feat: add OCI 1.1 Referrers API support with configurable distribution and serialization

Signed-off-by: Anitha Natarajan <anataraj@redhat.com>

Author: anithapriyanatarajan

docs/config.md

@@ -69,6 +69,9 @@ Supported keys include:
 | `storage.gcs.bucket`                             | The GCS bucket for storage                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |         |
 | `storage.oci.repository`                         | The OCI repo to store OCI signatures and attestation in                                                                                                                                                                                                                                                             | If left undefined _and_ one of `artifacts.{oci,taskrun}.storage` includes `oci` storage, attestations will be stored alongside the stored OCI artifact itself. ([example on GCP](../images/attestations-in-artifact-registry.png)) Defining this value results in the OCI bundle stored in the designated location _instead of_ alongside the image. See [cosign documentation](https://github.com/sigstore/cosign#specifying-registry) for additional information. |         |
 | `storage.oci.repository.insecure`                | Whether to use insecure connection when connecting to the OCI repository                                                                                                                                                                                                                                            | `true`, `false`                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false` |
+| `storage.oci.distribution-method`               | Controls how OCI signatures and attestations are attached to images in the registry. See [OCI Storage Formats](oci-storage-formats.md) for details.                                                                                                                | `legacy`, `referrers-api`                                                                                                                                                                                                                                                                                                                                                                                                                                           | `legacy` |
+| `storage.oci.serialization-format`              | Controls how the cryptographic payload is encoded. `protobuf-bundle` requires `storage.oci.distribution-method: referrers-api`. See [OCI Storage Formats](oci-storage-formats.md) for details.                                                                    | `dsse`, `protobuf-bundle`                                                                                                                                                                                                                                                                                                                                                                                                                                           | `dsse`   |
+| `storage.oci.legacy-fallback`                   | When `storage.oci.distribution-method: referrers-api`, verifies referrer persistence and falls back to legacy tag-based storage if the registry did not persist it. See [OCI Storage Formats](oci-storage-formats.md) for details.                               | `true`, `false`                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `false`  |
 | `storage.docdb.url`                              | The go-cloud URI reference to a docstore collection                                                                                                                                                                                                                                                                 | `firestore://projects/[PROJECT]/databases/(default)/documents/[COLLECTION]?name_field=name`                                                                                                                                                                                                                                                                                                                                                                         |         |
 | `storage.docdb.mongo-server-url` (optional)      | The value of MONGO_SERVER_URL env var with the MongoDB connection URI                                                                                                                                                                                                                                               | Example: `mongodb://[USER]:[PASSWORD]@[HOST]:[PORT]/[DATABASE]`                                                                                                                                                                                                                                                                                                                                                                                                     |         |
 | `storage.docdb.mongo-server-url-dir` (optional)  | The path of the directory that contains the file named MONGO_SERVER_URL that stores the value of MONGO_SERVER_URL env var                                                                                                                                                                                           | If the file `/mnt/mongo-creds-secret/MONGO_SERVER_URL` has the value of MONGO_SERVER_URL, then set `storage.docdb.mongo-server-url-dir: /mnt/mongo-creds-secret`                                                                                                                                                                                                                                                                                                    |         |
@@ -90,6 +93,8 @@ Supported keys include:
 >
 > **Recommendation**: Only use `storage.oci.repository.insecure: true` in development or test environments. For production deployments, always use secure HTTPS connections with valid TLS certificates (`storage.oci.repository.insecure: false`, which is the default).
 
+For a full description of each format, registry compatibility, and migration guidance see [OCI Storage Formats](oci-storage-formats.md).
+
 #### docstore
 
 You can read about the go-cloud docstore URI format [here](https://gocloud.dev/howto/docstore/). Tekton Chains supports the following docstore services: