v2.4.0

Breaking Changes

• Upgrade to image-spec v1.1.0-rc6 and distribution-spec v1.1.0-rc4
  • Validate the Content-type header of the response when accessing the Referrers API
  • When pushing manifests with a subject field, if the OCI-Subject header is not set in the response, the registry is considered as not supporting the Referrers API

Warning

There are no API changes in oras-go.
However, when pushing and deleting manifests with a subject field, as well as querying the Referrers API, registries that implement older versions of distribution-spec may be considered as not supporting the Referrers API. In such cases, the Referrers tag schema will be used instead.

Known compatible registries:

• Zot v2.0.0-rc5 and later versions
• Harbor v2.10.0 and later versions

New Features

• Move package credentials from github.com/oras-project/oras-credentials-go to oras.land/oras-go/v2/registry/remote/credentials, which supports reading, saving, and removing credentials from Docker configuration files and external credential stores that follow the Docker credential helper protocol
• Support deletion and garbage collection in oci package
• Add registry.Referrers for listing referrers on any ReadOnlyGraphStorage
• Introduce SkipNode for CopyGraphOptions.PreCopy to signal oras.CopyGraph to stop copying a node
• Introduce SkipUnpack option on file.Store to skip unpacking compressed directories

Performance Improvements

• Improve authorization token caching
  • Support per-host scope hints, fixing #581
  • Introduce auth.NewSingleContextCache that creates a host-based cache for optimizing the auth flow for non-compliant registries
• Optimize Copy efficiency
  • Add MountFrom and OnMounted to oras.CopyGraphOptions to support mounting on copy

Bug Fixes

• Fix #692: index or manifest list without the OPTIONAL field platform cause panic (#695)

Other Changes

• Improve error messages and examples
• Include changes in v2.3.1

Detailed Commits

• feat: merge package credentials back from oras-credentials-go by @Wwwsylvia in #589
• feat: Add 'MemoryStore' by @uanid in #602
• refactor: make credentials.NewMemoryStore return an interface by @Wwwsylvia in #605
• feat: support per-host scope hints by @Wwwsylvia in #604
• feat: support deletion for memory resolver by @wangxiaoxuan273 in #607
• feat: support deletion for OCI storage by @wangxiaoxuan273 in #608
• fix: package credentials to support legacy auth keys in docker config by @Wwwsylvia in #617
• feat: support deletion for memory graph by @wangxiaoxuan273 in #606
• fix: error handling when delete non-existent target by @wangxiaoxuan273 in #627
• chore: add reference details to errors by @sajayantony in #628
• feat: minimal change to support cross-repo blob mounting by @ktarplee in #631
• build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 by @dependabot in #637
• feat: extend oci.Store with Delete() by @wangxiaoxuan273 in #614
• fix: rename ErrSkipDesc to SkipNode by @wangxiaoxuan273 in #643
• fix: check content-type when using referrers API by @ktarplee in #635
• build(deps): bump actions/setup-go from 4 to 5 by @dependabot in #655
• build(deps): bump github/codeql-action from 2 to 3 by @dependabot in #658
• feat: add Untag() to *oci.Store by @eiffel-fl in #647
• feat: Referrers support for content.ReadOnlyGraphStorage by @wangxiaoxuan273 in #659
• feat: GC on oci.Store.Delete by @wangxiaoxuan273 in #653
• feat: add a host-based auth cache as a fallback by @ktarplee in #651
• build: increase code coverage threshold to 75% by @wangxiaoxuan273 in #666
• build(deps): bump golang.org/x/sync from 0.5.0 to 0.6.0 by @dependabot in #669
• feat: add MountFrom and OnMounted to CopyGraphOptions by @ktarplee in #665
• docs: add example to parse reference with digest by @shizhMSFT in #675
• feat: Public GC function of oci.Store by @wangxiaoxuan273 in #656
• feat: error type for not finding basic auth creds and export config path by @qweeah in #674
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc.6 by @dependabot in #681
• build(deps): use image-spec v1.1.0-rc6 instead of rc.6 by @Wwwsylvia in #687
• feat: allow skip unpack on push to file store by @wangxiaoxuan273 in #679
• feat: mark untagged manifests as garbage during GC and delete by @wangxiaoxuan273 in #680
• refactor: upgrade to distribution-spec v1.1.0-rc4 by @Wwwsylvia in #690
• fix: fix the potential panic error if there is no platform in the index or manifest list by @lizMSFT in #695
• refactor: remove AutoRemoveReferrers flag by @wangxiaoxuan273 in #683

New Contributors

• @uanid made their first contribution in #602
• @eiffel-fl made their first contribution in #647

Full Changelog: v2.3.0...v2.4.0