ORAS: Create and Distribute a Multi-platform Image with Secu...

on YouTube ↗05m

" summary

ORAS CLI builds a single OCI reference that combines AMD64 and ARM64 images by creating a manifest index locally, then pushes that multi-platform artifact to an OCI registry (demo uses GitHub Packages). It attaches provenance artifacts — SBoM and signatures — and supports air-gapped/local workflows so images are created and verified without remote-only build steps. The demo shows two architecture variants produced, indexed, pushed, and visible in the registry.

AI-written summary · about

" related talks

• 40mDistributing Supply Chain Artifacts with OCI & ORAS ArtifactsSteve Lasker · KubeCon + CloudNativeCon Europe 2022
• 49mORAS: Powering the next generation of Cloud NativeAndrew Block · DevConf.US 2024
• 44mModifying the Immutable: Attaching Artifacts to OCI ImagesBrandon Mitchell · ContainerCon @ Open Source Summit North America 2023
• 29mBuilding Signing, Distributing SPDX SBOMs as Artifact Reference TypeJustin Cormack, Steve Lasker · Supply Chain Town Hall 2021
• 36mModifying the Immutable: Attaching Artifacts to OCI ImagesBrandon Mitchell · CloudNativeSecurityCon North America 2023
• 36mContainer Images & Security 101: 5 Need to Know FactsPhil Estes · CloudNativeSecurityCon North America 2024
• 36mIt’s Complicated: Relationships Between Objects In OCI RegistriesJosh Dolitsky, Sajay Antony · KubeCon + CloudNativeCon North America 2022
• 50mMastering Modern Software Distribution: On-Prem, Air-Gapped, and BYOC ChallengesPhilip Miglinci · DevBcn 2025