Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a warning about portability to artifact.md #1004

Closed
wants to merge 1 commit into from
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions artifact.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# OCI Artifact Manifest Specification

Implementations concerned with portability SHOULD NOT use the Artifact Manifest.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"portability" would need to be explicitly defined for discussing this PR further

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. I have in mind "portability" between 1.0 and 1.1 registries, so perhaps "backwards compatibility with OCI 1.0" is a better phrase? We could link to a section of image manifest describing its use for packaging non-container-image content.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with that messaging change. It should be OK for an implementation to decide its own destiny if they've already adopted OCI 1.0 image spec and they want to phase it out at a major version change, their compatibility story is their own business.

The same applies for all future versions, and in fact, all future image-spec types!

How about this in spec.md or in all manifest types?

Implementations that support creating alternative manifest types SHOULD NOT use the registry to determine the manifest type created.

@sudo-bmitch does that address your objection about non-deterministic behavior? I should be able to look at a tool like [email protected] and its command line arguments and know what it will produce. Tools that are clever and try to automatically fall back will end up surprising users.

And understanding @sudo-bmitch's concern, I'll also close this issue:

I don't think it's a good idea to specify fallback behavior any longer.

Copy link
Contributor

@AaronFriel AaronFriel Feb 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sudo-bmitch re:

I'm not sure that a warning is enough if OCI is tasked with portability and compatibility. I'm leaning towards saying that any tooling that produces the artifact manifest, without an experimental flag or some other end-user control

Such as a user intentionally upgrading to a new major version, i.e.: OCI client Foobarctl says "with major version v3, we default to artifact now and will fail on pushing to an OCI 1.0 registry. Opt out of this behavior by passing --oci-spec=v1.0"?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After the conversations yesterday, some kind of verbiage could be useful. Let's steer to something hand-wavy, but maybe

**Introduced**: v1.1.0

_Notice_: Introduction of new manifest types requires client and server features. As implementations adopt a new manifest type it may cause portability challenges with legacy tools or services.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the wording that @vbatts provides, with the addition that I'd like to include a "SHOULD NOT use" suggestion in there to stress our desire for portability.


The goal of the Artifact Manifest Specification is to define content addressable artifacts in order to store them along side container images in a registry.
Like [OCI Images](manifest.md), OCI Artifacts may be referenced by the hash of their manifest.
Unlike OCI Images, OCI Artifacts are not meant to be used by any container runtime.
Expand Down