Adopt OCI distribution spec v1.1.0

[wy65701436]

Since OCI has been released to v1.1.0-rc2, https://github.com/opencontainers/distribution-spec/releases/tag/v1.1.0-rc1, Harbor, as one of the OCI-compliant registries, should adopt the latest changes.

Mainpoints:

• Enabling the Referrers API
• Support the Subject descriptor

[github-actions]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[jkjell]

Not Stale 😄

[ChristianCiach]

This will probably also fix

• Treat cosign SBOM and Attestation artifacts as "accessories" #17630.

I've just compiled the current main branch of cosign that includes:

• Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag sigstore/cosign#2684

Unsurprisingly, this currently does not work with Harbor:

$ COSIGN_EXPERIMENTAL=1 COSIGN_OCI_EXPERIMENTAL=1 ./cosign attach sbom --registry-referrers-mode oci-1-1 --type cyclonedx --sbom sbom.json my-harbor.local/public/sbom-test:1.0.0 
WARNING: Attaching SBOMs this way does not sign them. If you want to sign them, use 'cosign attest --predicate sboms.json --key <key path>' or 'cosign sign --key <key path> --attachment sbom <image uri>'.
Uploading SBOM file for [my-harbor.local/public/sbom-test:1.0.0] to [my-harbor.local/public/sbom-test@sha256:690e15b4832f28d585e781bc98654efb027c4cfc71a4f5b6c36ebc6f7b819900] with config.mediaType [application/vnd.dev.cosign.artifact.sbom.v1+json] layers[0].mediaType [application/vnd.cyclonedx+json].
Error: GET https://my-harbor.local/v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357: UNAUTHORIZED: un-recognized request: GET /v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357: un-recognized request: GET /v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357
main.go:74: error during command execution: GET https://my-harbor.local/v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357: UNAUTHORIZED: un-recognized request: GET /v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357: un-recognized request: GET /v2/public/sbom-test/referrers/sha256:a2d975176cb5b5c8e7e84319a8884c5fa9a94b9c734cb310b99bd312f4d13357

[wy65701436]

@ChristianCiach please try with test main branch code, it works now.

[justinharringa]

@ChristianCiach please try with test main branch code, it works now.

Thanks for all of the hard work on this! Is there a target release for this change?

[MinerYang]

@ChristianCiach please try with test main branch code, it works now.

Thanks for all of the hard work on this! Is there a target release for this change?

Thanks for connecting with us.
We have a phase4 EPIC to track this adoption along with oci-spec been GAed recently.
Will have this fully supported in v2.11 release