Add OCI artifact support to generic prefetcher

[cfergeau]

Requested new feature or change

We currently uses oras and OCI artifacts to build artifacts in a konflux pipeline, and reuse these artifacts in another pipeline. If we switch to hermetic builds, there is no easy way of prefetching these artifacts, having support for OCI artifacts in hermeto would help. It might even be possible to fetch SBOM details at the same time if these are available.

NB: I’m mentioning the generic prefetcher here, but a dedicated OCI prefetcher would also be good.

[eskultety]

@cfergeau thanks for reaching out. Yeah, I can see how OCI artifacts can become increasingly popular in various scenarios. I don't know when we'll get to this, but the least I can say is that this makes sense for us to investigate and consider the options at some point.

[eskultety]

@cfergeau hmm, out of curiosity, can you enumerate a list of limitations where the generic backend falls short for your needs?

[cfergeau]

@cfergeau hmm, out of curiosity, can you enumerate a list of limitations where the generic backend falls short for your needs?

During konflux builds, we have easy access to a container registry for pushing the artifacts we built, so it makes sense to use this. The generic prefetcher only support https URLs (I think?), and I don’t know if we can easily get a https:// URL to fetch artifacts we pushed to a registry? I also don’t know if as an alternative, konflux gives us a https location where we can easily publish our artifacts.

[vyasgun]

I found a related issue about adding support for oci:// URLs in rpm lockfile: #1080. I think the OCI pull/verify logic could be shared between the RPM and generic fetchers.

[eskultety]

I found a related issue about adding support for oci:// URLs in rpm lockfile: #1080. I think the OCI pull/verify logic could be shared between the RPM and generic fetchers.

Adding OCI capabilities to RPMs seems unlikely at least at the moment. That backend will be replaced with a DNF one instead.

[vyasgun]

Noted - adding OCI support in rpm lockfiles is not a priority. However, for our specific Konflux use case and security goals, it is important to have a way to prefetch these verified konflux built OCI artifacts instead of referencing GitHub release URLs.

[AKUMA-creator-ng]

Hey! I saw your issue about SBOM support and wanted to share a tool that might help.

I built VulnLedger — it generates CycloneDX SBOMs from your dependencies and scans for vulnerabilities in one command:

pip install vulnledger
vulnledger scan .

It supports 20+ ecosystems (Python, npm, Go, Maven, Cargo, etc.) and produces compliance-ready SBOMs for EU CRA, FDA, and NIST SSDF.

Free CLI, no account required. Web dashboard for teams from $19/mo.

Happy to help integrate this into your workflow if useful!

[eskultety]

However, for our specific Konflux use case

@vyasgun please kindly note this project is trying to be an independent project generally consumable by any pipeline solution, Konflux is just one of potentially more consumers. :)