Provide some guidance for `<tag>@<digest>` references

[Silvanoc]

It can be observed lately that more and more clients are supporting the use of <tag>@<digest> references for OCI-artifacts in general on their user interface. This naming format conflicts with the OCI-specification, which clearly states that "<reference> MUST be either (a) the digest of the manifest or (b) a tag. The <reference> MUST NOT be in any other format.".

It's clear that the user-client interface is not bound to the OCI-specification. Nevertheless, it would be meaningful to give some guidance on this naming format to ensure consistency across the different levels in the ecosystem.

I see two options:

1. Keeping the OCI-specification as it is, but give some guidance on how to deal with it on other levels in the ecosystem.
2. Extending the specification to make <tag>@<digest> also valid, specifying the expected behavior (probably ignoring the part).

@sudo-bmitch apparently regctl supports this format and you are a maintainer of both regctl and this specification. What's your opinion on this topic?

[sudo-bmitch]

This spec defines the registry API, where no conflict exists (except for overloading the reference term which I feel the spec needs to pick a new term).

There is a proposal to create a working group to standardize the reference strings used to point to images, but we don't even have enough people interested in owning that effort, along with disagreement on whether OCI should standardize that: opencontainers/tob#114

Until then, the reference strings are defined by individual projects. Distribution, regclient, and skopeo all have separate implementations with various incompatibilities.

• https://github.com/distribution/reference
• https://github.com/regclient/regclient/tree/main/types/ref and https://regclient.org/usage/#image-references
• https://github.com/containers/image/blob/main/docs/containers-transports.5.md

[sudo-bmitch]

I'm going to close this out since I don't believe this is a distribution spec issue (the reference string used by applications != the path segment in the HTTP API, these are two separate things).