Skip to content

Releases: oras-project/oras

v1.2.0

30 May 08:17
Compare
Choose a tag to compare

New Features

  • oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
  • Introduce brand-new default terminal experience
    • Show live progress for the following commands:
      • oras copy
      • oras pull
      • oras push
      • oras attach
      • oras blob fetch
      • oras blob push
    • The new terminal experience can be turned off via the preview flag --no-tty
  • Support deletion of manifests and blobs in OCI image layout
  • Support X.509 mTLS authentication with OCI registries

Preview Features

  • BREAKING CHANGE Registries supporting Referrers API prior to distribution-spec v1.1.0-rc4 will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
  • Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform
  • Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and its referrers
  • Promote --image-spec to a preview flag from experimental

Experimental Features

  • BREAKING CHANGE oras discover shows tree view output by default
  • Introduce formatted output via --format by implementing the specification
    • Formatted output is available to the following commands:
      • oras pull
      • oras push
      • oras attach
      • oras discover
      • oras manifest fetch
    • Examples:
      • --format json to print operation result as a JSON object
      • --format "go-template={{ .digest }}" to print the digest of the manifest using Go template
        • Template can also be specified by --template
  • Introduce oras resolve to get the digest of an artifact

Deprecation

  • oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

  • Fix #1079: Snaps build cannot read default credentials file
  • Fix #1096: Mixed request number in the debug mode
  • Fix #1106: Flag --plain-http=false does not work for local registries
  • Fix #1129: oras cp -r fails if index has a child manifest as subject
  • Minor fixes

Other Changes

  • Improve UX
    • oras discover: show placeholder when artifactType is not presented in an index referrer
    • oras push: show artifact type when pushing files
    • Improve error message based on ORAS CLI error handling guildline
    • Improve identity token input by a new flag --identity-token to replace --password without --username
  • Improve performance
    • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
    • Support blob mounting across repositories in the same registry for oras copy
  • Update dependencies
  • Update to Golang 1.22.3
  • Minor security enhancements

What's Changed Since RC.1

Other Changes

  • Improve documentation
  • Update dependencies

Detailed Commits

Full Changelog: v1.2.0-rc.1...v1.2.0

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

v1.2.0-rc.1

17 May 06:48
Compare
Choose a tag to compare
v1.2.0-rc.1 Pre-release
Pre-release

New Features

  • oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
  • Support X.509 mTLS authentication with OCI registries
  • PREVIEW Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform

Experimental Features

  • BREAKING CHANGE oras discover shows tree view output by default
  • BREAKING CHANGE Introduce new go templating experience to all commands support --format based on the spec
    • BREAKING CHANGE Require explicit type assertion --format go-template=TEMPLATE
    • BREAKING CHANGE Change field selectors from uppercased to lowercased
    • BREAKING CHANGE Rename digested reference selector to reference
    • Examples:
      • --format go-template="{{ .digest }}" to print the digest of the newly pushed manifest using Go template
    • Template can also be specified by --template
  • Introduce output control via --format to oras pull, oras manifest fetch, and oras discover

Deprecation

  • oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

  • Fix #1079: snap build cannot read default credentials file
  • Fix #1268: oras blob fetch failed to output to stdout in terminal mode
  • Fix #1300: pushing with multiple tags will corrupt --format output
  • Minor fixes

Other Changes

  • Improve UX
    • oras discover: show placeholder when artifactType is not presented in an index referrer
    • oras push: show artifact type when pushing files
    • Improve error message based on ORAS CLI error handling guildline
    • Improve identity token input by a new flag --identity-token to replace --password without --username
  • Improve live progress output for terminal
    • Introduce colored output
    • Smooth download speed display with reduced fluctuation
  • Update dependencies
  • Update to Golang 1.22.3

Detailed Commits

Read more

v1.2.0-beta.1

02 Feb 08:30
Compare
Choose a tag to compare
v1.2.0-beta.1 Pre-release
Pre-release

New Features

  • Introduce brand-new default terminal experience
    • Show live progress for the following commands:
      • oras copy
      • oras pull
      • oras push
      • oras attach
      • oras blob fetch
      • oras blob push
    • The new terminal experience can be turned off via the flag --no-tty
  • Support deletion of manifests and blobs in OCI image layout

Experimental Features

  • BREAKING CHANGE oras is compliant with OCI image-spec v1.1.0-rc6 and distribution-spec v1.1.0-rc4
    • Registries supporting Referrers API of older version of distribution-spec will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
    • Known registries supporting the distribution-spec v1.1.0-rc4:
  • Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and their referrer artifacts
  • Introduce oras resolve to get the digest of an artifact
  • Introduce output control by specifying --format to oras push and oras attach
    • Examples:
      • --format json to print operation result as a JSON object
      • --format "{{ .Digest }}" to print the digest of the newly pushed manifest using Go template
    • Known issue: pushing with multiple tags output unexcepted results and will be fixed in future versions

Bug Fixes

  • Fix #1096: Mixed request number in the debug mode
  • Fix #1106: Flag --plain-http=false does not work for local registries
  • Fix #1129: oras cp -r fails if index has a child manifest as subject

Other Changes

  • Enhance troubleshooting experience with improved error messages
  • Improve performance
    • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
    • Support blob mounting across repositories in the same registry for oras copy
  • Update dependencies
  • Update to Golang 1.21.6
  • Minor security enhancements

Detailed Commits

  • bump: tag and release ORAS CLI v1.1.0 by @qweeah in #1103
  • fix: allow HTTPS for localhost by @qweeah in #1107
  • perf: optimize request count for manifest and blob deletion by @qweeah in #1109
  • revert: "perf: optimize request count for manifest and blob deletion" by @qweeah in #1115
  • perf: optimize request count for manifest and blob deletion by @qweeah in #1116
  • chore: fix typo by @testwill in #1121
  • feat: support copying referrers for multi-arch images by @qweeah in #1122
  • build(deps): bump golang.org/x/term from 0.11.0 to 0.12.0 by @dependabot in #1123
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /test/e2e by @dependabot in #1126
  • fix: remove root from virtual referrers by @shizhMSFT in #1130
  • build: release ppc64le/riscv64 and improve reproducibility by @katexochen in #1118
  • build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 by @dependabot in #1137
  • build(deps): bump golang.org/x/term from 0.12.0 to 0.13.0 by @dependabot in #1136
  • build(deps): bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /test/e2e by @dependabot in #1132
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /test/e2e by @dependabot in #1140
  • build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1141
  • feat: support progressed output in blob push and blob get by @qweeah in #1113
  • perf: reduce auth request count for oras cp by @qweeah in #1142
  • fix: resolve duplicated debug log for oras cp by @qweeah in #1139
  • build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1144
  • build(deps): bump github.com/oras-project/oras-credentials-go from 0.2.0 to 0.3.1 by @dependabot in #1145
  • build(deps): bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /test/e2e by @dependabot in #1147
  • feat: support progress output for attach, push and copy commands by @qweeah in #1138
  • build(deps): bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /test/e2e by @dependabot in #1153
  • build(deps): upgrade image-spec to 1.1.0-rc5 and oras-go to the latest by @shizhMSFT in #1154
  • chore: add reference details to registry errors by @sajayantony in #1152
  • feat: support progress output in pull by @qweeah in #1148
  • feat: remove empty artifact CLI message and show hints for pulling OCI image layout by @sajayantony in #1157
  • fix: should not print copy hint for manifest in verbose mode by @qweeah in #1165
  • feat: make --debug imply --no-tty by @qweeah in #1162
  • fix: avoid copy suggestion when only config is skipped by @sajayantony in #1164
  • fix: resolve regression made in #1164 by @qweeah in #1170
  • fix: atomic bool for layer skipped during pulling by @qweeah in #1168
  • build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 by @dependabot in #1172
  • fix: update error message for repo ls by @sajayantony in #1169
  • test(e2e): add specs to hint for pulling unnamed layers by @qweeah in #1174
  • build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in #1171
  • fix: avoid overflow in progress bar percentage by @qweeah in #1178
  • chore(ux): add newline to make TTY output copy friendly by @qweeah in #1180
  • build(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 by @dependabot in #1181
  • build(deps): bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /test/e2e by @dependabot in #1182
  • test(e2e): fix a false positive test for blob get by @qweeah in #1184
  • chore: make error of non-existed source OCI layout more readable by @qweeah in #1176
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.1 in /test/e2e by @dependabot in #1185
  • feat: add resolve command by @sajayantony in #1187
  • test(e2e): add test for resolve command by @qweeah in #1188
  • build(deps): bump golang.org/x/term from 0.14.0 to 0.15.0 by @dependabot in #1194
  • doc: add example for attach with custom layer media type by @qweeah in #1195
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.1 to 2.13.2 in /test/e2e by @dependabot in #1196
  • feat: scrub Set-Cookie header in debug logs by @qweeah in #1190
  • feat: support manifest and blob deletion for OCI layout by @qweeah in #1197
  • build(ci): add workflow for releasing main image by @kranurag7 in #1191
  • build(ci): merge tag and main ghcr build release file by @qweeah in #1205
  • test(e2e): add spec to cover legacy docker config file by @qweeah in #1206
  • feat: improve returned error for invalid arguments by @qweeah in #1201
  • fix: bug in pushing with multiple tags by @qweeah in #1209
  • chore(ux): improve error message for oras tag list by @qweeah in #1219
  • build(ci): enforce coverage check by @qweeah in #1220
  • chore(ux): improve error output for unknown spec flag by @qweeah in #1221
  • build(deps): bump oras-go/v2 to main branch by @qweeah in #1223
  • fix: resolve error in help doc of distribution spec flag by @qweeah in #1229
  • build(ci): make coverage upload and calculation mandatory by @qweeah in https...
Read more

v1.1.0

05 Sep 01:50
Compare
Choose a tag to compare

New Features

Experimental Features

  • BREAKING CHANGE: Redesign the flag --image-spec
    • Add options v1.0 and v1.1
    • Remove options v1.1-image and v1.1-artifact
    • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
  • BREAKING CHANGE: Remove the flag --image-spec from oras attach

Bug Fixes

  • Fix #995: oras push and oras attach generates unwanted manifest file
  • Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
  • Fix #897: Wrong error log when --distribution-spec is provided with invalid value
  • Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

  • Improve UX, documentation, performance, tests and code coverage
  • Update dependencies
  • Update to Golang 1.21.0

What's Changed Since RC.2

Other Changes

  • Improve performance
    • Reduced number of auth requests for push and attach (#1084)
  • Improve documentation
    • Update security guide (#1017)
    • Update compatibility mode doc (#1065)
  • Update dependencies
    • Bump oras-go to 2.3.0
  • Improve tests

Detailed Commits

  • bump: tag and release ORAS CLI v1.1.0-rc.2 by @qweeah in #1078
  • test(e2e): add zot as a testing backend by @qweeah in #1072
  • Add SECURITY.md file by @TerryHowe in #1082
  • test(e2e): update e2e specs for oras attach by @qweeah in #1081
  • test(e2e): use ZOT as testing backend for oras blob specs by @qweeah in #1083
  • test(e2e): fix logging when e2e test fails by @qweeah in #1090
  • test(e2e): migrate oras push specs to ZOT by @qweeah in #1085
  • test(e2e): migrate oras pull specs to ZOT by @qweeah in #1086
  • test(e2e): migrate oras tag specs to ZOT by @qweeah in #1087
  • test(e2e): migrate oras repo specs to ZOT by @qweeah in #1088
  • test(e2e): migrate oras manifest specs to ZOT by @qweeah in #1089
  • perf: save auth requests for push and attach by @Wwwsylvia in #1097
  • test(e2e): re-bake test data by @qweeah in #1094
  • test(e2e): migrate oras cp and oras discover specs to ZOT by @qweeah in #1093
  • test(e2e): cover pulling test for image spec 1.1.0-rc.2 artifact by @qweeah in #1098
  • test(e2e): add tests to cover OCI spec v1.1.0-rc.4 and OCI distribution spec 1.1.0-rc3 by @qweeah in #1099
  • test(e2e): add doc for ZOT test data by @qweeah in #1100
  • build(deps): bump oras-go to v2.3.0 by @qweeah in #1101
  • doc: update example for oras push by @qweeah in #1102
  • doc: update compatibility mode doc to align with ORAS v1.1.0 by @FeynmanZhou in #1068

Full Changelog: v1.1.0-rc.2...v1.1.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.1.0-rc.2

25 Aug 07:30
Compare
Choose a tag to compare
v1.1.0-rc.2 Pre-release
Pre-release

New Features

Experimental Features

  • BREAKING CHANGE: Redesign the flag --image-spec
    • Add options v1.0 and v1.1
    • Remove options v1.1-image and v1.1-artifact
    • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
  • BREAKING CHANGE: Remove the flag --image-spec from oras attach

Deprecation

  • Remove the flag --skip-delete-referrers (#1041) introduced in v1.1.0-rc.1

Other Changes

  • Improve UX
    • Make error logs more readable (#1021)
  • Improve documentation
    • Fix broken links in project readme (#1017)
  • Update dependencies
  • Update to Golang 1.21.0
  • Improve tests
    • Add unit tests for cred store (#972)
    • Fix E2E false positive result (#1022)

Detailed commits

  • bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
  • chore: fix lint warning by @kranurag7 in #1001
  • chore: fix the links in project readme by @amands98 in #1012
  • chore: update container build prepare job output in Github Actions by @qweeah in #1019
  • test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
  • chore: use golangci lint by @kranurag7 in #986
  • fix: correct e2e specs and CI check configuration by @qweeah in #1023
  • workflow: add github stale action by @sajayantony in #1024
  • fix: move stale into .github/workflows by @sajayantony in #1031
  • build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
  • chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
  • chore: exempt stale if milestone is set by @qweeah in #1036
  • chore: add triage labels by @FeynmanZhou in #1055
  • chore: make error returned by oras tag more readable by @qweeah in #1058
  • revert: "feat: add flag to skip deleting obsolete referrers index" by @qweeah in #1060
  • feat: disable referrers index GC by default by @qweeah in #1059
  • build(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 by @dependabot in #1051
  • feat: pack OCI image spec v1.1 manifests by @qweeah in #1054
  • bump: use new packing function in oras-go by @qweeah in #1070
  • feat: support warning in remote targets by @qweeah in #1057
  • chore: align naming of pack option to oras-go by @qweeah in #1073
  • bump: update golang to 1.21 by @qweeah in #1074
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.11.0 to 2.12.0 in /test/e2e by @dependabot in #1075

New Contributors

Full Changelog: v1.1.0-rc.1...v1.1.0-rc.2

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.1

07 Aug 07:35
Compare
Choose a tag to compare

Bug Fixes

  • oras push and oras attach generates unwanted manifest file (#995)
  • Path validation not enforced for oras attach and oras push (#983, #980, #973)
  • Wrong error information when --distribution-spec is provided with invalid value (#897)
  • Tree view print bug in oras discover (#1003)

Other Changes

  • Improve UX
    • oras pull prints better error message when path traversal is required (#978)
    • Mention OCI support in help doc (#904)
    • Mark filtered tag listing as experimental (#993)
  • Improve documentation
    • Fix link to contributing guide (#950)
  • Update dependencies
    • Remove dependencies on docker CLI (#414)
    • Update dependency from github.com/moby/term to golang.org/x/term (#908)
  • Update to Golang 1.20.7
  • Improve tests
  • Workflow
    • Add GitHub actions to lint go code (#981)
    • Update GitHub actions output configuration (#1018)
    • Add GitHub stale actions

Detailed Commits

  • refactor: Logger initializes logging by @TerryHowe in #867
  • test(cov): make unit tests cover more by @qweeah in #905
  • refactor: add root package for Cobra commands by @qweeah in #825
  • build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
  • refactor: unify command contexts by @qweeah in #899
  • test: generate coverage profile during e2e tests by @qweeah in #903
  • build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
  • refactor: replace terminal package used by oras login by @qweeah in #910
  • test(e2e): OCI layout specs for oras tag by @qweeah in #902
  • build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
  • Add make target for e2e by @sajayantony in #924
  • test: make e2e coverage data in action by @qweeah in #926
  • build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
  • feat: use oras-credential-go to do auth by @qweeah in #932
  • doc: fix broken logo link by @FeynmanZhou in #935
  • docs: fix broken links in README by @wangxiaoxuan273 in #937
  • build: using cross compilation in docker build by @northtyphoon in #938
  • build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
  • build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
  • fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
  • build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
  • build: add dependabot for e2e module by @qweeah in #958
  • build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
  • build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
  • build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
  • build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
  • build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
  • fix: correct spec flag description by @qweeah in #964
  • build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
  • chore: add snap for ubuntu by @SamirPS in #965
  • build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
  • chore: simplify e2e scripts and github action by @qweeah in #967
  • Revert "Add help to make file" by @TerryHowe in #974
  • Add help to make file by @TerryHowe in #975
  • build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
  • test: add unit-tests for internal/version.go by @enraiha0307 in #977
  • build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
  • fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
  • chore: add experimental mark to filtered tag listing by @qweeah in #994
  • test(e2e): add test for pushing via absolute path by @qweeah in #991
  • test(e2e): update spec-related constants to string literal by @qweeah in #992
  • chore: update help doc with OCI layout support by @qweeah in #997
  • feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
  • fix: pushing based on temporary file store path by @qweeah in #996
  • chore: update minor version by @qweeah in #1000
  • fix: properly print tree for oras discover by @shizhMSFT in #1005
  • build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
  • build(deps): bump oras-go to main branch by @qweeah in #1004
  • revert: "chore: update minor version (#1000)" by @qweeah in #1014
  • bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015
  • bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
  • chore: fix lint warning by @kranurag7 in #1001
  • chore: fix the links in project readme by @amands98 in #1012
  • chore: update container build prepare job output in Github Actions by @qweeah in #1019
  • test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
  • chore: use golangci lint by @kranurag7 in #986
  • fix: correct e2e specs and CI check configuration by @qweeah in #1023
  • workflow: add github stale action by @sajayantony in #1024
  • fix: move stale into .github/workflows by @sajayantony in #1031
  • build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
  • chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
  • chore: exempt stale if milestone is set by @qweeah in #1036
  • merge: fast forward release-1.0 to main by @qweeah in #1045
  • revert: "feat: add flag to skip deleting obsolete referrers index (#957)" by @qweeah in #1046
  • revert: "bump: update oras version to 1.1.0-rc.1" by @qweeah in #1047
  • bump: update golang version to 1.20.7 by @qweeah in #1049

New Contributors

Read more

v1.1.0-rc.1

11 Jul 08:17
Compare
Choose a tag to compare
v1.1.0-rc.1 Pre-release
Pre-release

New Features

  • Add a new flag --skip-delete-referrers to allow oras commands to skip referrers index clean up

Bug Fixes

  • Fix #995: oras push and oras attach generates unwanted manifest file
  • Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
  • Fix #897: Wrong error log when --distribution-spec is provided with invalid value
  • Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

  • Improve UX
    • oras pull prints better error logs when path traversal is needed
    • Add OCI image layout support in help doc
    • Mark filtered tag listing as experimental
  • Improve documentation
    • Fix broken links in contribution document
  • Update dependencies
    • Remove dependencies on docker CLI
    • Update dependency from github.com/moby/term to golang.org/x/term
  • Update to Golang 1.20.5
  • Improve tests
    • Generate code coverage for E2E tests
    • Better test coverage

Detailed Commits

  • refactor: Logger initializes logging by @TerryHowe in #867
  • test(cov): make unit tests cover more by @qweeah in #905
  • refactor: add root package for Cobra commands by @qweeah in #825
  • build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
  • refactor: unify command contexts by @qweeah in #899
  • test: generate coverage profile during e2e tests by @qweeah in #903
  • build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
  • refactor: replace terminal package used by oras login by @qweeah in #910
  • test(e2e): OCI layout specs for oras tag by @qweeah in #902
  • build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
  • Add make target for e2e by @sajayantony in #924
  • test: make e2e coverage data in action by @qweeah in #926
  • build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
  • feat: use oras-credential-go to do auth by @qweeah in #932
  • doc: fix broken logo link by @FeynmanZhou in #935
  • docs: fix broken links in README by @wangxiaoxuan273 in #937
  • build: using cross compilation in docker build by @northtyphoon in #938
  • build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
  • build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
  • fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
  • build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
  • build: add dependabot for e2e module by @qweeah in #958
  • build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
  • build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
  • build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
  • build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
  • build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
  • fix: correct spec flag description by @qweeah in #964
  • build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
  • chore: add snap for ubuntu by @SamirPS in #965
  • build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
  • chore: simplify e2e scripts and github action by @qweeah in #967
  • Revert "Add help to make file" by @TerryHowe in #974
  • Add help to make file by @TerryHowe in #975
  • build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
  • build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
  • test: add unit-tests for internal/version.go by @enraiha0307 in #977
  • build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
  • fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
  • chore: add experimental mark to filtered tag listing by @qweeah in #994
  • test(e2e): add test for pushing via absolute path by @qweeah in #991
  • test(e2e): update spec-related constants to string literal by @qweeah in #992
  • chore: update help doc with OCI layout support by @qweeah in #997
  • feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
  • fix: pushing based on temporary file store path by @qweeah in #996
  • chore: update minor version by @qweeah in #1000
  • fix: properly print tree for oras discover by @shizhMSFT in #1005
  • build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
  • build(deps): bump oras-go to main branch by @qweeah in #1004
  • revert: "chore: update minor version (#1000)" by @qweeah in #1014
  • bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015

New Contributors

Full Changelog: v1.0.0...v1.1.0-rc.1

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0

20 Mar 10:26
b58e7b9
Compare
Choose a tag to compare

ORAS CLI V1

oras is a CLI tool to manage artifacts in OCI-compliant registries and also a fully functional registry client. After a long journey of development, oras has reached a critical milestone for its first stable release v1.0.0. 🎉🎉🎉

While most features are stable, some features are labeled as preview or experimental for early accesses (#865).

  • Preview features are almost stable but subject to change
  • Experimental features are working in progress and not stable

Changes after v0.16.0 are summarized as follows.

New Features

  • Introduce OCI image layout support with the flag --oci-layout
  • BREAKING CHANGE: oras push and oras attach publish OCI image manifest by default
    • Auto manifest type selection is disabled (#782)
  • BREAKING CHANGE: oras pull pulls artifacts without referenced artifacts. Use flag --include-subject to pull all artifacts recursively.
  • BREAKING CHANGE: oras cp --recursive is re-designed to copy artifacts with attached artifacts (#826, #827)
  • oras discover supports showing annotations of the discovered artifacts via the flag -v
  • oras repo ls supports listing repositories under a certain namespace
  • oras repo tags supports showing tags associated with a particular tag or digest
  • Improve registry developer experience
    • Support temporary DNS resolving with optional port forwarding via the flag --resolve
      • Example: debug and test local registry instances: oras push --resolve prod.registry.io:443:127.0.0.1:5000 prod.registry.io/hello:v1 hi.txt
    • Support custom HTTP header via flag -H, --header
      • Example: correlate operations for specific registry providers: oras repo ls -H X-Correlation-Id=$CORRELATION_ID prod.registry.io
  • Experimental: Introduce compatibility mode for OCI image-spec and distribution-spec
  • Support HTTP client retry on read operations for registry targets
  • Support s390x architecture for releasing oras

Other Changes

  • BREAKING CHANGE: oras blob delete and oras manifest delete return success on non-existent content when the flag --force is specified
  • Improve UX
    • oras discover prints subject digest for root node in tree-view output
    • oras tag prints digest for oras tag command
  • Update dependencies to the latest versions
  • Update to golang 1.20.2
  • Improve documentation
  • Assure quality by end-to-end tests

What's Changed Since RC.2

Bug Fixes

  • Fix #883: manifest entries got removed fromindex.json when tagging an artifact in the OCI layout
  • Minor fixes

Other Changes

  • Better debug experiences by correlating debug logs for HTTP requests
  • More E2E test cases
  • Improved documentation

Detailed Commits

  • docs: Add development environment section to readme by @TerryHowe in #822
  • feat!: improve debug log readability by @wangxiaoxuan273 in #861
  • doc: add feature marks to cmd description and log by @qweeah in #865
  • test(e2e): add OCI layout e2e specs for oras cp by @qweeah in #869
  • test: add e2e tests for custom header feature by @wangxiaoxuan273 in #837
  • test(e2e): OCI layout specs for oras discover by @qweeah in #871
  • build(deps): bump oras.land/oras-go/v2 from 2.0.0-20230224055117-216f081e33ba to 2.0.1 by @dependabot in #875
  • chore: update owners by @shizhMSFT in #866
  • test: add header e2e test cases for oras cp by @wangxiaoxuan273 in #874
  • test(e2e): OCI layout specs for oras repo tags by @qweeah in #873
  • test(e2e): OCI layout e2e specs for oras push by @qweeah in #878
  • test(e2e): OCI layout specs for oras attach by @qweeah in #882
  • test(e2e): add test specs for oras pull by @qweeah in #885
  • test: add e2e specs for manifest fetch under oci-layout by @wangxiaoxuan273 in #888
  • chore: e2e test code clean by @qweeah in #886
  • test: add e2e tests for manifest fetch-config under oci-layout by @wangxiaoxuan273 in #889
  • fix: add error when using media type assertion with oci layout by @wangxiaoxuan273 in #890
  • fix: return error if content and password are both read from stdin by @qweeah in #892
  • test(e2e): layout specs for oras manifest push by @qweeah in #880
  • build(deps): bump oras.land/oras-go/v2 to 2.0.2 by @qweeah in #894
  • bump: update go and release version by @qweeah in #895

Full Changelog: v1.0.0-rc.2...v1.0.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0-rc.2

06 Mar 11:16
3c5e899
Compare
Choose a tag to compare
v1.0.0-rc.2 Pre-release
Pre-release

New Features

  • BREAKING CHANGE: The default value of --image-spec is set to v1.1-image for oras push and oras attach
    • Auto manifest type selection is disabled (#782)
  • BREAKING CHANGE: oras cp --recursive is re-designed to copy artifacts with attached artifacts (#826, #827)
  • oras repo ls supports listing repositories under a certain namespace
  • oras repo tags supports showing tags associated with a particular tag or digest
  • Support HTTP client retry on read operations for registry targets
  • Improve registry developer experience
    • Support specifying port in custom DNS flag --resolve
      • Example: debug and test local registry instances: oras push --resolve prod.registry.io:443:127.0.0.1:5000 prod.registry.io/hello:v1 hi.txt
    • Support custom HTTP header via flag -H, --header
      • Example: correlate operations for specific registry providers: oras repo ls -H X-Correlation-Id=$CORRELATION_ID prod.registry.io

Bug Fixes

  • Fix #782: root node's registry and repository are not shown in the tree view output of oras discover
  • Fix #812: oras cp copies extra index and referrer nodes even when a platform flag is specified
  • Fix #815: temp files remain after oras pull
  • Fix #842: custom DNS rules not working for destination registry in oras cp
  • Fix #846: credential config file is not working for destination registry in oras cp
  • Fix #849: multi tagging fails when extra tags are provided in oras push
  • Minor fixes

Other Changes

  • Improve UX
    • oras discover prints subject digest for root node in tree-view output
    • oras tag prints digest for oras tag command
  • Update to golang 1.20.1
  • Update dependencies to the latest versions
  • Add end-to-end test specs covering all registry-related cases

Detailed Commits

  • bump: bump to golang 1.20 by @wangxiaoxuan273 in #784
  • feat: suppport repo ls sub-namespace by @wangxiaoxuan273 in #768
  • build(deps): bump github.com/docker/cli from 20.10.23+incompatible to 23.0.0+incompatible by @dependabot in #783
  • chore: add vi and mac things to gitignore by @TerryHowe in #777
  • fix: Have make file fail with wrong go version by @TerryHowe in #785
  • feat!: show subject digest in oras discover by @qweeah in #798
  • build(deps): bump github.com/docker/cli from 23.0.0+incompatible to 23.0.1+incompatible by @dependabot in #795
  • feat: enable --header flag to specify headers with requests by @wangxiaoxuan273 in #794
  • test(e2e): add e2e specs for oras cp by @qweeah in #749
  • chore: add CODEOWNERS based on OWNERS.md by @shizhMSFT in #811
  • fix: fix CODEOWNERS by @shizhMSFT in #819
  • chore: move ParseRepoPath to internal package by @qweeah in #817
  • test(e2e): add e2e specs for oras attach by @qweeah in #805
  • chore: add Billy Zha as a maintainer by @shizhMSFT in #820
  • chore: add Terry Howe as a maintainer by @shizhMSFT in #821
  • fix: lazy close file store by @chi-qin in #831
  • test(e2e): take registry logs when e2e fails by @qweeah in #830
  • chore: Add basic PR template by @TerryHowe in #778
  • feat: allow user to specify destination port via resolve flag by @qweeah in #801
  • feat: Add ability query tags for oras repo tags command by @TerryHowe in #800
  • test(e2e): specs for filtered tag listing by @qweeah in #832
  • fix: fix bug when copying recursively with certain platforms by @qweeah in #818
  • build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 in /test/e2e by @dependabot in #833
  • fix: flaky test on multi referrers by @qweeah in #835
  • test(e2e): add specs for oras discover by @qweeah in #828
  • docs: Add CONTRIBUTING.md file by @TerryHowe in #781
  • feat: add retry support to the auth client by @souleb in #838
  • fix: support binary target in oras cp by @qweeah in #843
  • fix!: support multiple config files in oras cp by @qweeah in #847
  • feat: support --header for oras cp by @wangxiaoxuan273 in #848
  • feat: return error when header flags used on oci layout by @qweeah in #841
  • fix: push bug when multi tagging by @qweeah in #850
  • refactor: clone default http transport for registry client by @qweeah in #840
  • fix: Improve error message on oras copy.go with non-existent tags by @khanjasir90 in #852
  • chore: add Billy Zha's GPG key by @qweeah in #844
  • feat!: disable auto type conversion for manifests by @qweeah in #797
  • feat: add digest hint in oras tag logs by @qweeah in #853
  • bump: update oras-go by @qweeah in #856
  • bump: update go to 1.20.1 by @qweeah in #857
  • test(e2e): add e2e specs for custom DNS rules by @qweeah in #855
  • bump: update version to rc.2 by @qweeah in #858

New Contributors

Full Changelog: v1.0.0-rc.1...v1.0.0-rc.2

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0-rc.1

31 Jan 09:47
a98931b
Compare
Choose a tag to compare
v1.0.0-rc.1 Pre-release
Pre-release

New Features

  • Introduce OCI image layout support for ORAS with the flag --oci-layout
    • oras CLI is able to push / pull / copy artifacts from / to the local file system in OCI image layout
    • Folders and tar archives are supported on read
    • Folders are supported on write
    • Examples
      • Download an artifact into an OCI layout folder: oras cp localhost:5000/net-monitor:v1 --to-oci-layout download_folder:v1
      • Show tags in tar archives built by docker buildx build -o dest=out.tar,type=oci: oras repo tags --oci-layout out.tar
    • More examples can be found in the help pages of applicable commands
  • Introduce compatibility mode for ORAS
    • oras push and oras attach allow building artifact using a specific manifest type via the flag --image-spec
    • oras push, oras attach, oras copy, oras discover, oras manifest push, and oras manifest delete allow opting for specific referrers implementation for listing referrers via the flag --distribution-spec
  • BREAKING CHANGE: oras pull will only pull direct artifacts. Use flag --include-subject to pull all artifacts recursively.
  • oras discover supports showing annotations of the discovered artifacts via the flag -v
  • Support temporary DNS resolving for remote server access via the flag --resolve host:port:address for applicable commands
  • Support s390x architecture for releasing oras

Bug Fixes

  • Fix #697: consistent file reference parsing on Windows and other platforms
  • Fix #740: fail to extract symbols links when oras pull to an absolute path
  • Minor fixes

Other Changes

  • BREAKING CHANGE: oras blob delete and oras manifest delete return success on non-existent content when the flag --force is specified
  • Update dependencies to the latest versions
  • Improve documentation
  • Assure quality by end-to-end tests

Detailed Commits

  • test(e2e): add E2E testing utilities and sample specs by @qweeah in #639
  • bump: update oras-go version by @qweeah in #683
  • fix: only pull configuration in root by @qweeah in #684
  • test: add test for oras push by @qweeah in #691
  • bump: change oras-go version to rc6 and change concurrency type by @wangxiaoxuan273 in #715
  • test: add utility for file matching by @qweeah in #701
  • feat!: support configurable subject pulling by @qweeah in #689
  • fix: add log when failed to scan confirmation by @qweeah in #705
  • feat: add directional hints for debug logs by @qweeah in #713
  • test: add e2e specs for oras pull by @qweeah in #693
  • test: add e2e specs for oras blob fetch by @qweeah in #699
  • test: add E2E specs for manifest fetch-config by @qweeah in #711
  • test: add E2E specs covering repo subcommand by @qweeah in #716
  • test: add e2e specs covering oras tag by @qweeah in #718
  • test: add E2E specs for oras blob push by @qweeah in #706
  • test: add E2E specs for manifest push by @qweeah in #702
  • test: add E2E specs for oras manifest delete by @qweeah in #703
  • test: add E2E specs covering blob delete by @qweeah in #708
  • fix: add stdin password for discover, repo ls and repo tags by @qweeah in #725
  • build(deps): bump github.com/docker/cli from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in #726
  • fix: mandates empty referrer to empty array by @qweeah in #729
  • feat: support customized DNS resolving for remote registry by @qweeah in #696
  • fix!: fix colon in media type for windows by @qweeah in #698
  • feat: add s390x release and image to support s390x architecture by @dmittelstaedt in #732
  • feat: show annotations in oras discover tree format output by @qweeah in #735
  • refactor(oci-layout): use Parser to process option input by @qweeah in #736
  • feat!: force deleting a non-existent blob/manifest by @qweeah in #745
  • feat: add compatibility mode for push and attach cmd by @qweeah in #741
  • test(e2e): add oci artifact spec for common registry users by @qweeah in #746
  • feat(oci-layout): support in oras cp by @qweeah in #748
  • feat(oci-layout): support oras tag,oras repo tags and oras pull by @qweeah in #753
  • feat(oci-layout): support in fetch and push for manifest and blob commands by @qweeah in #752
  • feat(oci-layout): support in oras push and oras attach by @qweeah in #750
  • build(deps): bump github.com/docker/cli from 20.10.22+incompatible to 20.10.23+incompatible by @dependabot in #758
  • feat: support specifying distribution spec in discover, cp and manifest push commands by @qweeah in #757
  • build(deps): bump oras-go to v2.0 by @qweeah in #759
  • fix: support fetching manifest in oci image layout by @qweeah in #766
  • feat: add distribution flag to manifest delete by @qweeah in #763
  • feat: support artifact discovering in OCI image layout by @qweeah in #765
  • doc: add ORAS CLI proposal doc for compatibility mode by @FeynmanZhou in #739
  • fix: fix bugs related to the spec --distribution-spec by @Wwwsylvia in #772
  • bump: upgrade golang and alpine versions by @Wwwsylvia in #773
  • bump: release v1.0.0-rc.1 by @Wwwsylvia in #775

New Contributors

Full Changelog: v0.16.0...v1.0.0-rc.1

Notes

This release was signed with 95BB 6CD4 6CA3 0D2B 9CAE E56C 9F2C D437 A97D CB8F (@shizhMSFT's GPG key) which can be found here.