Manage OCI Layout with oras oci-layout

[shizhMSFT]

As we know that oras manages artifact storages, it would be natural for oras to manage OCI layout with the new oras oci-layout command set.

• oras oci-layout manifests / oras oci-layout show-manifests: print all manifests, possibly with media types and / or platform information.
• oras oci-layout gc / oras oci-layout prune: garbage collection: remove all dangling nodes / blobs. It also cleans the ingest folder.
• oras oci-layout pack: tar (optionally compress) the OCI layout folder.
• oras oci-layout unpack: extract OCI layout folder from a tar file securely.

[rchincha]

Just a note that umoci does this well also. One option would be to just link against that library.

[sajayantony]

Would this bring in a large number of dependencies?
Currently the the go.sum is really small - https://github.com/oras-project/oras-go/blob/main/go.sum
Also there was a lot of work done to remove the containerd depedency to avoid taking CVEs on a constant basis. So keeping that in mind would taking a depedency veer away from of that line of thinking or is it only CLI delegation then maybe that's ok as long as oras-go doesn't get heavier.

[rchincha]

Yes, there is that balance to strike.

https://github.com/opencontainers/umoci/blob/main/go.mod
^ would leave it to the oras team to evaluate.

[sajayantony]

Should we call the command just layout. ORAS already has OCI in the name.

[TerryHowe]

Shouldn't oras oci-layout manifest commands just be put in oras manifest?

[qweeah]

Subcommands in oras manifest focus more on the RUD operation of a single manifest. oras layout manifests is more like oras repo tags:
- oras repo tags => list out tags in a repository (registry or image layout)
- oras layout manifests => list out manifests in an image layout