Use the OCI Distribution Specification Referrers API to list all signatures and SBOMs attached to a container image digest

Steps

1. Obtain the image manifest digest for the subject image using docker inspect --format '{{index .RepoDigests 0}}' <IMAGE> or via GET /v2/<name>/manifests/<tag> capturing the Docker-Content-Digest response header
2. Query the referrers endpoint: GET https://<REGISTRY>/v2/<name>/referrers/<digest> with an Accept: application/vnd.oci.image.index.v1+json header; the registry returns an OCI image index listing all attached artifacts
3. Filter by artifact type by appending a query parameter: GET /v2/<name>/referrers/<digest>?artifactType=application/vnd.cyclonedx+json to retrieve only CycloneDX SBOM referrers
4. For each referrer in the manifests array, pull the artifact manifest using GET /v2/<name>/manifests/<referrer_digest> and then fetch the blob using the layer digest to retrieve the SBOM or signature payload
5. Use the oras CLI as a higher-level alternative: oras discover <IMAGE>@<DIGEST> lists all referrers with their artifact types in a human-readable format