v1.2.2

Changes

• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.1 by @qweeah in #1563
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @Wwwsylvia in #1591

Full Changelog: v1.2.1...v1.2.2

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.3.0-beta.1

New Features

• Add OS and architecture information to oras version

Experimental Features

• Introduce multi-arch image / artifact management
  • New command set oras manifest index to manipulate OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • New flag --artifact-platform for oras push to push artifacts with platform information
• Support fully qualified reference for OCI image layout with a new flag --oci-layout-path (#1505)

Deprecation

• -v, --verbose flag is marked as deprecated for all commands and is by default for the following commands:
  • oras attach
  • oras blob push
  • oras cp
  • oras manifest push
  • oras pull
  • oras push

Bug Fixes

• Remove redundant -v, --verbose flag from below commands:
  • oras blob delete
  • oras blob fetch
  • oras login
  • oras manifest delete
  • oras manifest fetch
  • oras manifest fetch-config
  • oras repo ls
  • oras repo tags
  • oras resolve
  • oras tag
• Fix #1436: oras tag no longer creates referrer tag
• Fix #1442: invalid progress bar shown for empty layers
• Fix #1494: invalid reference in the format output of oras pull
• Minor fixes

Other Changes

• Improve UX
  • Improve error messages
  • Improve diagnose experience
• Improve documentation
• Update dependencies
• Update to Golang 1.23.4
• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0 by @qweeah in #1393
• build(deps): bump golang.org/x/term from 0.20.0 to 0.21.0 by @dependabot in #1399
• chore: Remove deprecated Print method by @TerryHowe in #1398
• chore: Remove unused file by @TerryHowe in #1395
• chore: Update goreleaser to v6 and configuration to v2 by @TerryHowe in #1402
• refactor: Move printer to output package by @TerryHowe in #1394
• Update links in README.md by @bcho in #1408
• refactor: Clean up pull handlers by @TerryHowe in #1407
• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #1410
• refactor: Move verbose into printer object by @TerryHowe in #1406
• refactor: clean status prompts by @qweeah in #1409
• chore: Add format type text by @TerryHowe in #1397
• chore: Increase print test coverage by @TerryHowe in #1411
• refactor: Move descriptor logic to descriptor by @TerryHowe in #1413
• chore: Ignore e2e test go sum file by @TerryHowe in #1416
• refactor: Move generate content key method to descriptor by @TerryHowe in #1415
• refactor: Move two output functions to the output package by @TerryHowe in #1417
• fix(doc): resolve example error for oras tag by @qweeah in #1419
• build(ci): set codecov CLI version to avoid tokenless upload failure by @qweeah in #1421
• refactor: Pass printer to text handler by @TerryHowe in #1420
• refactor: Use printer object for output by @TerryHowe in #1426
• chore: Add json test coverage by @TerryHowe in #1425
• fix: Minor spelling error in test by @TerryHowe in #1429
• refactor: assembles printer in the common output option by @qweeah in #1428
• refactor: Handle stderr similar to stdout by @TerryHowe in #1427
• refactor: reduce printer instantiation & unify stdout/stderr usage by @qweeah in #1433
• build(ci): unset codecov CLI version by @qweeah in #1434
• fix: disable oras tag fallback to tag schema when tagging a referrer by @njucjc in #1435
• refactor: Create tag handlers by @TerryHowe in #1437
• chore: Remove last deprecated method by @TerryHowe in #1438
• refactor: add display handler for cp, tag and manifest push by @qweeah in #1439
• chore(ux): improve error message when attaching without subject artifact by @qweeah in #1430
• build(deps): bump golang.org/x/term from 0.21.0 to 0.22.0 by @dependabot in #1440
• refactor: Move channel write logic to manager by @TerryHowe in #1445
• fix: variable name conflicts with built in function by @TerryHowe in #1448
• refactor: Isolate progress channel in Messenger by @TerryHowe in #1447
• refactor: Take private memory store out of test function by @TerryHowe in #1453
• chore: Bring back the print error by @TerryHowe in #1451
• fix: A couple small fixes to the descriptor test by @TerryHowe in #1452
• refactor: Create text copy handler by @TerryHowe in #1441
• refactor: replace error-ignored cobra output functions by @qweeah in #1454
• build(deps): bump github.com/onsi/gomega from 1.33.1 to 1.34.0 in /test/e2e by @dependabot in #1458
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in /test/e2e by @dependabot in #1462
• feature: Add manifest fetch documentation for digest by @TerryHowe in #1465
• fix: oras repo tags exlude-digest-tags documentation by @TerryHowe in #1467
• fix: Mention the resolve command in manifest fetch help by @TerryHowe in #1466
• refactor: increase test coverage for mac for tty tests by @TerryHowe in #1460
• refactor: Move testutils to general location by @TerryHowe in #1459
• refactor: Make mock fetcher generally available by @TerryHowe in #1455
• build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot in #1468
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 in /test/e2e by @dependabot in #1471
• build(deps): bump golang.org/x/term from 0.22.0 to 0.23.0 by @dependabot in #1470
• refactor: Successor getting with separation of concerns by @TerryHowe in #1443
• refactor: DRY up text_test by @TerryHowe in #1473
• docs: fix typo in help text of 'attach' command by @nmiyake in #1477
• chore: lint fixes for new lint by @TerryHowe in #1478
• chore: reset test coverage package list by @qweeah in #1482
• refactor: remove build constraint from testutils console by @TerryHowe in #1480
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.0 to 2.20.1 in /test/e2e by @dependabot in #1486
• fix: copy prompt skipped was missing by @TerryHowe in #1484
• build(deps): bump github.com/onsi/gomega from 1.34.1 to 1.34.2 in /test/e2e by @dependabot in #1489
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in /test/e2e by @dependabot in #1488
• build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 by @dependabot in #1491
• build: upgrade to Go 1.23.0 by @Wwwsylvia in #1493
• build(deps): bump golang.org/x/term from 0.23.0 to 0.24.0 by @dependabot in #1495
• feat: create index from existing manifests (index create) by @wangxiaoxuan273 in #1475
• fix: reference in the formatted output of oras pull is invalid by @wangxiaoxuan273 in #1496
• docs: add examples for --format by @wangxiaoxuan273 in #1497
• docs: improve the description of cp by @wangxiaoxuan273 in #1498
• feat: --output for oras manifest index create by @wangxiaoxuan273 in #1490
• feature: build binary for OS an...

v1.2.1

Bug Fixes

• Fix #1436: oras tag creates referrers tags unexpectedly

Other Changes

• Improve documentation
• Update dependencies
• Update to Golang 1.23.4

Detailed Commits

• bump: golang version to fix CVE-2024-24790 and CVE-2024-34156 by @qweeah in #1562
• chore: bump golang and dependencies by @qweeah in #1564
• chore: backport main-branch fixes into release-1.2 branch by @qweeah in #1567
• docs: add experimental marks to examples by @qweeah in #1570

Full Changelog: v1.2.0...v1.2.1

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

v1.2.0

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the preview flag --no-tty
• Support deletion of manifests and blobs in OCI image layout
• Support X.509 mTLS authentication with OCI registries

Preview Features

• BREAKING CHANGE Registries supporting Referrers API prior to distribution-spec v1.1.0-rc4 will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
• Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and its referrers
• Promote --image-spec to a preview flag from experimental

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• Introduce formatted output via --format by implementing the specification
  • Formatted output is available to the following commands:
    • oras pull
    • oras push
    • oras attach
    • oras discover
    • oras manifest fetch
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "go-template={{ .digest }}" to print the digest of the manifest using Go template
      • Template can also be specified by --template
• Introduce oras resolve to get the digest of an artifact

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: Snaps build cannot read default credentials file
• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.22.3
• Minor security enhancements

---

What's Changed Since RC.1

Other Changes

• Improve documentation
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-rc.1 by @qweeah in #1381
• fix: remove non-classic snap plugins by @qweeah in #1383
• fix: oras cp documentation by @TerryHowe in #1384
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #1385
• refactor: Get rid of deprecated PrintStatus method by @TerryHowe in #1378
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.3 to 2.18.0 in /test/e2e by @dependabot in #1388
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.18.0 to 2.19.0 in /test/e2e by @dependabot in #1390
• chore: Remove deprecated PrintStatus method by @TerryHowe in #1389
• doc: verify local files by @qweeah in #1386
• fix: remove call to deprecated print by @TerryHowe in #1392

Full Changelog: v1.2.0-rc.1...v1.2.0

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

v1.2.0-rc.1

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Support X.509 mTLS authentication with OCI registries
• PREVIEW Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• BREAKING CHANGE Introduce new go templating experience to all commands support --format based on the spec
  • BREAKING CHANGE Require explicit type assertion --format go-template=TEMPLATE
  • BREAKING CHANGE Change field selectors from uppercased to lowercased
  • BREAKING CHANGE Rename digested reference selector to reference
  • Examples:
    • --format go-template="{{ .digest }}" to print the digest of the newly pushed manifest using Go template
  • Template can also be specified by --template
• Introduce output control via --format to oras pull, oras manifest fetch, and oras discover

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: snap build cannot read default credentials file
• Fix #1268: oras blob fetch failed to output to stdout in terminal mode
• Fix #1300: pushing with multiple tags will corrupt --format output
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve live progress output for terminal
  • Introduce colored output
  • Smooth download speed display with reduced fluctuation
• Update dependencies
• Update to Golang 1.22.3

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-beta.1 by @qweeah in #1266
• doc (spec): add error message guideline by @FeynmanZhou in #1163
• build(deps): bump github.com/containerd/console from 1.0.3 to 1.0.4 by @dependabot in #1269
• build(deps): bump golang.org/x/term from 0.16.0 to 0.17.0 by @dependabot in #1270
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.15.0 to 2.16.0 in /test/e2e by @dependabot in #1278
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in #1272
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 in /test/e2e by @dependabot in #1271
• fix(e2e): update ZOT image by @qweeah in #1284
• build(deps): bump golang.org/x/term from 0.17.0 to 0.18.0 by @dependabot in #1279
• test(unit): exclude darwin from go build constraint by @wangxiaoxuan273 in #1289
• refactor: pass cobra.Command to all cmd exec functions by @TerryHowe in #1285
• fix: make --output - implies --no-tty by @wangxiaoxuan273 in #1286
• build(actions): update github actions for Node 20 by @TerryHowe in #1287
• fix: Revert github actions coverage until fixed by @TerryHowe in #1290
• feat: Use cobra.Command.OutOrStdout method for output by @TerryHowe in #1288
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /test/e2e by @dependabot in #1296
• build(deps): bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /test/e2e by @dependabot in #1297
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /test/e2e by @dependabot in #1305
• refactor: add stdout to metadata handlers by @qweeah in #1312
• bump: bump oras-go to 2.5.0 by @wangxiaoxuan273 in #1303
• refactor: use command output in status output by @qweeah in #1314
• chore: using const to replace string by @LinuxSuRen in #1316
• refactor: make command accessible in option parser by @wangxiaoxuan273 in #1315
• bump: update golang to 1.22 by @TerryHowe in #1282
• build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #1323
• build(deps): bump golang.org/x/term from 0.18.0 to 0.19.0 by @dependabot in #1322
• bump(ci): update codecov gha to v4 by @qweeah in #1324
• bump(ci): update golangci-lint to v4 by @qweeah in #1325
• feat: support --format for oras pull by @qweeah in #1293
• feat: support --platform for oras attach by @qweeah in #1309
• feat: show artifact type when pushing files by @wangxiaoxuan273 in #1320
• fix: oras push should return error when artifacttype is empty for spec 1.1 by @wangxiaoxuan273 in #1317
• build(ci): add dependabot to update ci version automatically by @qweeah in #1326
• build(deps): bump apache/skywalking-eyes from 0.4.0 to 0.6.0 by @dependabot in #1328
• build(deps): bump goreleaser/goreleaser-action from 2 to 5 by @dependabot in #1329
• build(deps): bump actions/setup-go from 4 to 5 by @dependabot in #1331
• build(deps): bump actions/stale from 8 to 9 by @dependabot in #1330
• build(deps): bump github/codeql-action from 2 to 3 by @dependabot in #1332
• feat: support --format in manifest fetch command by @qweeah in #1295
• ux: improve the usage doc of --image-spec by @wangxiaoxuan273 in #1334
• feat: support --format in oras discover by @qweeah in #1299
• chore: add preview feature mark to platform-specific attaching by @qweeah in #1337
• feat: oras discover should show a placeholder of artifactType if it's not presented by @wangxiaoxuan273 in #1336
• feat: make image spec preview by @wangxiaoxuan273 in #1338
• feat: make --identity-token an alias of --password by @wangxiaoxuan273 in #1294
• fix: discard tagging output when pushing with formatted output by @qweeah in #1302
• feat: add color to progress mark and bar by @qweeah in #1344
• feat: make all go-template key lower-cased by @qweeah in #1343
• feat: improve error message when detecting conflicting flags by @wangxiaoxuan273 in #1345
• feat: add mTLS options by @sabre1041 in #1319
• chore: set go version to 1.22.0 in go.mod by @Amulyam24 in #1351
• fix: fix failed Windows unit test by @wangxiaoxuan273 in #1352
• chore(ux): optimize progress bar by @qweeah in #1349
• fix: fix error message when output is used before format for oras discover by @wangxiaoxuan273 in #1354
• fix: return error when --format and --pretty are both used by @wangxiaoxuan273 in #1359
• fix: ignore --pretty when --output is used for oras manifest fetch by @wangxiaoxuan273 in #1363
• build(deps): bump github.com/onsi/gomega from 1.32.0 to 1.33.0 in /test/e2e by @dependabot in #1364
• build(deps): bump golangci/golangci-lint-action from 4 to 5 by @dependabot in #1370
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.1 to 2.17.2 in /test/e2e by @dependabot in #1369
• feat: improve error message of when a set of flags is required to use together by @wangxiaoxuan273 in #1358
• build(deps): bump github.com/onsi/gomega from 1.33.0 to 1.33.1 in /test/e2e by @dependabot in #1371
• refactor: move logger method to command by @TerryHowe in #1355
• refactor: Move ShortDigest out of display package by @te...

v1.2.0-beta.1

New Features

• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the flag --no-tty
• Support deletion of manifests and blobs in OCI image layout

Experimental Features

• BREAKING CHANGE oras is compliant with OCI image-spec v1.1.0-rc6 and distribution-spec v1.1.0-rc4
  • Registries supporting Referrers API of older version of distribution-spec will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
  • Known registries supporting the distribution-spec v1.1.0-rc4:
    • Zot v2.0.0-rc5 and later versions
    • Harbor v2.10.0 and later versions
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and their referrer artifacts
• Introduce oras resolve to get the digest of an artifact
• Introduce output control by specifying --format to oras push and oras attach
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "{{ .Digest }}" to print the digest of the newly pushed manifest using Go template
  • Known issue: pushing with multiple tags output unexcepted results and will be fixed in future versions

Bug Fixes

• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject

Other Changes

• Enhance troubleshooting experience with improved error messages
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.21.6
• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.1.0 by @qweeah in #1103
• fix: allow HTTPS for localhost by @qweeah in #1107
• perf: optimize request count for manifest and blob deletion by @qweeah in #1109
• revert: "perf: optimize request count for manifest and blob deletion" by @qweeah in #1115
• perf: optimize request count for manifest and blob deletion by @qweeah in #1116
• chore: fix typo by @testwill in #1121
• feat: support copying referrers for multi-arch images by @qweeah in #1122
• build(deps): bump golang.org/x/term from 0.11.0 to 0.12.0 by @dependabot in #1123
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /test/e2e by @dependabot in #1126
• fix: remove root from virtual referrers by @shizhMSFT in #1130
• build: release ppc64le/riscv64 and improve reproducibility by @katexochen in #1118
• build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 by @dependabot in #1137
• build(deps): bump golang.org/x/term from 0.12.0 to 0.13.0 by @dependabot in #1136
• build(deps): bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /test/e2e by @dependabot in #1132
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /test/e2e by @dependabot in #1140
• build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1141
• feat: support progressed output in blob push and blob get by @qweeah in #1113
• perf: reduce auth request count for oras cp by @qweeah in #1142
• fix: resolve duplicated debug log for oras cp by @qweeah in #1139
• build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1144
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.2.0 to 0.3.1 by @dependabot in #1145
• build(deps): bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /test/e2e by @dependabot in #1147
• feat: support progress output for attach, push and copy commands by @qweeah in #1138
• build(deps): bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /test/e2e by @dependabot in #1153
• build(deps): upgrade image-spec to 1.1.0-rc5 and oras-go to the latest by @shizhMSFT in #1154
• chore: add reference details to registry errors by @sajayantony in #1152
• feat: support progress output in pull by @qweeah in #1148
• feat: remove empty artifact CLI message and show hints for pulling OCI image layout by @sajayantony in #1157
• fix: should not print copy hint for manifest in verbose mode by @qweeah in #1165
• feat: make --debug imply --no-tty by @qweeah in #1162
• fix: avoid copy suggestion when only config is skipped by @sajayantony in #1164
• fix: resolve regression made in #1164 by @qweeah in #1170
• fix: atomic bool for layer skipped during pulling by @qweeah in #1168
• build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 by @dependabot in #1172
• fix: update error message for repo ls by @sajayantony in #1169
• test(e2e): add specs to hint for pulling unnamed layers by @qweeah in #1174
• build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in #1171
• fix: avoid overflow in progress bar percentage by @qweeah in #1178
• chore(ux): add newline to make TTY output copy friendly by @qweeah in #1180
• build(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 by @dependabot in #1181
• build(deps): bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /test/e2e by @dependabot in #1182
• test(e2e): fix a false positive test for blob get by @qweeah in #1184
• chore: make error of non-existed source OCI layout more readable by @qweeah in #1176
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.1 in /test/e2e by @dependabot in #1185
• feat: add resolve command by @sajayantony in #1187
• test(e2e): add test for resolve command by @qweeah in #1188
• build(deps): bump golang.org/x/term from 0.14.0 to 0.15.0 by @dependabot in #1194
• doc: add example for attach with custom layer media type by @qweeah in #1195
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.1 to 2.13.2 in /test/e2e by @dependabot in #1196
• feat: scrub Set-Cookie header in debug logs by @qweeah in #1190
• feat: support manifest and blob deletion for OCI layout by @qweeah in #1197
• build(ci): add workflow for releasing main image by @kranurag7 in #1191
• build(ci): merge tag and main ghcr build release file by @qweeah in #1205
• test(e2e): add spec to cover legacy docker config file by @qweeah in #1206
• feat: improve returned error for invalid arguments by @qweeah in #1201
• fix: bug in pushing with multiple tags by @qweeah in #1209
• chore(ux): improve error message for oras tag list by @qweeah in #1219
• build(ci): enforce coverage check by @qweeah in #1220
• chore(ux): improve error output for unknown spec flag by @qweeah in #1221
• build(deps): bump oras-go/v2 to main branch by @qweeah in #1223
• fix: resolve error in help doc of distribution spec flag by @qweeah in #1229
• build(ci): make coverage upload and calculation mandatory by @qweeah in https...

v1.1.0

New Features

• oras is compliant with OCI image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3
  • Support copying or pulling image index with a subject field
  • Output OCI distribution warning headers
• Improve oras push
  • Formalize the default config to empty descriptor (previously application/vnd.unknown.config.v1+json)
  • Default to artifact type application/vnd.unknown.artifact.v1 if not specified
  • Allow artifact type and config to be specified at the same time

Experimental Features

• BREAKING CHANGE: Redesign the flag --image-spec
  • Add options v1.0 and v1.1
  • Remove options v1.1-image and v1.1-artifact
  • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
• BREAKING CHANGE: Remove the flag --image-spec from oras attach

Bug Fixes

• Fix #995: oras push and oras attach generates unwanted manifest file
• Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
• Fix #897: Wrong error log when --distribution-spec is provided with invalid value
• Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

• Improve UX, documentation, performance, tests and code coverage
• Update dependencies
• Update to Golang 1.21.0

---

What's Changed Since RC.2

Other Changes

• Improve performance
  • Reduced number of auth requests for push and attach (#1084)
• Improve documentation
  • Update security guide (#1017)
  • Update compatibility mode doc (#1065)
• Update dependencies
  • Bump oras-go to 2.3.0
• Improve tests

Detailed Commits

• bump: tag and release ORAS CLI v1.1.0-rc.2 by @qweeah in #1078
• test(e2e): add zot as a testing backend by @qweeah in #1072
• Add SECURITY.md file by @TerryHowe in #1082
• test(e2e): update e2e specs for oras attach by @qweeah in #1081
• test(e2e): use ZOT as testing backend for oras blob specs by @qweeah in #1083
• test(e2e): fix logging when e2e test fails by @qweeah in #1090
• test(e2e): migrate oras push specs to ZOT by @qweeah in #1085
• test(e2e): migrate oras pull specs to ZOT by @qweeah in #1086
• test(e2e): migrate oras tag specs to ZOT by @qweeah in #1087
• test(e2e): migrate oras repo specs to ZOT by @qweeah in #1088
• test(e2e): migrate oras manifest specs to ZOT by @qweeah in #1089
• perf: save auth requests for push and attach by @Wwwsylvia in #1097
• test(e2e): re-bake test data by @qweeah in #1094
• test(e2e): migrate oras cp and oras discover specs to ZOT by @qweeah in #1093
• test(e2e): cover pulling test for image spec 1.1.0-rc.2 artifact by @qweeah in #1098
• test(e2e): add tests to cover OCI spec v1.1.0-rc.4 and OCI distribution spec 1.1.0-rc3 by @qweeah in #1099
• test(e2e): add doc for ZOT test data by @qweeah in #1100
• build(deps): bump oras-go to v2.3.0 by @qweeah in #1101
• doc: update example for oras push by @qweeah in #1102
• doc: update compatibility mode doc to align with ORAS v1.1.0 by @FeynmanZhou in #1068

Full Changelog: v1.1.0-rc.2...v1.1.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.1.0-rc.2

New Features

• oras is compliant with OCI image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3
  • Support copying index with subject
  • Output OCI distribution warning headers
• Improve oras push
  • Formalize the default config to empty descriptor (previously application/vnd.unknown.config.v1+json)
  • Default to artifact type application/vnd.unknown.artifact.v1 if not specified
  • Allow artifact type and config to be specified at the same time

Experimental Features

• BREAKING CHANGE: Redesign the flag --image-spec
  • Add options v1.0 and v1.1
  • Remove options v1.1-image and v1.1-artifact
  • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
• BREAKING CHANGE: Remove the flag --image-spec from oras attach

Deprecation

• Remove the flag --skip-delete-referrers (#1041) introduced in v1.1.0-rc.1

Other Changes

• Improve UX
  • Make error logs more readable (#1021)
• Improve documentation
  • Fix broken links in project readme (#1017)
• Update dependencies
• Update to Golang 1.21.0
• Improve tests
  • Add unit tests for cred store (#972)
  • Fix E2E false positive result (#1022)

Detailed commits

• bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
• chore: fix lint warning by @kranurag7 in #1001
• chore: fix the links in project readme by @amands98 in #1012
• chore: update container build prepare job output in Github Actions by @qweeah in #1019
• test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
• chore: use golangci lint by @kranurag7 in #986
• fix: correct e2e specs and CI check configuration by @qweeah in #1023
• workflow: add github stale action by @sajayantony in #1024
• fix: move stale into .github/workflows by @sajayantony in #1031
• build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
• chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
• chore: exempt stale if milestone is set by @qweeah in #1036
• chore: add triage labels by @FeynmanZhou in #1055
• chore: make error returned by oras tag more readable by @qweeah in #1058
• revert: "feat: add flag to skip deleting obsolete referrers index" by @qweeah in #1060
• feat: disable referrers index GC by default by @qweeah in #1059
• build(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 by @dependabot in #1051
• feat: pack OCI image spec v1.1 manifests by @qweeah in #1054
• bump: use new packing function in oras-go by @qweeah in #1070
• feat: support warning in remote targets by @qweeah in #1057
• chore: align naming of pack option to oras-go by @qweeah in #1073
• bump: update golang to 1.21 by @qweeah in #1074
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.11.0 to 2.12.0 in /test/e2e by @dependabot in #1075

New Contributors

• @kranurag7 made their first contribution in #1001
• @amands98 made their first contribution in #1012
• @1Shubham7 made their first contribution in #1026

Full Changelog: v1.1.0-rc.1...v1.1.0-rc.2

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.1

Bug Fixes

• oras push and oras attach generates unwanted manifest file (#995)
• Path validation not enforced for oras attach and oras push (#983, #980, #973)
• Wrong error information when --distribution-spec is provided with invalid value (#897)
• Tree view print bug in oras discover (#1003)

Other Changes

• Improve UX
  • oras pull prints better error message when path traversal is required (#978)
  • Mention OCI support in help doc (#904)
  • Mark filtered tag listing as experimental (#993)
• Improve documentation
  • Fix link to contributing guide (#950)
• Update dependencies
  • Remove dependencies on docker CLI (#414)
  • Update dependency from github.com/moby/term to golang.org/x/term (#908)
• Update to Golang 1.20.7
• Improve tests
  • Generate code coverage for E2E tests (#900)
  • Add more tests (#904, #901, #972, #1022)
• Workflow
  • Add GitHub actions to lint go code (#981)
  • Update GitHub actions output configuration (#1018)
  • Add GitHub stale actions

Detailed Commits

• refactor: Logger initializes logging by @TerryHowe in #867
• test(cov): make unit tests cover more by @qweeah in #905
• refactor: add root package for Cobra commands by @qweeah in #825
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
• refactor: unify command contexts by @qweeah in #899
• test: generate coverage profile during e2e tests by @qweeah in #903
• build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
• refactor: replace terminal package used by oras login by @qweeah in #910
• test(e2e): OCI layout specs for oras tag by @qweeah in #902
• build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
• Add make target for e2e by @sajayantony in #924
• test: make e2e coverage data in action by @qweeah in #926
• build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
• feat: use oras-credential-go to do auth by @qweeah in #932
• doc: fix broken logo link by @FeynmanZhou in #935
• docs: fix broken links in README by @wangxiaoxuan273 in #937
• build: using cross compilation in docker build by @northtyphoon in #938
• build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
• build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
• fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
• build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
• build: add dependabot for e2e module by @qweeah in #958
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
• build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
• fix: correct spec flag description by @qweeah in #964
• build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
• chore: add snap for ubuntu by @SamirPS in #965
• build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
• chore: simplify e2e scripts and github action by @qweeah in #967
• Revert "Add help to make file" by @TerryHowe in #974
• Add help to make file by @TerryHowe in #975
• build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
• test: add unit-tests for internal/version.go by @enraiha0307 in #977
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
• fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
• chore: add experimental mark to filtered tag listing by @qweeah in #994
• test(e2e): add test for pushing via absolute path by @qweeah in #991
• test(e2e): update spec-related constants to string literal by @qweeah in #992
• chore: update help doc with OCI layout support by @qweeah in #997
• feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
• fix: pushing based on temporary file store path by @qweeah in #996
• chore: update minor version by @qweeah in #1000
• fix: properly print tree for oras discover by @shizhMSFT in #1005
• build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
• build(deps): bump oras-go to main branch by @qweeah in #1004
• revert: "chore: update minor version (#1000)" by @qweeah in #1014
• bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015
• bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
• chore: fix lint warning by @kranurag7 in #1001
• chore: fix the links in project readme by @amands98 in #1012
• chore: update container build prepare job output in Github Actions by @qweeah in #1019
• test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
• chore: use golangci lint by @kranurag7 in #986
• fix: correct e2e specs and CI check configuration by @qweeah in #1023
• workflow: add github stale action by @sajayantony in #1024
• fix: move stale into .github/workflows by @sajayantony in #1031
• build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
• chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
• chore: exempt stale if milestone is set by @qweeah in #1036
• merge: fast forward release-1.0 to main by @qweeah in #1045
• revert: "feat: add flag to skip deleting obsolete referrers index (#957)" by @qweeah in #1046
• revert: "bump: update oras version to 1.1.0-rc.1" by @qweeah in #1047
• bump: update golang version to 1.20.7 by @qweeah in #1049

New Contributors

• @northtyphoon made their first contribution in #938
• @yash7raut made their first contribution in #951
• @SamirPS made their first contribution in #965
• @enraiha0307 made their first contribution in #977
• @suganyas made their first contribution in #988
• @kranurag7 made their first contribution in #1001
• @amands98 ...

v1.1.0-rc.1

New Features

• Add a new flag --skip-delete-referrers to allow oras commands to skip referrers index clean up

Bug Fixes

• Fix #995: oras push and oras attach generates unwanted manifest file
• Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
• Fix #897: Wrong error log when --distribution-spec is provided with invalid value
• Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

• Improve UX
  • oras pull prints better error logs when path traversal is needed
  • Add OCI image layout support in help doc
  • Mark filtered tag listing as experimental
• Improve documentation
  • Fix broken links in contribution document
• Update dependencies
  • Remove dependencies on docker CLI
  • Update dependency from github.com/moby/term to golang.org/x/term
• Update to Golang 1.20.5
• Improve tests
  • Generate code coverage for E2E tests
  • Better test coverage

Detailed Commits

• refactor: Logger initializes logging by @TerryHowe in #867
• test(cov): make unit tests cover more by @qweeah in #905
• refactor: add root package for Cobra commands by @qweeah in #825
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
• refactor: unify command contexts by @qweeah in #899
• test: generate coverage profile during e2e tests by @qweeah in #903
• build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
• refactor: replace terminal package used by oras login by @qweeah in #910
• test(e2e): OCI layout specs for oras tag by @qweeah in #902
• build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
• Add make target for e2e by @sajayantony in #924
• test: make e2e coverage data in action by @qweeah in #926
• build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
• feat: use oras-credential-go to do auth by @qweeah in #932
• doc: fix broken logo link by @FeynmanZhou in #935
• docs: fix broken links in README by @wangxiaoxuan273 in #937
• build: using cross compilation in docker build by @northtyphoon in #938
• build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
• build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
• fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
• build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
• build: add dependabot for e2e module by @qweeah in #958
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
• build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
• fix: correct spec flag description by @qweeah in #964
• build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
• chore: add snap for ubuntu by @SamirPS in #965
• build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
• chore: simplify e2e scripts and github action by @qweeah in #967
• Revert "Add help to make file" by @TerryHowe in #974
• Add help to make file by @TerryHowe in #975
• build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
• test: add unit-tests for internal/version.go by @enraiha0307 in #977
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
• fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
• chore: add experimental mark to filtered tag listing by @qweeah in #994
• test(e2e): add test for pushing via absolute path by @qweeah in #991
• test(e2e): update spec-related constants to string literal by @qweeah in #992
• chore: update help doc with OCI layout support by @qweeah in #997
• feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
• fix: pushing based on temporary file store path by @qweeah in #996
• chore: update minor version by @qweeah in #1000
• fix: properly print tree for oras discover by @shizhMSFT in #1005
• build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
• build(deps): bump oras-go to main branch by @qweeah in #1004
• revert: "chore: update minor version (#1000)" by @qweeah in #1014
• bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015

New Contributors

• @northtyphoon made their first contribution in #938
• @yash7raut made their first contribution in #951
• @SamirPS made their first contribution in #965
• @enraiha0307 made their first contribution in #977
• @suganyas made their first contribution in #988

Full Changelog: v1.0.0...v1.1.0-rc.1

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.