There are a couple of things to think of here.

Firstly, I had it in mind that we might end up implementing the copy-image flow, which I understand is widely used in some quarters. That would require a second struct here, and we'd probably want to turn this back into a pointer at that point. However, if this were the only concern, simply making this required but still a pointer would be fine: we can 'upgrade' from that without breaking either semver or kube backwards compatibility.

The other issue is more complex, though. One of the earliest use cases we discussed for ORC, but we haven't implemented yet, is 'import and manage'. This is for when we want ORC to take ownership of resources which already exist. In that case we cannot define download, and we would definitely want it to be empty. We would also have to define the validation for that at the Spec level, so both the context of 'import and manage' and the resource spec are in scope.

I'm not sure this is straightforward.

This strikes me that perhaps you don't actually want this field to be required?