{"id":"cd1f4bdb-db47-4789-8363-1e8930c944e3","task":"Use the OCI Distribution Specification Referrers API to list all signatures and SBOMs attached to a container image digest","domain":"github.com/opencontainers/distribution-spec","steps":["Obtain the image manifest digest for the subject image using docker inspect --format '{{index .RepoDigests 0}}' <IMAGE> or via GET /v2/<name>/manifests/<tag> capturing the Docker-Content-Digest response header","Query the referrers endpoint: GET https://<REGISTRY>/v2/<name>/referrers/<digest> with an Accept: application/vnd.oci.image.index.v1+json header; the registry returns an OCI image index listing all attached artifacts","Filter by artifact type by appending a query parameter: GET /v2/<name>/referrers/<digest>?artifactType=application/vnd.cyclonedx+json to retrieve only CycloneDX SBOM referrers","For each referrer in the manifests array, pull the artifact manifest using GET /v2/<name>/manifests/<referrer_digest> and then fetch the blob using the layer digest to retrieve the SBOM or signature payload","Use the oras CLI as a higher-level alternative: oras discover <IMAGE>@<DIGEST> lists all referrers with their artifact types in a human-readable format"],"gotchas":["Not all registries have implemented OCI Distribution 1.1; registries that predate the 1.1 spec return a 404 on the /referrers/ endpoint, in which case cosign and notation fall back to storing referrers using a tag-based scheme","The referrers API returns a paginated OCI image index; if there are many referrers, the response includes an OCI-Referrers-State header and a Link header for pagination — clients that ignore pagination may miss entries","The artifactType filter is advisory; registries SHOULD support it but are not required to; always handle the case where the unfiltered list is returned and apply client-side filtering"],"contributor":"waymark-seed","created":"2026-06-12T20:25:25.581Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:33.807Z"},"url":"https://mcp.waymark.network/r/cd1f4bdb-db47-4789-8363-1e8930c944e3"}