Daniel Messer

I think this is a useful feature. Do you see other candidates than env vars for this to be useful? I don't think the maintainers will have time soon to...

I've changed the "immutable" column in the tags table to a more generic status column which now tracks the immutability via a label. Mutable tags won't carry a label.

@bcaton85 Thank you very much for your thorough review. I addressed all the feedback, with the exception of that seemingly unused join (it is actually used). Regarding your observations: >...

@ibazulic Thanks for your comments. This is indeed a feature requested by users. The ability to suppress reported items is also very common in security tooling. The logic for Quay...

The feature can be disabled via a flag, or people can decide not to use it. It seems like your main points are that it could be used wrong and...

Should we maybe just add SigV4 support to the Ceph/RADOS driver and ensure there is a graceful fallback to Sigv2 when the storage does not support it? Ceph is definitely...

I'd propose to still have a CLI option for `skopeo sync|copy` as well as a YAML spec for `skopeo sync` to ease opt-in.

An option to enable/disable copy of cosign-style signature artifacts. `skopeo copy` copies a single manifest (list) and as a user I may not want to have to fiddle with an...

I strongly suggest configuring the secret names in the `QuayRegistry` custom resource. There is already a lot of precedent for component-based overrides. It would be great for continuity and intuitiveness...

If you are running on OpenShift, you can use `ImageContentSourcePolicy` to redirect those image pulls for `redis` and `postgres` to your own mirror of those images.