[Bug]: OCI Attestor searches for manifest.json instead of index.json breaking OCI Archive format support #686

What steps did you take and what happened:

The OCI attestor in oci.go searches for manifest.json inside the tar archive, which is the Docker Archive format. According to the OCI Image Layout Specification, the correct entry point for an OCI archive is index.json.

When using buildah push --format oci ... oci-archive:image.tar, the tar contains:

blobs/sha256/...
index.json       ← OCI spec
oci-layout       ← OCI spec

This causes the attestor to fail with:

level=debug msg="(attestation/oci) error parsing manifest: unexpected end of JSON input"
level=error msg="attestors failed with error messages\nattestor oci failed: unexpected end of JSON input"

What did you expect to happen:

The OCI attestor should support index.json (OCI Archive format) in addition to or instead of manifest.json (Docker Archive format).

[Expected outcome listed here.]

Anything else you would like to add:

[Miscellaneous information that will assist in solving the issue.]

Environment:

• Go-Witness version: v0.10.2
• Architecture: x86
• Attestors used: slsa, git, product, material, oci, gitlab
• Archivista version: not used