Is it time to adopt extensions?

[SteveLasker]

@vbatts opened an extension proposal - Is it time to implement and start using it?

The listing APIs discussions might serve as a good working model

• What types of capabilities should be added to the core distribution-spec vs. extensions?
• How do we account for distribution-spec capabilities, that aren't implemented?
• Should we start with an extension model, and promote to the distribution-spec upon large usage?

[SteveLasker]

Example:
Notary v2 is pursuing:

• A new oci.artifact.manifest to support linked artifacts.
• A listing API, that returns a collection of linked manifests for a given artifact. (eg: what Notary v2 signatures are linked to the wordpress@sha256digest?

We'd like to see this capability in all registries, which registries can opt-into supporting. Just like they can opt-into catalog management.
If not adopted by oci-distribution-spec, we'd likely pursue an extension through OCI Artifacts. The OCI Artifacts spec would define the behavior, and registries can opt-into that support. Which would give them Notary v2 signing.

The question is how do we decide:

1. what goes into distribution-spec
2. what is an extension

Which all presumes, we have an extension model defined in the first place.

[jdolitsky]

I'm gonna go ahead and vote that we not use the discussion feature. There's actually a checkbox to disable it.. What do we gain over issues? Threaded discussion? Voting?