v2.0.2

Bug Fixes

• Fix #461: Untagged manifests might be accidentally removed from the index.json file in OCI layouts

Other Changes

• Improve repository governance

Detailed Commits

• chore: update owners by @shizhMSFT in #459
• fix: refactor tagging implementation for OCI Store by @Wwwsylvia in #462

Full Changelog: v2.0.1...v2.0.2

v1.2.3

What's Changed

• build(deps): bump golang.org/x/crypto from 0.4.0 to 0.5.0 by @dependabot in #408
• build(deps): bump github.com/docker/cli from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in #405
• build(deps): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in #406
• build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.15 by @dependabot in #407
• build(deps): bump golang.org/x/crypto from 0.5.0 to 0.6.0 by @dependabot in #436
• build(deps): bump github.com/containerd/containerd from 1.6.15 to 1.6.17 by @dependabot in #441
• bump: update docker and docker/cli by @benschlueter in #428
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.1+incompatible by @dependabot in #439
• build(deps): bump github.com/docker/docker from 23.0.0+incompatible to 23.0.1+incompatible by @dependabot in #440
• build(deps): bump github.com/containerd/containerd from 1.6.17 to 1.6.18 by @dependabot in #447
• build(deps): bump github.com/containerd/containerd from 1.6.18 to 1.6.19 by @dependabot in #452
• build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 by @dependabot in #451
• build(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 by @dependabot in #455
• build(deps): bump github.com/containerd/containerd from 1.6.19 to 1.7.0 by @dependabot in #460

New Contributors

• @benschlueter made their first contribution in #428

Full Changelog: v1.2.2...v1.2.3

v2.0.1

Bug Fixes

• fix #449: index.json is not generated for OCI Stores that contain no manifests
• fix #431: Some unit tests fail on Mac

Other Changes

• Update the Go support window to [1.19, 1.20] (#442)
• Improve documentation and repository governance

Detailed Commits

• fix: Broken tests for mac by @TerryHowe in #431
• fix: broken go-sdk link in readme by @khanjasir90 in #438
• feat: update go support window to [1.19, 1.20] by @asmit2952 in #442
• chore: add CODEOWNERS based on OWNERS.md by @shizhMSFT in #444
• fix: fix CODEOWNERS by @shizhMSFT in #446
• fix: ensure index.json for oci store by @Wwwsylvia in #450

New Contributors

• @TerryHowe made their first contribution in #431
• @khanjasir90 made their first contribution in #438
• @asmit2952 made their first contribution in #442

Full Changelog: v2.0.0...v2.0.1

v2.0.0

Brand New V2 Library

What's New

In version v2, ORAS Go library has been completely refreshed with:

• More unified interfaces
• Notably fewer dependencies
• Higher test coverage
• Better documentation
• Balanced security and performance

Besides, ORAS Go v2 is now a registry client conforming image-spec v1.1.0-rc.2 and distribution-spec v1.1.0-rc1.

In ORAS Go v2, artifacts are modeled as Directed Acyclic Graphs (DAGs) stored in Content-Addressable Storages (CASs). Copying artifacts across repositories or generic targets is implemented as copying single-rooted DAGs across CASs. By extending the copy operation, ORAS Go v2 further supports copying underlying DAGs identified by a specific node. For instance, copying a signed artifact with its signatures across repositories.

Documentation and examples are available at pkg.go.dev.

Deprecation

Docker based key management is no longer supported. Credentials are required to be supplied to auth.Client for authentication. Related discussion can be found at #413.

Migration From v1

See MIGRATION_GUIDE.md.

What's Changed Since RC.6

New Features

• Implement registry.TagLister for package content/oci
• Add package registry/remote/retry which provides a default http client with automatic retries

Bug Fixes

• fix #395: oras.Tag() and oras.TagN() should return a descriptor
• fix #402: file.Store fails to extract folder containing symbolic links
• fix #404: oci.Store and file.Store should record an absolute path instead of a relative path for root

Deprecation

• BREAKING CHANGE: Interface registry.ReferrerFinder is renamed to registry.ReferrerLister
• BREAKING CHANGE: Remove file.PackFiles()

Other Changes

• BREAKING CHANGE: oras.Tag() and oras.TagsN() return a descriptor
• BREAKING CHANGE: file.New(), file.NewWithFallbackLimit() and file.NewWithFallbackStorage() return an error
• BREAKING CHANGE: oci.NewStorage() returns an error
• BREAKING CHANGE: auth.DefaultClient uses retry.DefaultClient instead of http.DefaultClient
• Improve the performance of oras.ExtendedCopy()
• Improve documentation
• Improve error messages

Detailed Commits

• fix: add error detail to resolve failure by @qweeah in #390
• fix!: Tag() and TagN() return a descriptor by @shizhMSFT in #396
• feat!: implement Tags for package content/oci by @shizhMSFT in #394
• refactor: optimize performance for Extended Copy by @Wwwsylvia in #397
• remove!: Remove file.PackFiles() and add an example instead by @Wwwsylvia in #400
• doc: Remove main from the godoc URLs in README by @Wwwsylvia in #403
• build: add dependabot for v1 branch, add GitHub Actions by @lucacome in #399
• fix!: fix error when extracting folder containing symbolic links by @Wwwsylvia in #411
• fix!: use absolute path for OCI root by @Wwwsylvia in #412
• test: improve the symlink unit tests for file store by @Wwwsylvia in #414
• feat!: retryable http client by @souleb in #398
• doc: Update README and clean up godoc comments by @Wwwsylvia in #418

Full Changelog: v2.0.0-rc.6...v2.0.0

v1.2.2

What's Changed

• BREAKING CHANGE: Update to Go 1.18 by @lucacome in #154
• Bump containerd and opencontainers/image-spec by @lucacome in #378
• Bump crypto and sync by @lucacome in #381
• Bump docker by @lucacome in #382
• Bump distribution by @lucacome in #386
• Bump logrus and testify by @lucacome in #387

Full Changelog: v1.2.1...v1.2.2

v2.0.0-rc.6

New Features

• Upgrade package content/oci
  • Support creating read-only OCI store from fs.FS
  • Support reading OCI layout from tar archives
    • Compatible with tar archives generated by docker buildx build with option --output=type=oci
  • Support resolving a digest to a descriptor
  • Support discovering predecessors that are not tagged in index.json
• oras.Copy() supports copying images with non-distributable / foreign layers by skipping.

Bug Fixes

• fix #368: Range query is attempted for fetching blob from registries without range query support
• fix #374: Repository.FetchReference() fails when registry responds with chunked transfer encoding
• fix #383: oras.Copy() may fail when the option FindSuccessors finds successors from external sources

Other Changes

• BREAKING CHANGE: Change the type of Concurrency options from int64 to int
• Improve code quality (#363, #364)
• Improve the readability of GoDoc

Detailed Commits

• doc: fix testable example name by @Wwwsylvia in #365
• fix: avoid copying Repository mutex state by @abursavich in #364
• fix: attempt range query only if server explicitly supports by @shizhMSFT in #369
• doc: make the default options displayed next to the option type on godoc by @Wwwsylvia in #372
• fix: avoid panic from releasing unacquired semaphore by @abursavich in #363
• refactor!: update the type of Concurrency options to int by @Wwwsylvia in #376
• fix: allow chunked responses via HEAD request fallback by @AaronFriel in #370
• feat: support creating read-only OCI store from fs.FS by @Wwwsylvia in #367
• feat: support reading OCI layout from tarballs by @Wwwsylvia in #379
• feat: change foreign layer error message at repository.Fetch() by @wangxiaoxuan273 in #377
• feat: skip foreign layers on oras.Copy by @shizhMSFT in #380
• fix: use proxy when copying node with successors by @qweeah in #384
• refactor: refactor OCI store to fully support Predecessors() and Resolve() by @Wwwsylvia in #385

New Contributors

• @abursavich made their first contribution in #364
• @AaronFriel made their first contribution in #370

Full Changelog: v2.0.0-rc.5...v2.0.0-rc.6

v2.0.0-rc.5

New Features

• BREAKING CHANGE: Add ReferrerFinder to Repository interface

Bug Fixes

• fix #349: Potential dead lock in oras.Copy

Other Changes

• Improve the performance of using referrers tag schema when pushing and deleting manifest concurrently
• Revise the documentation of registry.Reference

Detailed Commits

• feat!: add ReferrerFinder to Repository interface by @shizhMSFT in #357
• fix: fix potential deadlock in oras.Copy by @Wwwsylvia in #359
• doc: revise doc of registry.Reference by @nima in #358
• perf: improve the performance of using referrers tag schema by @Wwwsylvia in #360

Full Changelog: v2.0.0-rc.4...v2.0.0-rc.5

v2.0.0-rc.4

New Features

• BREAKING CHANGE: Migrate to OCI Artifact from ORAS Artifact
  • Upgrade to image-spec v1.0.0-rc.2
  • Support OCI Artifact Manifest
  • Support Referrers API and its fallback Referrers Tag Schema
  • Support indexing referrers when pushing and deleting manifests with the subject field
• Add package registry/remote/errcode to support checking the error code returned by the registry/remote package
• Add content.VerifyReader for verifying the read content against the descriptor

Bug Fixes

• fix #303: Scrutinize references for digests posing as tags

Other Changes

• BREAKING CHANGE: Change the signature of Repository.Referrers()
• BREAKING CHANGE: Merge oras.PackArtifact() into oras.Pack()
• Improve error message on platform mismatch
• Improve error message for Repository.FetchReference()
• Increase test coverage
• Check license header in Github workflow
• Other minor fixes

Detailed Commits

• test: add interface tests for Repository, blobStore and manifestStore by @wangxiaoxuan273 in #313
• fix: add missing license headers by @jasminetMSFT in #315
• build: license header check in github workflows by @jasminetMSFT in #316
• feat: add read and verify utility method by @wangxiaoxuan273 in #324
• fix: fix data race in TagBytesN unit test by @Wwwsylvia in #329
• fix: improve oras manifest fetch --platform error message by @lizMSFT in #330
• fix: fix 404 error message for manifestStore.FetchReference by @Wwwsylvia in #331
• fix: add nil checks for some functions by @jasminetMSFT in #327
• feat!: support OCI artifact manifest with descriptor migration by @Wwwsylvia in #334
• fix: Scrutinize references for digests posing as tags by @nima in #326
• refactor: optimize extended copy filters by @Wwwsylvia in #335
• Update image-spec to v1.1.0-rc2 by @sajayantony in #339
• refactor: update implementation of Referrers API by @Wwwsylvia in #340
• refactor!: merge oras.PackArtifact() into oras.Pack() by @Wwwsylvia in #343
• feat: index referrers on manifest push by @Wwwsylvia in #348
• feat: index referrers on manifest delete by @Wwwsylvia in #350
• feat: include error code in error response by @Wwwsylvia in #352
• refactor: refactor functions related to querying referrers by @Wwwsylvia in #353

New Contributors

• @jasminetMSFT made their first contribution in #315

Full Changelog: v2.0.0-rc.3...v2.0.0-rc.4

v2.0.0-rc.3

New Features

• Added utility functions for content descriptors
  • content.NewDescriptorFromBytes() to generate a descriptor from a byte slice
  • content.Equal() to compare if two descriptors point to the same content
• Simplified API
  • registry/remote/auth.StaticCredential() for easier and secure credential setting for simple scenarios
  • oras.Fetch() to fetch content as a reader via a reference string from any target
  • oras.FetchBytes() to fetch content as a byte slice via a reference string from any target
  • oras.PushBytes() to push a byte slice to any target
  • oras.TagN() to tag content with multiple tags
  • oras.TagBytes() to push a byte slice to any target and tag it with a single tag
  • oras.TagBytesN() to push a byte slice to any target and tag it with multiple tags
• Extracted content.Tagger interface from content.TagResolver

Deprecation

• BREAKING CHANGE Moved content.ErrSizeExceedLimit to errdef.ErrSizeExceedsLimit
• BREAKING CHANGE Removed registry.ReferenceTagger
• BREAKING CHANGE Removed registry/remote.Repository.TagReference()

Bug Fixes

• fix #225: Pulling from AWS ECR fails with error empty response Docker-Content-Digest
• fix #294: Pushing artifacts to Google GAR fails with error Error PUT ... unexpected status code 400: Bad Request
• fix potential security vulnerabilities: #289, #291

Other Changes

• BREAKING CHANGE Updated support window to Go 1.18 and 1.19
• BREAKING CHANGE Reduced interface requirements in corresponding functions of the package oras to ReadOnly interfaces
  • content.Storage --> content.ReadOnlyStorage
  • content.GraphStorage --> content.ReadOnlyGraphStorage
  • oras.Target --> oras.ReadOnlyTarget
  • oras.GraphTarget --> oras.ReadOnlyGraphTarget
• BREAKING CHANGE Manifest() of registry.Repository returns a ManifestStore instead of a BlobStore
• Improved error message on planform mismatch

Detailed Commits

• build: update support window to Go 1.18, 1.19 by @wangxiaoxuan273 in #270
• refactor: Small refactor of reference module and tests by @nima in #279
• fix: oras pull error empty response Docker-Content-Digest by @nima in #237
• refactor!: add read-only interfaces by @Wwwsylvia in #283
• feat: add utility methods for creating and comparing OCI descriptors by @wangxiaoxuan273 in #281
• fix: remove +json encoding from the default config media type by @Wwwsylvia in #288
• feat!: support oras.Fetch and oras.FetchBytes by @Wwwsylvia in #282
• feat: add a utility method for specifying static credentials by @wangxiaoxuan273 in #280
• refactor: improve error message on platform mismatch in order to distinguish platform not found and manifest not found by @lizMSFT in #292
• feat: Support oras.PushBytes and oras.TagBytes by @Wwwsylvia in #293
• fix: Revert "Upload empty blob when packing" by @Wwwsylvia in #295
• fix: Revert "fix: remove +json encoding from the default config media type" by @Wwwsylvia in #297
• fix: use a default value when Concurrency is not specified by @Wwwsylvia in #296
• feat!: Support specifying MaxMetadataBytes option for oras.Resolve and oras.Copy by @Wwwsylvia in #299
• feat: Repository.Manifest() now returns a ManifestStore by @Wwwsylvia in #300
• feat!: support oras.TagN by @Wwwsylvia in #301
• feat: implement ReferenceParser for manifestStore by @Wwwsylvia in #305

New Contributors

• @nima made their first contribution in #279

Full Changelog: v2.0.0-rc.2...v2.0.0-rc.3

v1.2.1

What's Changed

• Implement Info, which will return metadata about the content available in the OCI store by @oanatmaria in #187
• Bump docker/distribution to v2.8.1 by @mihaibuzgau in #276

New Contributors

• @oanatmaria made their first contribution in #187
• @mihaibuzgau made their first contribution in #276

Full Changelog: v1.2.0...v1.2.1