Steve Lasker

Hey @lumjjb, > Signing a manifest would be difficult if it is designed to keep changing (if I understood the proposal correctly). Are you inferring it can keep changing because...

> validity of a manifest would be based on some value in the metadata The Notary v2 model signs the digest of the manifest, which is why it's so important...

Hi @cmoulliard, Can you tell us a bit about what use cases you’re looking for?

ahh, I see. The build pack reference. I’ll read through the above PR. This PR wound up getting paused as it has some challenges. We have started implementing an evolution...

I believe the questions are: **Q:** if a group creates an artifact, (aka helm), with a specific `config.mediaType`, how can they know they won't get broken in the future? **A:**...

riffing a bit more: One of the values of an OCI distribution based service is the named/content addressable storage. The blobs are details, but not the “human” interaction model registry.io/namespace/artifact:tag...

It’s getting closer. We do have this general request for curling urls from a few folks, including some internal Azure teams. I’m trying to find a way to meet the...

Can I ask why we're concerned here? While it's true that a plane spends most of its time flying, it's pretty important it can land and take off. While it's...

I guess this really goes back to the requirements conversation. What do we consider the purpose of the distribution-spec is? How can you distribute something if you can't first load...

> I'm somewhat worried that if we make everything mandatory The conformance tests break this down into 4 categories today (push, pull, content discovery, content management) https://github.com/opencontainers/oci-conformance/tree/master/distribution-spec The question we're...