OCI Artifacts to store signatures

[loresuso]

Question

Hello everybody,

Now that also docker has introduced support for OCI artifacts, I would like to know if there is an ongoing effort to store signatures as such, using the latest changes deriving from the work done by the Reference Types Working Group, who introduced subject field and referrers api to properly implement artifacts that refers to other ones like signatures.
I am seeing that also go-containerregistry is working on something, so maybe cosign could use it when it's done

Thank you!

[dlorenc]

cc @jdolitsky @imjasonh

We should be able to switch to storing signatures as OCI artifacts whenever now that Dockerhub has added support.

We're also planning to switch to the new reference types API and are prototyping it now!

[loresuso]

Nice, thank you @dlorenc !

[znewman01]

Duplicate of #1397