Downloading artifact leads to broken OCI image layout

[jastBytes]

Context
When running ocm download artifacts the directory structure is not adhering the OpenContainer Image Layout Spec.

Version
v0.32.0

To Reproduce
Steps to reproduce the behavior:

Run ocm download artifacts -O tmp/alpine-latest alpine:latest and validate the contents of directory tmp/alpine-latest/blobs.

Actual behavior
Blobs are not in a subdirectory for the sha256 but have a prefix and are located directly below /blobs.

Expected behavior
Blobs are located below /blobs/sha256 and have no prefix with the hash algorithm according to the standard, see https://specs.opencontainers.org/image-spec/image-layout/.

[jakobmoellerdev]

Heyho, I think you have encountered the desired behavior, but I agree that it is not nice.. From the ocm download artifact command

Description:

  Download artifacts from an OCI registry. The result is stored in
  artifact set format, without the repository part

  The files are named according to the artifact repository name.

  If the repository/registry option is specified, the given names are interpreted
  relative to the specified registry using the syntax

  <OCI repository name>[:<tag>][@<digest>]

  If no «--repo» option is specified the given names are interpreted 
  as extended OCI artifact references.

https://github.com/open-component-model/ocm-spec/blob/7bfbc171e814e73d6e95cfa07cc85813f89a1d44/doc/04-extensions/common/formatspec.md#artifact-set-archive-format

This comes from a time when OCI Layout was not officially set in OCI distribution spec. I believe we can add an option that formats the output as an OCI layout instead. While checking this issue however I noticed that there are some more discrepancies between spec and impl.
I will push this into some more validation and let you know here how we could proceed. Thanks for letting us know!

[trevex]

I just encountered this issue while testing OCM and wanted to add some context why this can be helpful and what use-cases it enables:

Even though attestations help securing the supply chain we still need to run checks when transfering artifacts between security domains. Adhering to the OCI layout would help running scanners such as trivy directly against the CTF.

[matthiasbruns]

Talked to @piotrjanik - he will lead this one