Spike: Package to OCI spec POC

[Madeline-UX]

Problem Statement: How should the OCI layer or layers be constructed and how are they built?

Specific Questions:

1. How do you construct an OCI layer and make it so that you can add it to a registry and get it back a registry without using external tools?

2. How will the current Zarf package be structured into a layer or layers?

3. How do we get a generic structure of tarballs into an OCI spec?

Acceptance Criteria:

• Demonstrate building a raw OCI layer.
• Package the OCI layer(s) in a way to interface with OCI formats
• Come up with options for the Zarf package data in a repeatable and compatible way with existing OCI meta data.

[wirewc]

I found the spec for go here: https://github.com/opencontainers/runtime-spec/tree/main/specs-go.

[wirewc]

After speaking with @YrrepNoj, it looks like their prior experience plus a reference to this project may help provide the necessary guidance.

https://github.com/oras-project/oras-go

[wirewc]

Touching this for an update:
@Noxsios is doing the work on the spike in this branch: https://github.com/defenseunicorns/zarf/tree/features/oci-publish

We should be merging it soon with either the other feature branch or in main pending comfort with the current state.

[Racer159]

@Noxsios / @wirewc / @YrrepNoj is this basically done or was there more to explore?

[Racer159]

@Noxsios can you add info to this and close?

[wirewc]

@Racer159 yes, the spike is handled by the branches that needed be merged between features/oci-package and features/oci-publish.

The spike included looking at Oras for the packaging by @Noxsios.
While @YrrepNoj was addressing the package structure.

Pending their feeling, I feel this spike should be closed.

[Racer159]

This will be closed by the ADR for the OCI PR