ORAS v1.3.0 milestone discussion

[FeynmanZhou]

Hi ORAS fellows:

ORAS continues to follow a quarter-based iterative release cadence in 2024. ORAS v1.2.0-beta.1 was released on Feb 7 and is going to be stable in May (updated: released on May 30).

It's time to discuss and determine the v1.3.0 milestone and release plan for v1.2.0 in the community. After regularly triaged all GitHub issues, I grouped the major enhancements into four aspects as follows.

This is an open discussion and I am also open to any suggestions. Feel free to share anything feature requests you think are missing below or should be prioritized.

Improve verbose logs for all ORAS commands to enhance the troubleshooting experience

Make the verbose logs consistent, useful, concise, and human-readable. Users can easily locate the root cause by analyzing the verbose logs. Formulize the CLI output guideline to provide a unified reference for future command output.

• Add verbose http logging to blob fetch #911
• Improve verbose logging for oras commands #1091
• Incomplete output when copying #916

Part of its enhancements could be considered in ORAS v1.2.1 if possible.

Support multi-arch image index management

Most of the open-source projects support multi-arch images. Enable users to push/attach a multi-arch image or an image index by leveraging the OCI image index.

• support --platform in oras push and oras attach #1066
• Support multi-arch image/artifact push #1053
• Add platform flag to attach command #813

This will be marked as a preview feature when we introduce a brand-new feature

Extend functionality of oras pull/push

These are frequently asked feature requests so it would be good to define the specifications in v1.3.0 at least.

• Support pulling an OCI artifact/image from registry to a local OCI archive #1160 and another duplicated Add new commands to support uploading and downloading images #1366
• Support pulling referrers from an image manifest #1308

Streamline annotating experience (nice to have)

Annotating experience is critical to allow users to update the OCI image annotation metadata. For example, in the containers secure supply chain, users can easily update the image lifecycle metadata without learning the OCI Spec. such as adding "End-of-support" metadata to an OCI image manifest.

In addition, ORAS requires a static JSON file as an input to update annotations in some cases. This is not convenient in automation and scripting scenario.

• append annotations instead of overwrite? #571

This will be marked as a preview feature when we introduce a brand-new feature

Improve user experience and performance

• X509 Authentication with OCI registry #491
• oras discover should show a placeholder of artifactType if it's not presented in an index referrer #1108
• Make --identity-token an alias of --password #742
• Show artifact type when pushing files #1061

[FeynmanZhou]

As we discussed in the community meeting on Mar 26, 2024, @sajayantony suggested consider another two enhancements for oras pull. It would be better that we could define specifications in ORAS v1.3.0 for these two:

• Support pulling an OCI artifact/image from registry to a local OCI archive #1160
• Support pulling referrers from an image manifest #1308

[TerryHowe]

Looks good, I just added a comment to one of the issues.