ORAS Go library

<p align="left"> <a href="https://oras.land/"><img src="https://oras.land/img/oras.svg" alt="ORAS logo" width="100px"></a> </p>

oras-go is a Go library for managing OCI artifacts, compliant with the OCI Image Format Specification and the OCI Distribution Specification. It provides unified APIs for pushing, pulling, and managing artifacts across OCI-compliant registries, local file systems, and in-memory stores.

[!Note]
The main and v2 branches follow Go's Security Policy and support the two latest versions of Go (currently 1.25 and 1.26).

Getting Started

Concepts

Gain insights into the fundamental concepts:

• Modeling Artifacts
• Targets and Content Stores

Quickstart

Follow the step-by-step tutorial to use oras-go v2:

• Quickstart: Managing OCI Artifacts with oras-go v2

Examples

Check out sample code for common use cases of oras-go v2:

• Artifact copying
• Registry operations
• Repository operations
• Authentication
• Credentials management

Find more API examples at pkg.go.dev.

Versioning

This project follows Semantic Versioning (MAJOR.MINOR.PATCH), with MAJOR for breaking changes, MINOR for backward-compatible features, and PATCH for backward-compatible fixes.

Branches

main (v3 development)

The main branch is under active development for v3 and may contain breaking changes. Not recommended for production use.

v2 (stable)

The v2 branch contains the latest stable release and is recommended for production use.

New features and bug fixes from main will be backported to v2 if applicable.

v1 (maintenance)

The v1 branch is in maintenance mode and receives only dependency updates and security fixes. No new features are planned.

To migrate from v1 to v2, see MIGRATION_GUIDE.md.

Community

• Code of Conduct: CODE_OF_CONDUCT.md
• Security Policy: SECURITY.md
• Reviewing Guide: Reviewing Guide
• Slack: #oras channel on CNCF Slack