oras-project/oras-go

🐛 Security Fixes

• Drop the `Authorization` header on cross-origin redirects to prevent origin credentials leaking to a redirect target on a different scheme/port of the same host ([GHSA-vh4v-2xq2-g5cg](https://github.com/oras-project/oras-go/security/advisories/GHSA-vh4v-2xq2-g5cg))
• Validate the bearer `realm` host before sending credentials to prevent credential exfiltration to an attacker-controlled token service, including TLS downgrades and IP-literal metadata endpoints; adds `TrustedRealmHosts` ([GHSA-28r5-37g7-p6mp](https://github.com/oras-project/oras-go/security/advisories/GHSA-28r5-37g7-p6mp), [GHSA-xf85-363p-868w](https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w))
• Validate the `Location` host before blob upload to prevent credentials being forwarded to a cross-host upload endpoint (SSRF / CWE-918) (#1152, [GHSA-jxpm-75mh-9fp7](https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7))
• Reject descriptor sizes exceeding 32 MiB in `content.ReadAll` to prevent a crafted OCI layout from triggering a `makeslice` panic and crashing the process (#1153, [GHSA-f36w-mj3v-6jqv](https://github.com/oras-project/oras-go/security/advisories/GHSA-f36w-mj3v-6jqv))
• Resolve symlinks when enforcing the `workingDir` write boundary in `content/file`, blocking writes that escape the boundary via a symlinked path component when `AllowPathTraversalOnWrite=false`

🐛 Bug Fixes

• `graph.Memory` should use digest as map key (#1095)
• Fix credentials key for the Docker `registry-1` host (#966)
• Support an empty credentials file (#959)

📋 Other Changes

• Add GitOps release workflow with goreleaser (#1161)
• Shift the Go support window to [1.24, 1.25] (#991)
• Run `go modernize` (#1005)
• Sync `CODEOWNERS` and `OWNERS.md` from main to v2 (#1122)
• Remove scripts reference from the Makefile (#960)
• Bump `golang.org/x/sync` 0.14.0 → 0.20.0 (#971, #978, #1001, #1037, #1078, #1121)
• Bump GitHub Actions: `actions/checkout` 4→5 (#989), `actions/setup-go` 5→6 (#998), `actions/stale` 9→10 (#997), `github/codeql-action` 3→4 (#1016)

📋 What's Changed

• build(deps): bump github.com/docker/cli from 27.1.0+incompatible to 27.1.1+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/797
• build(deps): bump github.com/docker/docker from 27.1.0+incompatible to 27.1.1+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/798
• build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/800
• build(deps): bump golang.org/x/crypto from 0.25.0 to 0.26.0 by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/802
• build(deps): bump github.com/docker/docker from 27.1.1+incompatible to 27.1.2+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/804
• build(deps): bump github.com/docker/cli from 27.1.1+incompatible to 27.1.2+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/805
• build(deps): bump github.com/docker/cli from 27.1.2+incompatible to 27.2.0+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/809
• build(deps): bump github.com/docker/docker from 27.1.2+incompatible to 27.2.0+incompatible by @dependabot[bot] in https://github.com/oras-project/oras-go/pull/810
• + 85 more

✨ New Features

• Upgrade to [`image-spec v1.1.1`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.1) and [`distribution-spec v1.1.1`](https://github.com/opencontainers/distribution-spec/releases/tag/v1.1.1)
• Support context cancellation in [`file.Store.Add()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.6.0/content/file#Store.Add)
• Introduce [`credentials.NewMemoryStoreFromDockerConfig`](https://pkg.go.dev/oras.land/oras-go/v2@v2.6.0/registry/remote/credentials#NewMemoryStoreFromDockerConfig) to load Docker config bytes into an in-memory credentials store
• Add `PreservePermissions` option to [file store](https://pkg.go.dev/oras.land/oras-go/v2@v2.6.0/content/file#Store) to retain original permissions when extracting tar archives
• Introduce [`oras.CopyError`](https://pkg.go.dev/oras.land/oras-go/v2@v2.6.0#CopyError) to identify error sources in copy operations

🐛 Bug Fixes

• Fix #640: Unclear error message from `oci.NewFromTar`
• Fix #865: Symbolic links are not automatically overwritten when extracted from tar archive to File store
• Fix #851: Dot‑prefixed paths in tar archives were not recognized by `ReadOnlyOCIStore`
• Fix #880: The `index.json` generated by the OCI store lacked a `mediaType` field
• Fix #895: The `Docker-Content-Digest` header was not verified in `Repository.Blobs().Fetch()`
• Fix #916: Incorrect use of `atomic.Value` in the `syncutil.Go` utility function causes panics
• Fix #923: Pushing descriptors with invalid digests to memory or file store caused panics
• Other minor bug fixes

📝 Documentation

• Add documentation for artifact modeling
• Add documentation for targets and content store
• Add quickstart tutorial
• Improve examples
• Other minor improvements

📋 Other Changes

• Upgrade the Go support window to `[1.23, 1.24]`
• Increase test coverage to 80%
• Update dependencies
• Minor optimization

📦 Detailed Commits

• fix: cancel goroutine before the next one is created by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/739
• build(deps): bump apache/skywalking-eyes from 0.5.0 to 0.6.0 by @dependabot in https://github.com/oras-project/oras-go/pull/740
• bump(ci): update codecov to v4 by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/741
• docs: update migration guide and copy doc by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/752
• test: fix file closing issue on windows by @shizhMSFT in https://github.com/oras-project/oras-go/pull/764
• docs: document PackManifestOptions to make PackManifest reproducible by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/749
• build: enforce diff code coverage of 80% by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/769
• fix: add missing operation to fs path error by @qweeah in https://github.com/oras-project/oras-go/pull/799
• + 38 more

✨ New Contributors

• @lucasrod16 made their first contribution in https://github.com/oras-project/oras-go/pull/803
• @programmer04 made their first contribution in https://github.com/oras-project/oras-go/pull/850
• @sammy-da made their first contribution in https://github.com/oras-project/oras-go/pull/891
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.5.0...v2.6.0

📋 What's Changed

• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in https://github.com/oras-project/oras-go/pull/707
• build(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 by @dependabot in https://github.com/oras-project/oras-go/pull/705
• build(deps): bump github.com/docker/cli from 25.0.1+incompatible to 25.0.3+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/706
• build(deps): bump golang.org/x/crypto from 0.19.0 to 0.21.0 by @dependabot in https://github.com/oras-project/oras-go/pull/719
• build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in https://github.com/oras-project/oras-go/pull/718
• build: update to Go 1.19 by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/723
• build(deps): bump github.com/docker/docker from 25.0.1+incompatible to 25.0.4+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/722
• build(deps): bump github.com/docker/cli from 25.0.3+incompatible to 25.0.4+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/721
• + 36 more

✨ New Features

• Upgrade to [`image-spec v1.1.0`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0) and [`distributio-spec v1.1.0`](https://github.com/opencontainers/distribution-spec/releases/tag/v1.1.0)
• Introduce `oras.PackManifestVersion1_1` for packing [OCI Image Manifest](https://github.com/opencontainers/image-spec/blob/v1.1.0/manifest.md) defined in `image-spec v1.1.0`

🗑️ Deprecation

• `oras.PackManifestVersion1_1_RC4` is deprecated and not recommended for future use. Use `oras.PackManifestVersion1_1` instead.

🐛 Bug Fixes

• Fix #698: [`registry.ParseReference`](https://pkg.go.dev/oras.land/oras-go/v2/registry#ParseReference) returns false positive when registry is empty
• Fix #727: Subsequent calls to [`credentials.DynamicStore.Put`](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote/credentials#DynamicStore.Put) will not set the detected credential store after the first failed attempt
• Fix #730: [`file.Store`](https://pkg.go.dev/oras.land/oras-go/v2/content/file#Store) has race conditions when restoring content with the same name

📋 Other Changes

• Update the Go support window to `[1.21, 1.22]`
• Update unit tests and examples
• Improve performance

📦 Detailed Commits

• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in https://github.com/oras-project/oras-go/pull/708
• feat: upgrade to distribution-spec v1.1.0 by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/720
• build: bump go version by @dextrot in https://github.com/oras-project/oras-go/pull/715
• test: add a new case for UnwrapNopCloser by @shizhMSFT in https://github.com/oras-project/oras-go/pull/725
• perf: use new built-in methods introduced before go 1.22 by @shizhMSFT in https://github.com/oras-project/oras-go/pull/726
• fix: check empty registry name by @shizhMSFT in https://github.com/oras-project/oras-go/pull/729
• fix(DynamicStore): retry `setCredsStore` on next `PUT` by @shizhMSFT in https://github.com/oras-project/oras-go/pull/728
• fix(file.Store): fix race condition on restoring the same named content by @shizhMSFT in https://github.com/oras-project/oras-go/pull/731

✨ New Contributors

• @dextrot made their first contribution in https://github.com/oras-project/oras-go/pull/715
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.4.0...v2.5.0

💥 Breaking Changes

• Upgrade to [`image-spec v1.1.0-rc6`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc6) and [`distribution-spec v1.1.0-rc4`](https://github.com/opencontainers/distribution-spec/releases/tag/v1.1.0-rc4)
• Validate the `Content-type` header of the response when accessing the [Referrers API](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#listing-referrers)
• When [pushing manifests with a `subject` field](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#pushing-manifests-with-subject), if the `OCI-Subject` header is not set in the response, the registry is considered as not supporting the Referrers API
• > [!WARNING]
• > There are no API changes in `oras-go`.
• >
• > Known compatible registries:
• > * Zot [`v2.0.0-rc5`](https://github.com/project-zot/zot/releases/tag/v2.0.0-rc5) and later versions
• + 1 more

✨ New Features

• Move package `credentials` from [`github.com/oras-project/oras-credentials-go`](https://github.com/oras-project/oras-credentials-go) to [`oras.land/oras-go/v2/registry/remote/credentials`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/registry/remote/credentials), which supports reading, saving, and removing credentials from Docker configuration files and external credential stores that follow the Docker credential helper protocol
• Support deletion and garbage collection in [`oci`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/content/oci) package
• Add [`registry.Referrers`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/registry#Referrers) for listing referrers on any [`ReadOnlyGraphStorage`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/content#ReadOnlyGraphStorage)
• Introduce [`SkipNode`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0#pkg-variables) for [`CopyGraphOptions.PreCopy`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0#CopyGraphOptions) to signal [`oras.CopyGraph`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0#CopyGraph) to stop copying a node
• Introduce `SkipUnpack` option on [`file.Store`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/content/file#Store) to skip unpacking compressed directories

⚡ Performance Improvements

• Improve authorization token caching
• Support per-host scope hints, fixing #581
• Introduce [`auth.NewSingleContextCache`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0/registry/remote/auth#NewSingleContextCache) that creates a host-based cache for optimizing the auth flow for non-compliant registries
• Optimize Copy efficiency
• Add `MountFrom` and `OnMounted` to [`oras.CopyGraphOptions`](https://pkg.go.dev/oras.land/oras-go/v2@v2.4.0#CopyGraphOptions) to support mounting on copy

🐛 Bug Fixes

• Fix #692: index or manifest list without the OPTIONAL field platform cause panic (#695)

📋 Other Changes

• Improve error messages and examples
• Include changes in `v2.3.1`

📦 Detailed Commits

• feat: merge package `credentials` back from `oras-credentials-go` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/589
• feat: Add 'MemoryStore' by @Uanid in https://github.com/oras-project/oras-go/pull/602
• refactor: make credentials.NewMemoryStore return an interface by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/605
• feat: support per-host scope hints by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/604
• feat: support deletion for memory resolver by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/607
• feat: support deletion for OCI storage by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/608
• fix: package `credentials` to support legacy auth keys in docker config by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/617
• feat: support deletion for memory graph by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/606
• + 26 more

✨ New Contributors

• @Uanid made their first contribution in https://github.com/oras-project/oras-go/pull/602
• @eiffel-fl made their first contribution in https://github.com/oras-project/oras-go/pull/647
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.3.0...v2.4.0

📋 What's Changed

• build(deps): bump golang.org/x/crypto from 0.13.0 to 0.14.0 by @dependabot in https://github.com/oras-project/oras-go/pull/613
• build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 by @dependabot in https://github.com/oras-project/oras-go/pull/612
• build(deps): bump github.com/docker/distribution from 2.8.2+incompatible to 2.8.3+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/610
• build(deps): bump github.com/docker/docker from 24.0.6+incompatible to 24.0.7+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/630
• build(deps): bump github.com/docker/cli from 24.0.6+incompatible to 24.0.7+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/629
• build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in https://github.com/oras-project/oras-go/pull/638
• build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 by @dependabot in https://github.com/oras-project/oras-go/pull/639
• build(deps): bump golang.org/x/crypto from 0.14.0 to 0.15.0 by @dependabot in https://github.com/oras-project/oras-go/pull/642
• + 11 more

✨ New Contributors

• @ilya-lesikov made their first contribution in https://github.com/oras-project/oras-go/pull/678
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.2.4...v1.2.5

🐛 Bug Fixes

• Fix #592: Referrers tag index is not updated when all referrers are removed and GC is skipped
• Fix #600: `sibling()` is copying a `sync.Mutex`
• Fix #552: `OnCopySkipped` is called unexpectedly on root node when using `oras.Copy`

📋 Other Changes

• Update the Go support window to [1.20, 1.21] (#587)
• Upgrade `image-spec` to [`v1.1.0-rc5`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc5) (#615)
• Backport #618: Optimize the authentication workflow for `Repository.Manifests().Delete()` (#623)

📦 Detailed Commits

• Add SECURITY.md file by @TerryHowe in https://github.com/oras-project/oras-go/pull/579
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in https://github.com/oras-project/oras-go/pull/585
• build: bump go version by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/587
• fix: push an empty index when deleting the last referrer with SkipReferrersGC by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/593
• fix: Avoid a copy of sync.Mutex in Repository by @ktarplee in https://github.com/oras-project/oras-go/pull/603
• fix: correctly handle OnCopySkipped by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/609
• build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 by @dependabot in https://github.com/oras-project/oras-go/pull/611
• build: bump `github.com/opencontainers/image-spec` to `v1.1.0-rc5` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/615
• + 1 more

✨ New Contributors

• @ktarplee made their first contribution in https://github.com/oras-project/oras-go/pull/603
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.3.0...v2.3.1

📋 What's Changed

• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/474
• build(deps): bump github.com/docker/docker from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/473
• build(deps): bump golang.org/x/crypto from 0.7.0 to 0.8.0 by @dependabot in https://github.com/oras-project/oras-go/pull/480
• build(deps): bump github.com/docker/docker from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/478
• build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/477
• build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in https://github.com/oras-project/oras-go/pull/475
• build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.5+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/488
• build(deps): bump github.com/docker/docker from 23.0.3+incompatible to 23.0.5+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/489
• + 31 more

✨ New Contributors

• @dtrudg made their first contribution in https://github.com/oras-project/oras-go/pull/527
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.2.3...v1.2.4

✨ New Features

• Conform to [`image-spec v1.1.0-rc4`](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc4/spec.md) and [`distribution-spec v1.1.0-rc3`](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc3/spec.md), while remaining compatible with [`image-spec v1.1.0-rc2`](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/spec.md) and [`distribution-spec v1.1.0-rc1`](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md) (see #494 for more details)
• Support handling [Image Index with a `subject`](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc4/image-index.md)
• Add `oras.PackManifest` that supports packing Image Manifest version `1.0` and version `1.1.0-rc4`, as well as media type validation
• Add `Repository.HandleWarning` that can be used to handle [warnings](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc3/spec.md#warnings) returned by the remote registry
• Update the implementation of Referrers API to support the "OCI-Filters-Applied" response header
• Update the implementation of pushing manifests with `subject` to support the "OCI-Subject" response header
• Add `Repository.SkipReferrersGC` that allows skipping deleting dangling referrers index when referrers tag schema is utilized

🗑️ Deprecation

• `oras.Pack` is deprecated and not recommended for future use. Use `oras.PackManifest` instead.

📋 Other Changes

• Improve documentation and examples

📦 Detailed Commits

• feat: add option to skip referrers GC by @qweeah in https://github.com/oras-project/oras-go/pull/515
• feat: support Image Index with a subject by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/548
• feat: add a PackOption to support packing image manifests that conform to image-spec v1.1.0-rc4 by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/550
• feat: update Referrers API for distribution-spec v1.1.0-rc3 by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/553
• feat: update the implementation of pushing manifest for distribution-spec v1.1.0-rc3 by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/557
• feat: update the implementation of deleting manifest for distribution-spec v1.1.0-rc3 by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/558
• docs: update links by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/563
• feat: report warnings by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/560
• + 8 more

🐛 Bug Fixes

• Fix the bug where the "blobs" directory was not being ensured during the initialization of [`oci.Store`](https://pkg.go.dev/oras.land/oras-go/v2@v2.2.0/content/oci#Store) (#520)

📋 Other Changes

• Improve error messages
• Upgrade `image-spec` to [`v1.1.0-rc4`](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc4) to mitigate the missing annotation keys issue

📦 Detailed Commits

• build(deps): bump golang.org/x/sync from 0.2.0 to 0.3.0 by @dependabot in https://github.com/oras-project/oras-go/pull/524
• fix(oci): create blobs dir and define blobs dir name constant by @sparr in https://github.com/oras-project/oras-go/pull/520
• fix: improve errors for `ReadAll` and `loadIndexfile` by @sparr in https://github.com/oras-project/oras-go/pull/526
• refactor: upgrade go mod to `image-spec v1.1.0-rc4` and fix the missing types by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/536
• chore: enable workflows for release branches by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/537

✨ New Contributors

• @sparr made their first contribution in https://github.com/oras-project/oras-go/pull/520
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.2.0...v2.2.1

✨ New Features

• Support [mounting](https://pkg.go.dev/oras.land/oras-go/v2@v2.2.0/registry/remote#Repository.Mount) a blob from one repository to another in the same remote registry

🐛 Bug Fixes

• Fix #484: [`auth.StaticCredential`](https://pkg.go.dev/oras.land/oras-go/v2@v2.2.0/registry/remote/auth#StaticCredential) does not properly handle `docker.io`

📦 Detailed Commits

• build(deps): bump golang.org/x/sync from 0.1.0 to 0.2.0 by @dependabot in https://github.com/oras-project/oras-go/pull/498
• feat(registry/remote): implement `Mount` by @rogpeppe in https://github.com/oras-project/oras-go/pull/500
• fix: add special handling for "docker.io" in `StaticCredential()` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/504

✨ New Contributors

• @rogpeppe made their first contribution in https://github.com/oras-project/oras-go/pull/500
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.1.0...v2.2.0

✨ New Features

• Introduce [remote.ReferrersError](https://pkg.go.dev/oras.land/oras-go/v2@v2.1.0/registry/remote#ReferrersError) in case there is an error in updating the referrers index when the referrers tag schema is applied
• Here is an [example](https://pkg.go.dev/oras.land/oras-go/v2@v2.1.0/registry/remote#example-package-PushAndIgnoreReferrersIndexError) to ignore referrer index deletion error during push a referrer manifest.

📋 Other Changes

• [oci.Store.Resolve()](https://pkg.go.dev/oras.land/oras-go/v2@v2.1.0/content/oci#Store.Resolve) and [oci.ReadOnlyStore.Resolve()](https://pkg.go.dev/oras.land/oras-go/v2@v2.1.0/content/oci#ReadOnlyStore.Resolve) return the original descriptor in the `index.json` file if tag is queried
• Upgrade `image-spec` to [v1.1.0-rc.3](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc.3) to mitigate the missing symbol issue (#495)

📦 Detailed Commits

• build(deps): bump actions/setup-go from 3 to 4 by @dependabot in https://github.com/oras-project/oras-go/pull/464
• chore: add .cover to ignore by @TerryHowe in https://github.com/oras-project/oras-go/pull/463
• fix: OCI store resolve returns full descriptor by @oanatmaria in https://github.com/oras-project/oras-go/pull/468
• feat: add type for failure during deleting dangling referrer index by @qweeah in https://github.com/oras-project/oras-go/pull/482
• doc: fix broken links for ORAS logo and oras-go doc by @FeynmanZhou in https://github.com/oras-project/oras-go/pull/490
• build: upgrade image-spec to v1.1.0-rc.3 by @shizhMSFT in https://github.com/oras-project/oras-go/pull/496
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.2...v2.1.0

🐛 Bug Fixes

• Fix #461: Untagged manifests might be accidentally removed from the `index.json` file in OCI layouts

📋 Other Changes

• Improve repository governance

📦 Detailed Commits

• chore: update owners by @shizhMSFT in https://github.com/oras-project/oras-go/pull/459
• fix: refactor tagging implementation for OCI Store by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/462
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.1...v2.0.2

📋 What's Changed

• build(deps): bump golang.org/x/crypto from 0.4.0 to 0.5.0 by @dependabot in https://github.com/oras-project/oras-go/pull/408
• build(deps): bump github.com/docker/cli from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/405
• build(deps): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/406
• build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.15 by @dependabot in https://github.com/oras-project/oras-go/pull/407
• build(deps): bump golang.org/x/crypto from 0.5.0 to 0.6.0 by @dependabot in https://github.com/oras-project/oras-go/pull/436
• build(deps): bump github.com/containerd/containerd from 1.6.15 to 1.6.17 by @dependabot in https://github.com/oras-project/oras-go/pull/441
• bump: update docker and docker/cli by @benschlueter in https://github.com/oras-project/oras-go/pull/428
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.1+incompatible by @dependabot in https://github.com/oras-project/oras-go/pull/439
• + 6 more

✨ New Contributors

• @benschlueter made their first contribution in https://github.com/oras-project/oras-go/pull/428
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.2.2...v1.2.3

🐛 Bug Fixes

• fix #449: `index.json` is not generated for OCI Stores that contain no manifests
• fix #431: Some unit tests fail on Mac

📋 Other Changes

• Update the Go support window to [1.19, 1.20] (#442)
• Improve documentation and repository governance

📦 Detailed Commits

• fix: Broken tests for mac by @TerryHowe in https://github.com/oras-project/oras-go/pull/431
• fix: broken go-sdk link in readme by @khanjasir90 in https://github.com/oras-project/oras-go/pull/438
• feat: update go support window to [1.19, 1.20] by @Asmit2952 in https://github.com/oras-project/oras-go/pull/442
• chore: add CODEOWNERS based on OWNERS.md by @shizhMSFT in https://github.com/oras-project/oras-go/pull/444
• fix: fix CODEOWNERS by @shizhMSFT in https://github.com/oras-project/oras-go/pull/446
• fix: ensure `index.json` for oci store by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/450

✨ New Contributors

• @TerryHowe made their first contribution in https://github.com/oras-project/oras-go/pull/431
• @khanjasir90 made their first contribution in https://github.com/oras-project/oras-go/pull/438
• @Asmit2952 made their first contribution in https://github.com/oras-project/oras-go/pull/442
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0...v2.0.1

✨ What's New

• In version `v2`, ORAS Go library has been completely refreshed with:
• More unified interfaces
• Notably fewer dependencies
• Higher test coverage
• Better documentation
• Balanced security and performance
• Documentation and examples are available at [pkg.go.dev](https://pkg.go.dev/oras.land/oras-go/v2).

📦 Migration From `v1`

• See [MIGRATION_GUIDE.md](https://github.com/oras-project/oras-go/blob/main/MIGRATION_GUIDE.md).

✨ New Features

• Implement [`registry.TagLister`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry#TagLister) for package [`content/oci`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/oci)
• Add package [`registry/remote/retry`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry/remote/retry) which provides a default http client with automatic retries

🐛 Bug Fixes

• fix #395: `oras.Tag()` and `oras.TagN()` should return a descriptor
• fix #402: `file.Store` fails to extract folder containing symbolic links
• fix #404: `oci.Store` and `file.Store` should record an absolute path instead of a relative path for root

🗑️ Deprecation

• BREAKING CHANGE: Interface `registry.ReferrerFinder` is renamed to [`registry.ReferrerLister`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry#ReferrerLister)
• BREAKING CHANGE: Remove `file.PackFiles()`

📋 Other Changes

• BREAKING CHANGE: [`oras.Tag()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0#Tag) and [`oras.TagsN()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0#TagN) return a descriptor
• BREAKING CHANGE: [`file.New()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#New), [`file.NewWithFallbackLimit()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#NewWithFallbackLimit) and [`file.NewWithFallbackStorage()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#NewWithFallbackStorage) return an error
• BREAKING CHANGE: [`oci.NewStorage()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/oci#NewStorage) returns an error
• BREAKING CHANGE: [`auth.DefaultClient`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry/remote/auth#pkg-variables) uses [`retry.DefaultClient`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry/remote/retry#pkg-variables) instead of [`http.DefaultClient`](https://pkg.go.dev/net/http#pkg-variables)
• Improve the performance of [`oras.ExtendedCopy()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0#ExtendedCopy)
• Improve documentation
• Improve error messages

📦 Detailed Commits

• fix: add error detail to resolve failure by @qweeah in https://github.com/oras-project/oras-go/pull/390
• fix!: `Tag()` and `TagN()` return a descriptor by @shizhMSFT in https://github.com/oras-project/oras-go/pull/396
• feat!: implement `Tags` for package `content/oci` by @shizhMSFT in https://github.com/oras-project/oras-go/pull/394
• refactor: optimize performance for Extended Copy by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/397
• remove!: Remove `file.PackFiles()` and add an example instead by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/400
• doc: Remove main from the godoc URLs in README by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/403
• build: add dependabot for `v1` branch, add GitHub Actions by @lucacome in https://github.com/oras-project/oras-go/pull/399
• fix!: fix error when extracting folder containing symbolic links by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/411
• + 5 more

📋 What's Changed

• BREAKING CHANGE: Update to Go 1.18 by @lucacome in https://github.com/oras-project/oras-go/pull/154
• Bump containerd and opencontainers/image-spec by @lucacome in https://github.com/oras-project/oras-go/pull/378
• Bump crypto and sync by @lucacome in https://github.com/oras-project/oras-go/pull/381
• Bump docker by @lucacome in https://github.com/oras-project/oras-go/pull/382
• Bump distribution by @lucacome in https://github.com/oras-project/oras-go/pull/386
• Bump logrus and testify by @lucacome in https://github.com/oras-project/oras-go/pull/387
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.2.1...v1.2.2

✨ New Features

• Upgrade package [`content/oci`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6/content/oci)
• Support creating [read-only OCI store](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6/content/oci#ReadOnlyStore) from [`fs.FS`](https://pkg.go.dev/io/fs#FS)
• Support reading [OCI layout](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md) from tar archives
• Compatible with tar archives generated by `docker buildx build` with option [`--output=type=oci`](https://docs.docker.com/engine/reference/commandline/buildx_build/#output)
• Support [resolving](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6/content/oci#Store.Resolve) a digest to a descriptor
• Support [discovering predecessors](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6/content/oci#Store.Predecessors) that are not tagged in [`index.json`](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md#indexjson-file)
• [`oras.Copy()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6#Copy) supports copying images with [non-distributable](https://github.com/opencontainers/image-spec/blob/main/layer.md#non-distributable-layers) / [foreign](https://docs.docker.com/registry/spec/manifest-v2-2/#media-types) layers by skipping.

🐛 Bug Fixes

• fix #368: Range query is attempted for fetching blob from registries without range query support
• fix #374: [`Repository.FetchReference()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6/registry/remote#Repository.FetchReference) fails when registry responds with chunked transfer encoding
• fix #383: [`oras.Copy()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6#Copy) may fail when the option [`FindSuccessors`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.6#CopyGraphOptions) finds successors from external sources

📋 Other Changes

• BREAKING CHANGE: Change the type of `Concurrency` options from `int64` to `int`
• Improve code quality (#363, #364)
• Improve the readability of GoDoc

📦 Detailed Commits

• doc: fix testable example name by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/365
• fix: avoid copying Repository mutex state by @abursavich in https://github.com/oras-project/oras-go/pull/364
• fix: attempt range query only if server explicitly supports by @shizhMSFT in https://github.com/oras-project/oras-go/pull/369
• doc: make the default options displayed next to the option type on godoc by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/372
• fix: avoid panic from releasing unacquired semaphore by @abursavich in https://github.com/oras-project/oras-go/pull/363
• refactor!: update the type of `Concurrency` options to `int` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/376
• fix: allow chunked responses via HEAD request fallback by @AaronFriel in https://github.com/oras-project/oras-go/pull/370
• feat: support creating read-only OCI store from `fs.FS` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/367
• + 5 more

✨ New Contributors

• @abursavich made their first contribution in https://github.com/oras-project/oras-go/pull/364
• @AaronFriel made their first contribution in https://github.com/oras-project/oras-go/pull/370
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-rc.5...v2.0.0-rc.6

✨ New Features

• BREAKING CHANGE: Add [`ReferrerFinder`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.5/registry#ReferrerFinder) to [`Repository`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.5/registry#Repository) interface

🐛 Bug Fixes

• fix #349: Potential dead lock in [`oras.Copy`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.5#Copy)

📋 Other Changes

• Improve the performance of using referrers tag schema when pushing and deleting manifest concurrently
• Revise the documentation of [`registry.Reference`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.5/registry#Reference)

📦 Detailed Commits

• feat!: add `ReferrerFinder` to `Repository` interface by @shizhMSFT in https://github.com/oras-project/oras-go/pull/357
• fix: fix potential deadlock in `oras.Copy` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/359
• doc: revise doc of `registry.Reference` by @nima in https://github.com/oras-project/oras-go/pull/358
• perf: improve the performance of using referrers tag schema by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/360
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-rc.4...v2.0.0-rc.5

✨ New Features

• BREAKING CHANGE: Migrate to [OCI Artifact](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc2) from [ORAS Artifact](https://github.com/oras-project/artifacts-spec)
• Upgrade to [image-spec v1.0.0-rc.2](https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc2)
• Support [OCI Artifact Manifest](https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/artifact.md#artifact-manifest)
• Support [Referrers API](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#listing-referrers) and its fallback [Referrers Tag Schema](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#referrers-tag-schema)
• Support indexing referrers when pushing and deleting manifests with the `subject` field
• Add package [`registry/remote/errcode`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4/registry/remote/errcode) to support checking the error code returned by the [`registry/remote`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4/registry/remote) package
• Add [`content.VerifyReader`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4/content#VerifyReader) for verifying the read content against the descriptor

🐛 Bug Fixes

• fix #303: Scrutinize references for digests posing as tags

📋 Other Changes

• BREAKING CHANGE: Change the signature of [`Repository.Referrers()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4/registry/remote#Repository.Referrers)
• BREAKING CHANGE: Merge `oras.PackArtifact()` into [`oras.Pack()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4#Pack)
• Improve error message on platform mismatch
• Improve error message for [`Repository.FetchReference()`](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.4/registry/remote#Repository.FetchReference)
• Increase test coverage
• Check license header in Github workflow
• Other minor fixes

📦 Detailed Commits

• test: add interface tests for Repository, blobStore and manifestStore by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/313
• fix: add missing license headers by @jasminetMSFT in https://github.com/oras-project/oras-go/pull/315
• build: license header check in github workflows by @jasminetMSFT in https://github.com/oras-project/oras-go/pull/316
• feat: add read and verify utility method by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/324
• fix: fix data race in TagBytesN unit test by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/329
• fix: improve oras manifest fetch --platform error message by @lizMSFT in https://github.com/oras-project/oras-go/pull/330
• fix: fix 404 error message for `manifestStore.FetchReference` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/331
• fix: add nil checks for some functions by @jasminetMSFT in https://github.com/oras-project/oras-go/pull/327
• + 10 more

✨ New Contributors

• @jasminetMSFT made their first contribution in https://github.com/oras-project/oras-go/pull/315
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-rc.3...v2.0.0-rc.4

✨ New Features

• Added utility functions for content descriptors
• [content.NewDescriptorFromBytes()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#NewDescriptorFromBytes) to generate a descriptor from a byte slice
• [content.Equal()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#Equal) to compare if two descriptors point to the same content
• Simplified API
• [registry/remote/auth.StaticCredential()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/registry/remote/auth#StaticCredential) for easier and secure credential setting for simple scenarios
• [oras.Fetch()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#Fetch) to fetch content as a reader via a reference string from any target
• [oras.FetchBytes()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#FetchBytes) to fetch content as a byte slice via a reference string from any target
• [oras.PushBytes()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#PushBytes) to push a byte slice to any target
• + 4 more

🗑️ Deprecation

• BREAKING CHANGE Moved `content.ErrSizeExceedLimit` to `errdef.ErrSizeExceedsLimit`
• BREAKING CHANGE Removed `registry.ReferenceTagger`
• BREAKING CHANGE Removed `registry/remote.Repository.TagReference()`

🐛 Bug Fixes

• fix #225: Pulling from AWS ECR fails with error `empty response Docker-Content-Digest`
• fix #294: Pushing artifacts to Google GAR fails with error `Error PUT ... unexpected status code 400: Bad Request`
• fix potential security vulnerabilities: #289, #291

📋 Other Changes

• BREAKING CHANGE Updated support window to Go `1.18` and `1.19`
• BREAKING CHANGE Reduced interface requirements in corresponding functions of the package `oras` to `ReadOnly` interfaces
• [content.Storage](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#Storage) --> [content.ReadOnlyStorage](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#ReadOnlyStorage)
• [content.GraphStorage](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#GraphStorage) --> [content.ReadOnlyGraphStorage](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/content#ReadOnlyStorage)
• [oras.Target](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#Target) --> [oras.ReadOnlyTarget](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#ReadOnlyTarget)
• [oras.GraphTarget](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#GraphTarget) --> [oras.ReadOnlyGraphTarget](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3#ReadOnlyGraphTarget)
• BREAKING CHANGE `Manifest()` of [registry.Repository](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/registry#Repository) returns a [ManifestStore](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/registry#ManifestStore) instead of a [BlobStore](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.3/registry#BlobStore)
• Improved error message on planform mismatch

📦 Detailed Commits

• build: update support window to Go 1.18, 1.19 by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/270
• refactor: Small refactor of reference module and tests by @nima in https://github.com/oras-project/oras-go/pull/279
• fix: oras pull error `empty response Docker-Content-Digest` by @nima in https://github.com/oras-project/oras-go/pull/237
• refactor!: add read-only interfaces by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/283
• feat: add utility methods for creating and comparing OCI descriptors by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/281
• fix: remove `+json` encoding from the default config media type by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/288
• feat!: support `oras.Fetch` and `oras.FetchBytes` by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/282
• feat: add a utility method for specifying static credentials by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/280
• + 9 more

✨ New Contributors

• @nima made their first contribution in https://github.com/oras-project/oras-go/pull/279
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-rc.2...v2.0.0-rc.3

📋 What's Changed

• Implement `Info`, which will return metadata about the content available in the OCI store by @oanatmaria in https://github.com/oras-project/oras-go/pull/187
• Bump `docker/distribution` to `v2.8.1` by @mihaibuzgau in https://github.com/oras-project/oras-go/pull/276

✨ New Contributors

• @oanatmaria made their first contribution in https://github.com/oras-project/oras-go/pull/187
• @mihaibuzgau made their first contribution in https://github.com/oras-project/oras-go/pull/276
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.2.0...v1.2.1

✨ New Features

• Supports [artifacts-spec v1.0.0-rc.2](https://github.com/oras-project/artifacts-spec/releases/tag/v1.0.0-rc.2)
• Added new API `content.ReadAll()` to safely read fetched blobs
• `content/file.Store` allows skipping unnamed blobs when pushing
• `oras.Copy()` and `oras.ExtendedCopy()` support platform selection
• `oras.ExtendedCopy()` supports filtering predecessors by artifact type and / or annotations using regular expressions

🐛 Bug Fixes

• fix #236: same content with different names will be skipped when being pushing to file store
• fix #239: `oras.Copy()` may skip tagging if manifest blob already exists in the destination
• fix #252: pushing blobs to ECR will fail

📋 Other Changes

• Improved documentation
• Migrated to codecov.io for code coverage reports
• `oras.Pack()` packs empty config blob of size 0 bytes instead of `{}` (empty JSON object of size 2 bytes).

📦 Detailed Commits

• Bug: oras.Copy() may skip tagging if manifest blob already exists in the destination by @m5i-work in https://github.com/oras-project/oras-go/pull/243
• created pull blob example by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/234
• added an example of copying artifact manifest by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/241
• moved ReadAll and related functions to package Content by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/245
• update artifact-spec to v1.0.0-rc.2 by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/251
• Reuse post token for put when pushing blobs by @qweeah in https://github.com/oras-project/oras-go/pull/253
• Migrate to codecov.io by @junczhuMSFT in https://github.com/oras-project/oras-go/pull/247
• replaced io.ReadAll with content.ReadAll in examples by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/255
• + 10 more

✨ New Contributors

• @junczhuMSFT made their first contribution in https://github.com/oras-project/oras-go/pull/247
• @lizMSFT made their first contribution in https://github.com/oras-project/oras-go/pull/257
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-rc.1...v2.0.0-rc.2

📋 Major Changes

• Updates implementation to conform [artifact-spec v1.0.0-rc.1](https://github.com/oras-project/artifacts-spec/releases/tag/v1.0.0-rc.1).
• Supports the [Referrer API](https://github.com/oras-project/artifacts-spec/blob/v1.0.0-rc.1/manifest-referrers-api.md), and is compatible with the [legacy draft.1 API](https://github.com/oras-project/artifacts-spec/blob/v1.0.0-draft.1/manifest-referrers-api.md).
• Supports the [Discovery API](https://github.com/oras-project/artifacts-spec/blob/v1.0.0-rc.1/manifest-referrers-api.md#api-discovery).
• BREAKING CHANGE [registry.Repositories()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.1/registry#Registry) and [registry.Tags()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.1/registry#Repository) support `last` parameter.
• New [PackArtifact()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.1#PackArtifact) method for easier packing artifacts.
• New [Tag()](https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0-rc.1#Tag) method to re-tag a manifest.

📋 What's Changed

• Update godoc link to main branch by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/198
• migrate REVIEWING.md from ORAS-go to community by @FeynmanZhou in https://github.com/oras-project/oras-go/pull/194
• Update Referrers API to match RC.1 by @m5i-work in https://github.com/oras-project/oras-go/pull/191
• Clean up unused files by @shizhMSFT in https://github.com/oras-project/oras-go/pull/212
• Filter referrers by artifact type by @m5i-work in https://github.com/oras-project/oras-go/pull/211
• examples for the auth module by @wangxiaoxuan273 in https://github.com/oras-project/oras-go/pull/182
• Add auth examples in README by @Wwwsylvia in https://github.com/oras-project/oras-go/pull/216
• Support last parameter for listing catalog and tags by @patrickzheng200 in https://github.com/oras-project/oras-go/pull/217
• + 9 more

✨ New Contributors

• @FeynmanZhou made their first contribution in https://github.com/oras-project/oras-go/pull/194
• @m5i-work made their first contribution in https://github.com/oras-project/oras-go/pull/191
• Full Changelog: https://github.com/oras-project/oras-go/compare/v2.0.0-alpha...v2.0.0-rc.1

📋 Changes

• More unified interfaces
• Notably fewer dependencies
• Higher test coverage
• Better documentation

📋 Major Changes in `v2`

• Moves `content.FileStore` to [file.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/file#Store)
• Moves `content.OCIStore` to [oci.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/oci#Store)
• Moves `content.MemoryStore` to [memory.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/memory#Store)
• Provides [SDK](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote) to interact with OCI-compliant and Docker-compliant registries
• Supports [Copy](https://pkg.go.dev/oras.land/oras-go/v2#Copy) with more flexible options
• Supports [Extended Copy](https://pkg.go.dev/oras.land/oras-go/v2#ExtendedCopy) with options *(experimental)*
• No longer supports `docker.Login` and `docker.Logout` (removes the dependency on `docker`); instead, provides authentication through [auth.Client](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote/auth#Client)
• Documentation and examples are available at [pkg.go.dev](https://pkg.go.dev/oras.land/oras-go/v2).
• + 1 more

✨ New Contributors

• @scottrigby made their first contribution in https://github.com/oras-project/oras-go/pull/74
• @Wwwsylvia made their first contribution in https://github.com/oras-project/oras-go/pull/86
• @sajayantony made their first contribution in https://github.com/oras-project/oras-go/pull/116
• @qweeah made their first contribution in https://github.com/oras-project/oras-go/pull/117
• @wangxiaoxuan273 made their first contribution in https://github.com/oras-project/oras-go/pull/145
• @caniszczyk made their first contribution in https://github.com/oras-project/oras-go/pull/105
• @patrickzheng200 made their first contribution in https://github.com/oras-project/oras-go/pull/186
• Full Changelog: https://github.com/oras-project/oras-go/compare/v0.5.0...v2.0.0-alpha

📋 What's Changed

• use io.ReadFull for ProviderWrapper in case of partial read by @raygecao in https://github.com/oras-project/oras-go/pull/142
• Bump containerd to v1.6.4 by @lucacome in https://github.com/oras-project/oras-go/pull/151
• Bump containerd to v1.6.6 by @lucacome in https://github.com/oras-project/oras-go/pull/160
• Bump cobra to v1.4.0 by @lucacome in https://github.com/oras-project/oras-go/pull/167
• Bump dependencies by @lucacome in https://github.com/oras-project/oras-go/pull/168
• Implement Delete in the oci store content implementation by @viovanov in https://github.com/oras-project/oras-go/pull/174
• Add a loginWithTLS function to V1 by @souleb in https://github.com/oras-project/oras-go/pull/171

✨ New Contributors

• @raygecao made their first contribution in https://github.com/oras-project/oras-go/pull/142
• @lucacome made their first contribution in https://github.com/oras-project/oras-go/pull/151
• @souleb made their first contribution in https://github.com/oras-project/oras-go/pull/171
• Full Changelog: https://github.com/oras-project/oras-go/compare/v1.1.1...v1.2.0