Validate Container Images with OCI Specification

[chirangaalwis]

I encountered #738 which already requests for a tool which can validate a provided container image if it meets the OCI specification.

But the development of the tools in the GitHub Repository seems to have halted for the past 2-3 years.

Is it safe and up to date to use the tools defined in this issue to perform $subject? Or do we have any new recommendations?

Suggested Assignee
@cyphar

[cyphar]

The image-tools repository is still okay for validation (umoci uses it for validation in its integration tests).

The long-term plan is to migrate the image validation code from image-tools to https://github.com/opencontainers/umoci (which is maintained and is far more solid as an image tool than image-tools) and then archive the image-tools repo. Unfortunately I haven't gotten around to doing that yet.

However I would not use it for any other image operations -- please use umoci for those things (there are several long-standing bugs in image-tools which ended up motivating me to write umoci in the first place).

[chirangaalwis]

The image-tools repository is still okay for validation (umoci uses it for validation in its integration tests).

The long-term plan is to migrate the image validation code from image-tools to https://github.com/opencontainers/umoci (which is maintained and is far more solid as an image tool than image-tools) and then archive the image-tools repo. Unfortunately I haven't gotten around to doing that yet.

However I would not use it for any other image operations -- please use umoci for those things (there are several long-standing bugs in image-tools which ended up motivating me to write umoci in the first place).

@cyphar cool, thanks. I will try out image-tools for this, for now.

Appreciate if we can know when the transition happens. Also, it would be nice if a newbie to OCI details and concepts can be provided with a quickstart guide which can be used for aligning the container images to the specification. Please send any such documentation if already exists.

Plus, please let me know if I should keep this issue open to track the transition to umoci or close it.

[cyphar]

I've opened opencontainers/umoci#361 to track this.

[chirangaalwis]

@cyphar cool thanks. Closing the issue as per #823 (comment).