>However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend th

>However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend that users yet attempt deploying these. I am not sure I agree with this. You have deployed these draft protocols in 1.3 resulting in CVEs for the pull ops. For me (and I think for every software release engineer), I would deploy something only as part of a test branch and not as part of production code. This is (IMHO) bad engineering practice for such a vital piece of software. Not good.