go-containerregistry
go-containerregistry copied to clipboard
Include manifest in the v1 tarball? Or latest OCI image-spec?
Per #255 and the reference PR, support for v1 tarball was added, which steps in this direction. However, it does not include multiple blobs, or the original manifest or index, which the spec at https://github.com/opencontainers/image-spec/blob/master/image-layout.md does do. This breaks the confirmation of software supply chain a little, makes it hard to see the entire piece.
For now, I have been hacking the v1 tar file by adding the original manifest after pulling, but I would far prefer to follow the spec.