> > I'm not familiar enough with the internals of registry and TUF -- is > "4.2.4-x86_64-..." what would be presented by Docker Hub as a "tag"?
Almost. I store only the TUF metadata as tags in the registry. The metadata contains the digests of the data. Since the registry is content-addressable, I can then just retrieve the data by digest. So "node-4.2.4-x86_64-rumprun-netbsd-hw_generic" is actually just an entry in the TUF metadata and isn't visible as a tag in the registry.
