Brandon Mitchell

To rephrase the shared layer concern: layers aren't attached to a single image, they can be included in multiple images. So when runtimes share layers, the filesystem permissions and ownership...

Hi @adrianreber. From the description, I'm thinking an artifact containing the checkpoint, and a subject pointing back to the base image, might be a good model for this. That work...

@estesp good catch. You're right, if you are spanning repositories or registries, the subject/referrers is a bad match.

> One thing that we need to consider with respect to the base image is that if the base image has changed (e.g., has been updated or removed) the associated...

For portability, I'd hold back on using the artifact manifest. We only just merged that and I don't think there are any public registries that have added support. When pushing...

We've got some pictures in the `img` directory. The current method for building with code uses the dot file. There's a makefile entry for applying these. https://github.com/opencontainers/image-spec/blob/main/Makefile#L98 I'm fine with...

Pinging @opencontainers/image-spec-maintainers since this question is getting asked again.

~Holding this as a draft while looking into why the supported workflows don't have the expected checkboxes.~

It's not there today, but adding hooks to different stages of the copy has been in the design for a while. Identifying the kinds of hooks (executing commands and http...

> SLSA version 1.0 only had build levels 1-3 defined, because there were many challenges in working out how to define level 4. Maybe a separate track is the way...