https://www.w3.org/TR/2010/NOTE-curie-20101216/#s_schema) too. [Update]: thanks @dalito for the link

> I don't have merge permissions -- @cmungall @sierra-moxon can you approve/merge? @ialarmedalien I can merge, but the (undocumented) policy says that only the core-team is allowed to merge. And...

> I'm with you on the lack of clarity on permissions that you talk about in your discussion! Then vote it up 😉 > I'd guess there hasn't been much...

> @Silvanoc good point about "thumbs up" vs. "votes". I think for a thumbs-up to count as a vote, it has to be on the issue description (i.e., the first...

This is the output my script gets in my system: ``` 2305d95df86d4c75f67a6058631d4f939924ca19f4627c6306e6577206c7349a 10+0 records in 10+0 records out 10485760 bytes transferred in 0.013827 secs (758353945 bytes/sec) Getting image source signatures...

I didn't get the expectation of cross-repository references out of the blue, but from the [OCI blog](https://opencontainers.org/posts/blog/2023-07-07-summary-of-upcoming-changes-in-oci-image-and-distribution-specs-v-1-1/#2-new-manifest-field-for-establishing-relationships). The first sentence of the linked section ends with "subject [...] points to...

@sneakers-the-rat you have been active lately in that part of the code. Could you please confirm the issue?

> aha, yeah well when i wrote that I didn't know that we were using those models for literals like enum values If a schema has something specified as `ifabsent:...