OCI Referrers API Implementation

[cfitzw]

Provide full support for the OCI Distribution Specification 1.1 Referrers API (GET /v2//referrers/).

The current fallback mechanism appears to work with clients such as ORAS, but native Referrers API support would provide the standards-compliant approach for discovering artifacts associated with an image, including signatures, attestations, SBOMs, and other OCI artifacts. This should include the relevant OCI-Subject behavior and return the standard OCI Index response.

Ideally, referrers should also be surfaced in the GitHub Container Registry UI, so users can discover and inspect related artifacts without needing ORAS or manually querying the registry. The existing fallback should remain supported for compatibility, but native OCI 1.1 support should be the primary path.

Reference:
https://opencontainers.org/posts/blog/2024-03-13-image-and-distribution-1-1/

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.