layers: describe policy enforcement for foreign layer media type

Signed-off-by: Stephen J Day <stephen.day@docker.com>

layer.md

@@ -270,4 +270,13 @@ Implementations SHOULD generate layers using _explicit whiteout_ files, but MUST
 
 Any given image is likely to be composed of several of these Image Filesystem Changeset tar archives.
 
+# Foreign Layers
+
+Certain layers, due to legal requirements, may not be regularly distributable.
+Typically, such layers are downloaded directly from a distributor but are never uploaded.
+
+Layers that have these restrictions SHOULD be tagged with an alternative mediatype of `application/vnd.oci.image.layer.foreign.tar+gzip`.
+[Descriptors](descriptor.md) referencing these layers MAY include `urls` for downloading these layers.
+It is implementation defined whether or not implementations upload layers tagged with this media type.
+
 [tar-archive]: https://en.wikipedia.org/wiki/Tar_(computing)

media-types.md

@@ -5,8 +5,9 @@ The following `mediaType` MIME types are used by the formats described here, and
 - `application/vnd.oci.descriptor.v1+json`: [Content Descriptor](descriptor.md)
 - `application/vnd.oci.image.manifest.list.v1+json`: [Manifest list](manifest.md#manifest-list)
 - `application/vnd.oci.image.manifest.v1+json`: [Image manifest format](manifest.md#image-manifest)
-- `application/vnd.oci.image.layer.tar+gzip`: ["Layer", as a gzipped tar archive](layer.md)
 - `application/vnd.oci.image.config.v1+json`: [Container config JSON](serialization.md)
+- `application/vnd.oci.image.layer.tar+gzip`: ["Layer", as a gzipped tar archive](layer.md)
+- `application/vnd.oci.image.layer.foreign.tar+gzip`: ["Layer", as a gzipped tar that has distribution restrictions](layer.md#foreign-layers)
 
 ## Compatibility Matrix