Part 1: What the Registry Already Knows

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

OCI registries already let a second artifact — a signature, an SBOM, an attestation — attach to a first one without touching its digest. As of July 2026, most registries only implement half of that mechanism, and almost no edge deployment uses the half that exists.

Read on javatask.dev ↗