OCI Artifact

Every OCI Artifact is identified by a cryptographic digest (SHA-256) of its manifest, not just a mutable tag. This provides immutable, tamper-evident storage where any modification to the artifact's layers or configuration produces a completely different digest. The manifest references individual layers by their own digests, creating a Merkle DAG that guarantees end-to-end data integrity. This is the foundation for non-repudiation in software supply chains.

Unlike container images locked to application/vnd.oci.image.manifest.v1+json, OCI Artifacts use custom IANA media types to declare their content format. Examples include:

• application/vnd.cncf.helm.chart.config.v1+json for Helm charts
• application/vnd.wasm.config.v1+json for WebAssembly modules
• application/vnd.oci.image.manifest.v1+json for traditional images This allows registries to polyglot store any artifact type while enabling type-specific policy enforcement and scanning.

OCI manifests support an annotations map—arbitrary key-value string pairs—that attach metadata directly to the artifact without modifying its content. Common annotations include:

• org.opencontainers.image.source: link to source repository
• org.opencontainers.image.vendor: publisher identity
• Custom keys for SBOM references, signing status, or model card pointers Annotations are indexed by registries, enabling discovery and filtering without pulling the full artifact.

The Referrers API (OCI Distribution Spec v1.1) enables artifacts to link to other artifacts, forming a supply chain graph. A container image can point to its SBOM, signature, and vulnerability scan result as separate, independently signed artifacts. This creates an attestation ecosystem where:

• Cosign signatures are stored as referrers
• SBOMs are linked via subject field
• Policy engines traverse the graph for binary authorization decisions

ORAS (OCI Registry As Storage) is the de facto CLI and library for managing non-container OCI Artifacts. It extends docker push/pull semantics to arbitrary content:

bashCopy
oras push registry.example.com/models/llama:7b \
  --artifact-type application/vnd.ai.model \
  model.safetensors:application/octet-stream

ORAS handles manifest creation, layer compression, and multi-arch indexing, making it the universal client for model registries, Helm repositories, and WASM stores.

Registries supporting OCI Artifacts can enforce immutable tags, preventing a tag like v1.0 from being overwritten with a different digest. Combined with digest-based pulling (registry.example.com/model@sha256:abc...), this guarantees that a deployment always fetches the exact, verified artifact. This is critical for reproducible ML pipelines where model weights must be cryptographically pinned to a specific version for auditability and rollback.