v1.2.0

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the preview flag --no-tty
• Support deletion of manifests and blobs in OCI image layout
• Support X.509 mTLS authentication with OCI registries

Preview Features

• BREAKING CHANGE Registries supporting Referrers API prior to distribution-spec v1.1.0-rc4 will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
• Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and its referrers
• Promote --image-spec to a preview flag from experimental

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• Introduce formatted output via --format by implementing the specification
  • Formatted output is available to the following commands:
    • oras pull
    • oras push
    • oras attach
    • oras discover
    • oras manifest fetch
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "go-template={{ .digest }}" to print the digest of the manifest using Go template
      • Template can also be specified by --template
• Introduce oras resolve to get the digest of an artifact

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: Snaps build cannot read default credentials file
• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.22.3
• Minor security enhancements

---

What's Changed Since RC.1

Other Changes

• Improve documentation
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-rc.1 by @qweeah in #1381
• fix: remove non-classic snap plugins by @qweeah in #1383
• fix: oras cp documentation by @TerryHowe in #1384
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #1385
• refactor: Get rid of deprecated PrintStatus method by @TerryHowe in #1378
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.3 to 2.18.0 in /test/e2e by @dependabot in #1388
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.18.0 to 2.19.0 in /test/e2e by @dependabot in #1390
• chore: Remove deprecated PrintStatus method by @TerryHowe in #1389
• doc: verify local files by @qweeah in #1386
• fix: remove call to deprecated print by @TerryHowe in #1392

Full Changelog: v1.2.0-rc.1...v1.2.0

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

v1.2.0-rc.1

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Support X.509 mTLS authentication with OCI registries
• PREVIEW Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• BREAKING CHANGE Introduce new go templating experience to all commands support --format based on the spec
  • BREAKING CHANGE Require explicit type assertion --format go-template=TEMPLATE
  • BREAKING CHANGE Change field selectors from uppercased to lowercased
  • BREAKING CHANGE Rename digested reference selector to reference
  • Examples:
    • --format go-template="{{ .digest }}" to print the digest of the newly pushed manifest using Go template
  • Template can also be specified by --template
• Introduce output control via --format to oras pull, oras manifest fetch, and oras discover

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: snap build cannot read default credentials file
• Fix #1268: oras blob fetch failed to output to stdout in terminal mode
• Fix #1300: pushing with multiple tags will corrupt --format output
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve live progress output for terminal
  • Introduce colored output
  • Smooth download speed display with reduced fluctuation
• Update dependencies
• Update to Golang 1.22.3

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-beta.1 by @qweeah in #1266
• doc (spec): add error message guideline by @FeynmanZhou in #1163
• build(deps): bump github.com/containerd/console from 1.0.3 to 1.0.4 by @dependabot in #1269
• build(deps): bump golang.org/x/term from 0.16.0 to 0.17.0 by @dependabot in #1270
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.15.0 to 2.16.0 in /test/e2e by @dependabot in #1278
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in #1272
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 in /test/e2e by @dependabot in #1271
• fix(e2e): update ZOT image by @qweeah in #1284
• build(deps): bump golang.org/x/term from 0.17.0 to 0.18.0 by @dependabot in #1279
• test(unit): exclude darwin from go build constraint by @wangxiaoxuan273 in #1289
• refactor: pass cobra.Command to all cmd exec functions by @TerryHowe in #1285
• fix: make --output - implies --no-tty by @wangxiaoxuan273 in #1286
• build(actions): update github actions for Node 20 by @TerryHowe in #1287
• fix: Revert github actions coverage until fixed by @TerryHowe in #1290
• feat: Use cobra.Command.OutOrStdout method for output by @TerryHowe in #1288
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /test/e2e by @dependabot in #1296
• build(deps): bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /test/e2e by @dependabot in #1297
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /test/e2e by @dependabot in #1305
• refactor: add stdout to metadata handlers by @qweeah in #1312
• bump: bump oras-go to 2.5.0 by @wangxiaoxuan273 in #1303
• refactor: use command output in status output by @qweeah in #1314
• chore: using const to replace string by @LinuxSuRen in #1316
• refactor: make command accessible in option parser by @wangxiaoxuan273 in #1315
• bump: update golang to 1.22 by @TerryHowe in #1282
• build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #1323
• build(deps): bump golang.org/x/term from 0.18.0 to 0.19.0 by @dependabot in #1322
• bump(ci): update codecov gha to v4 by @qweeah in #1324
• bump(ci): update golangci-lint to v4 by @qweeah in #1325
• feat: support --format for oras pull by @qweeah in #1293
• feat: support --platform for oras attach by @qweeah in #1309
• feat: show artifact type when pushing files by @wangxiaoxuan273 in #1320
• fix: oras push should return error when artifacttype is empty for spec 1.1 by @wangxiaoxuan273 in #1317
• build(ci): add dependabot to update ci version automatically by @qweeah in #1326
• build(deps): bump apache/skywalking-eyes from 0.4.0 to 0.6.0 by @dependabot in #1328
• build(deps): bump goreleaser/goreleaser-action from 2 to 5 by @dependabot in #1329
• build(deps): bump actions/setup-go from 4 to 5 by @dependabot in #1331
• build(deps): bump actions/stale from 8 to 9 by @dependabot in #1330
• build(deps): bump github/codeql-action from 2 to 3 by @dependabot in #1332
• feat: support --format in manifest fetch command by @qweeah in #1295
• ux: improve the usage doc of --image-spec by @wangxiaoxuan273 in #1334
• feat: support --format in oras discover by @qweeah in #1299
• chore: add preview feature mark to platform-specific attaching by @qweeah in #1337
• feat: oras discover should show a placeholder of artifactType if it's not presented by @wangxiaoxuan273 in #1336
• feat: make image spec preview by @wangxiaoxuan273 in #1338
• feat: make --identity-token an alias of --password by @wangxiaoxuan273 in #1294
• fix: discard tagging output when pushing with formatted output by @qweeah in #1302
• feat: add color to progress mark and bar by @qweeah in #1344
• feat: make all go-template key lower-cased by @qweeah in #1343
• feat: improve error message when detecting conflicting flags by @wangxiaoxuan273 in #1345
• feat: add mTLS options by @sabre1041 in #1319
• chore: set go version to 1.22.0 in go.mod by @Amulyam24 in #1351
• fix: fix failed Windows unit test by @wangxiaoxuan273 in #1352
• chore(ux): optimize progress bar by @qweeah in #1349
• fix: fix error message when output is used before format for oras discover by @wangxiaoxuan273 in #1354
• fix: return error when --format and --pretty are both used by @wangxiaoxuan273 in #1359
• fix: ignore --pretty when --output is used for oras manifest fetch by @wangxiaoxuan273 in #1363
• build(deps): bump github.com/onsi/gomega from 1.32.0 to 1.33.0 in /test/e2e by @dependabot in #1364
• build(deps): bump golangci/golangci-lint-action from 4 to 5 by @dependabot in #1370
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.1 to 2.17.2 in /test/e2e by @dependabot in #1369
• feat: improve error message of when a set of flags is required to use together by @wangxiaoxuan273 in #1358
• build(deps): bump github.com/onsi/gomega from 1.33.0 to 1.33.1 in /test/e2e by @dependabot in #1371
• refactor: move logger method to command by @TerryHowe in #1355
• refactor: Move ShortDigest out of display package by @te...

v1.2.0-beta.1

New Features

• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the flag --no-tty
• Support deletion of manifests and blobs in OCI image layout

Experimental Features

• BREAKING CHANGE oras is compliant with OCI image-spec v1.1.0-rc6 and distribution-spec v1.1.0-rc4
  • Registries supporting Referrers API of older version of distribution-spec will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
  • Known registries supporting the distribution-spec v1.1.0-rc4:
    • Zot v2.0.0-rc5 and later versions
    • Harbor v2.10.0 and later versions
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and their referrer artifacts
• Introduce oras resolve to get the digest of an artifact
• Introduce output control by specifying --format to oras push and oras attach
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "{{ .Digest }}" to print the digest of the newly pushed manifest using Go template
  • Known issue: pushing with multiple tags output unexcepted results and will be fixed in future versions

Bug Fixes

• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject

Other Changes

• Enhance troubleshooting experience with improved error messages
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.21.6
• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.1.0 by @qweeah in #1103
• fix: allow HTTPS for localhost by @qweeah in #1107
• perf: optimize request count for manifest and blob deletion by @qweeah in #1109
• revert: "perf: optimize request count for manifest and blob deletion" by @qweeah in #1115
• perf: optimize request count for manifest and blob deletion by @qweeah in #1116
• chore: fix typo by @testwill in #1121
• feat: support copying referrers for multi-arch images by @qweeah in #1122
• build(deps): bump golang.org/x/term from 0.11.0 to 0.12.0 by @dependabot in #1123
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.0 to 2.12.1 in /test/e2e by @dependabot in #1126
• fix: remove root from virtual referrers by @shizhMSFT in #1130
• build: release ppc64le/riscv64 and improve reproducibility by @katexochen in #1118
• build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 by @dependabot in #1137
• build(deps): bump golang.org/x/term from 0.12.0 to 0.13.0 by @dependabot in #1136
• build(deps): bump github.com/onsi/gomega from 1.27.10 to 1.28.0 in /test/e2e by @dependabot in #1132
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.12.1 to 2.13.0 in /test/e2e by @dependabot in #1140
• build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1141
• feat: support progressed output in blob push and blob get by @qweeah in #1113
• perf: reduce auth request count for oras cp by @qweeah in #1142
• fix: resolve duplicated debug log for oras cp by @qweeah in #1139
• build(deps): bump golang.org/x/net from 0.14.0 to 0.17.0 in /test/e2e by @dependabot in #1144
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.2.0 to 0.3.1 by @dependabot in #1145
• build(deps): bump github.com/onsi/gomega from 1.28.0 to 1.28.1 in /test/e2e by @dependabot in #1147
• feat: support progress output for attach, push and copy commands by @qweeah in #1138
• build(deps): bump github.com/onsi/gomega from 1.28.1 to 1.29.0 in /test/e2e by @dependabot in #1153
• build(deps): upgrade image-spec to 1.1.0-rc5 and oras-go to the latest by @shizhMSFT in #1154
• chore: add reference details to registry errors by @sajayantony in #1152
• feat: support progress output in pull by @qweeah in #1148
• feat: remove empty artifact CLI message and show hints for pulling OCI image layout by @sajayantony in #1157
• fix: should not print copy hint for manifest in verbose mode by @qweeah in #1165
• feat: make --debug imply --no-tty by @qweeah in #1162
• fix: avoid copy suggestion when only config is skipped by @sajayantony in #1164
• fix: resolve regression made in #1164 by @qweeah in #1170
• fix: atomic bool for layer skipped during pulling by @qweeah in #1168
• build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 by @dependabot in #1172
• fix: update error message for repo ls by @sajayantony in #1169
• test(e2e): add specs to hint for pulling unnamed layers by @qweeah in #1174
• build(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in #1171
• fix: avoid overflow in progress bar percentage by @qweeah in #1178
• chore(ux): add newline to make TTY output copy friendly by @qweeah in #1180
• build(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 by @dependabot in #1181
• build(deps): bump github.com/onsi/gomega from 1.29.0 to 1.30.0 in /test/e2e by @dependabot in #1182
• test(e2e): fix a false positive test for blob get by @qweeah in #1184
• chore: make error of non-existed source OCI layout more readable by @qweeah in #1176
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.0 to 2.13.1 in /test/e2e by @dependabot in #1185
• feat: add resolve command by @sajayantony in #1187
• test(e2e): add test for resolve command by @qweeah in #1188
• build(deps): bump golang.org/x/term from 0.14.0 to 0.15.0 by @dependabot in #1194
• doc: add example for attach with custom layer media type by @qweeah in #1195
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.13.1 to 2.13.2 in /test/e2e by @dependabot in #1196
• feat: scrub Set-Cookie header in debug logs by @qweeah in #1190
• feat: support manifest and blob deletion for OCI layout by @qweeah in #1197
• build(ci): add workflow for releasing main image by @kranurag7 in #1191
• build(ci): merge tag and main ghcr build release file by @qweeah in #1205
• test(e2e): add spec to cover legacy docker config file by @qweeah in #1206
• feat: improve returned error for invalid arguments by @qweeah in #1201
• fix: bug in pushing with multiple tags by @qweeah in #1209
• chore(ux): improve error message for oras tag list by @qweeah in #1219
• build(ci): enforce coverage check by @qweeah in #1220
• chore(ux): improve error output for unknown spec flag by @qweeah in #1221
• build(deps): bump oras-go/v2 to main branch by @qweeah in #1223
• fix: resolve error in help doc of distribution spec flag by @qweeah in #1229
• build(ci): make coverage upload and calculation mandatory by @qweeah in https...

v1.1.0

New Features

• oras is compliant with OCI image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3
  • Support copying or pulling image index with a subject field
  • Output OCI distribution warning headers
• Improve oras push
  • Formalize the default config to empty descriptor (previously application/vnd.unknown.config.v1+json)
  • Default to artifact type application/vnd.unknown.artifact.v1 if not specified
  • Allow artifact type and config to be specified at the same time

Experimental Features

• BREAKING CHANGE: Redesign the flag --image-spec
  • Add options v1.0 and v1.1
  • Remove options v1.1-image and v1.1-artifact
  • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
• BREAKING CHANGE: Remove the flag --image-spec from oras attach

Bug Fixes

• Fix #995: oras push and oras attach generates unwanted manifest file
• Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
• Fix #897: Wrong error log when --distribution-spec is provided with invalid value
• Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

• Improve UX, documentation, performance, tests and code coverage
• Update dependencies
• Update to Golang 1.21.0

---

What's Changed Since RC.2

Other Changes

• Improve performance
  • Reduced number of auth requests for push and attach (#1084)
• Improve documentation
  • Update security guide (#1017)
  • Update compatibility mode doc (#1065)
• Update dependencies
  • Bump oras-go to 2.3.0
• Improve tests

Detailed Commits

• bump: tag and release ORAS CLI v1.1.0-rc.2 by @qweeah in #1078
• test(e2e): add zot as a testing backend by @qweeah in #1072
• Add SECURITY.md file by @TerryHowe in #1082
• test(e2e): update e2e specs for oras attach by @qweeah in #1081
• test(e2e): use ZOT as testing backend for oras blob specs by @qweeah in #1083
• test(e2e): fix logging when e2e test fails by @qweeah in #1090
• test(e2e): migrate oras push specs to ZOT by @qweeah in #1085
• test(e2e): migrate oras pull specs to ZOT by @qweeah in #1086
• test(e2e): migrate oras tag specs to ZOT by @qweeah in #1087
• test(e2e): migrate oras repo specs to ZOT by @qweeah in #1088
• test(e2e): migrate oras manifest specs to ZOT by @qweeah in #1089
• perf: save auth requests for push and attach by @Wwwsylvia in #1097
• test(e2e): re-bake test data by @qweeah in #1094
• test(e2e): migrate oras cp and oras discover specs to ZOT by @qweeah in #1093
• test(e2e): cover pulling test for image spec 1.1.0-rc.2 artifact by @qweeah in #1098
• test(e2e): add tests to cover OCI spec v1.1.0-rc.4 and OCI distribution spec 1.1.0-rc3 by @qweeah in #1099
• test(e2e): add doc for ZOT test data by @qweeah in #1100
• build(deps): bump oras-go to v2.3.0 by @qweeah in #1101
• doc: update example for oras push by @qweeah in #1102
• doc: update compatibility mode doc to align with ORAS v1.1.0 by @FeynmanZhou in #1068

Full Changelog: v1.1.0-rc.2...v1.1.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.1.0-rc.2

New Features

• oras is compliant with OCI image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3
  • Support copying index with subject
  • Output OCI distribution warning headers
• Improve oras push
  • Formalize the default config to empty descriptor (previously application/vnd.unknown.config.v1+json)
  • Default to artifact type application/vnd.unknown.artifact.v1 if not specified
  • Allow artifact type and config to be specified at the same time

Experimental Features

• BREAKING CHANGE: Redesign the flag --image-spec
  • Add options v1.0 and v1.1
  • Remove options v1.1-image and v1.1-artifact
  • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
• BREAKING CHANGE: Remove the flag --image-spec from oras attach

Deprecation

• Remove the flag --skip-delete-referrers (#1041) introduced in v1.1.0-rc.1

Other Changes

• Improve UX
  • Make error logs more readable (#1021)
• Improve documentation
  • Fix broken links in project readme (#1017)
• Update dependencies
• Update to Golang 1.21.0
• Improve tests
  • Add unit tests for cred store (#972)
  • Fix E2E false positive result (#1022)

Detailed commits

• bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
• chore: fix lint warning by @kranurag7 in #1001
• chore: fix the links in project readme by @amands98 in #1012
• chore: update container build prepare job output in Github Actions by @qweeah in #1019
• test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
• chore: use golangci lint by @kranurag7 in #986
• fix: correct e2e specs and CI check configuration by @qweeah in #1023
• workflow: add github stale action by @sajayantony in #1024
• fix: move stale into .github/workflows by @sajayantony in #1031
• build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
• chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
• chore: exempt stale if milestone is set by @qweeah in #1036
• chore: add triage labels by @FeynmanZhou in #1055
• chore: make error returned by oras tag more readable by @qweeah in #1058
• revert: "feat: add flag to skip deleting obsolete referrers index" by @qweeah in #1060
• feat: disable referrers index GC by default by @qweeah in #1059
• build(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 by @dependabot in #1051
• feat: pack OCI image spec v1.1 manifests by @qweeah in #1054
• bump: use new packing function in oras-go by @qweeah in #1070
• feat: support warning in remote targets by @qweeah in #1057
• chore: align naming of pack option to oras-go by @qweeah in #1073
• bump: update golang to 1.21 by @qweeah in #1074
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.11.0 to 2.12.0 in /test/e2e by @dependabot in #1075

New Contributors

• @kranurag7 made their first contribution in #1001
• @amands98 made their first contribution in #1012
• @1Shubham7 made their first contribution in #1026

Full Changelog: v1.1.0-rc.1...v1.1.0-rc.2

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.1

Bug Fixes

• oras push and oras attach generates unwanted manifest file (#995)
• Path validation not enforced for oras attach and oras push (#983, #980, #973)
• Wrong error information when --distribution-spec is provided with invalid value (#897)
• Tree view print bug in oras discover (#1003)

Other Changes

• Improve UX
  • oras pull prints better error message when path traversal is required (#978)
  • Mention OCI support in help doc (#904)
  • Mark filtered tag listing as experimental (#993)
• Improve documentation
  • Fix link to contributing guide (#950)
• Update dependencies
  • Remove dependencies on docker CLI (#414)
  • Update dependency from github.com/moby/term to golang.org/x/term (#908)
• Update to Golang 1.20.7
• Improve tests
  • Generate code coverage for E2E tests (#900)
  • Add more tests (#904, #901, #972, #1022)
• Workflow
  • Add GitHub actions to lint go code (#981)
  • Update GitHub actions output configuration (#1018)
  • Add GitHub stale actions

Detailed Commits

• refactor: Logger initializes logging by @TerryHowe in #867
• test(cov): make unit tests cover more by @qweeah in #905
• refactor: add root package for Cobra commands by @qweeah in #825
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
• refactor: unify command contexts by @qweeah in #899
• test: generate coverage profile during e2e tests by @qweeah in #903
• build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
• refactor: replace terminal package used by oras login by @qweeah in #910
• test(e2e): OCI layout specs for oras tag by @qweeah in #902
• build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
• Add make target for e2e by @sajayantony in #924
• test: make e2e coverage data in action by @qweeah in #926
• build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
• feat: use oras-credential-go to do auth by @qweeah in #932
• doc: fix broken logo link by @FeynmanZhou in #935
• docs: fix broken links in README by @wangxiaoxuan273 in #937
• build: using cross compilation in docker build by @northtyphoon in #938
• build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
• build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
• fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
• build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
• build: add dependabot for e2e module by @qweeah in #958
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
• build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
• fix: correct spec flag description by @qweeah in #964
• build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
• chore: add snap for ubuntu by @SamirPS in #965
• build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
• chore: simplify e2e scripts and github action by @qweeah in #967
• Revert "Add help to make file" by @TerryHowe in #974
• Add help to make file by @TerryHowe in #975
• build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
• test: add unit-tests for internal/version.go by @enraiha0307 in #977
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
• fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
• chore: add experimental mark to filtered tag listing by @qweeah in #994
• test(e2e): add test for pushing via absolute path by @qweeah in #991
• test(e2e): update spec-related constants to string literal by @qweeah in #992
• chore: update help doc with OCI layout support by @qweeah in #997
• feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
• fix: pushing based on temporary file store path by @qweeah in #996
• chore: update minor version by @qweeah in #1000
• fix: properly print tree for oras discover by @shizhMSFT in #1005
• build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
• build(deps): bump oras-go to main branch by @qweeah in #1004
• revert: "chore: update minor version (#1000)" by @qweeah in #1014
• bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015
• bump: tag and release ORAS CLI v1.1.0-rc.1 by @qweeah in #1016
• chore: fix lint warning by @kranurag7 in #1001
• chore: fix the links in project readme by @amands98 in #1012
• chore: update container build prepare job output in Github Actions by @qweeah in #1019
• test: add unit test for error scenario in internal/credential/store.go by @enraiha0307 in #982
• chore: use golangci lint by @kranurag7 in #986
• fix: correct e2e specs and CI check configuration by @qweeah in #1023
• workflow: add github stale action by @sajayantony in #1024
• fix: move stale into .github/workflows by @sajayantony in #1031
• build(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 in /test/e2e by @dependabot in #1037
• chore: improving error log for oras push and oras attach when the annotation file is invalid by @1Shubham7 in #1026
• chore: exempt stale if milestone is set by @qweeah in #1036
• merge: fast forward release-1.0 to main by @qweeah in #1045
• revert: "feat: add flag to skip deleting obsolete referrers index (#957)" by @qweeah in #1046
• revert: "bump: update oras version to 1.1.0-rc.1" by @qweeah in #1047
• bump: update golang version to 1.20.7 by @qweeah in #1049

New Contributors

• @northtyphoon made their first contribution in #938
• @yash7raut made their first contribution in #951
• @SamirPS made their first contribution in #965
• @enraiha0307 made their first contribution in #977
• @suganyas made their first contribution in #988
• @kranurag7 made their first contribution in #1001
• @amands98 ...

v1.1.0-rc.1

New Features

• Add a new flag --skip-delete-referrers to allow oras commands to skip referrers index clean up

Bug Fixes

• Fix #995: oras push and oras attach generates unwanted manifest file
• Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
• Fix #897: Wrong error log when --distribution-spec is provided with invalid value
• Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

• Improve UX
  • oras pull prints better error logs when path traversal is needed
  • Add OCI image layout support in help doc
  • Mark filtered tag listing as experimental
• Improve documentation
  • Fix broken links in contribution document
• Update dependencies
  • Remove dependencies on docker CLI
  • Update dependency from github.com/moby/term to golang.org/x/term
• Update to Golang 1.20.5
• Improve tests
  • Generate code coverage for E2E tests
  • Better test coverage

Detailed Commits

• refactor: Logger initializes logging by @TerryHowe in #867
• test(cov): make unit tests cover more by @qweeah in #905
• refactor: add root package for Cobra commands by @qweeah in #825
• build(deps): bump github.com/docker/cli from 23.0.1+incompatible to 23.0.2+incompatible by @dependabot in #909
• refactor: unify command contexts by @qweeah in #899
• test: generate coverage profile during e2e tests by @qweeah in #903
• build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 by @dependabot in #919
• refactor: replace terminal package used by oras login by @qweeah in #910
• test(e2e): OCI layout specs for oras tag by @qweeah in #902
• build(deps): bump github.com/docker/cli from 23.0.2+incompatible to 23.0.3+incompatible by @dependabot in #918
• Add make target for e2e by @sajayantony in #924
• test: make e2e coverage data in action by @qweeah in #926
• build(deps): bump github.com/docker/cli from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #929
• feat: use oras-credential-go to do auth by @qweeah in #932
• doc: fix broken logo link by @FeynmanZhou in #935
• docs: fix broken links in README by @wangxiaoxuan273 in #937
• build: using cross compilation in docker build by @northtyphoon in #938
• build(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 by @dependabot in #942
• build(deps): bump oras-go and oras-credentials-go by @qweeah in #946
• fixed the link in the file : oras/CONTRIBUTING.md by @yash7raut in #951
• build(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #953
• build: add dependabot for e2e module by @qweeah in #958
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 by @dependabot in #955
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.0 to 0.1.1 by @dependabot in #956
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 in /test/e2e by @dependabot in #961
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 in /test/e2e by @dependabot in #962
• build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.7 in /test/e2e by @dependabot in #959
• build(deps): bump oras.land/oras-go/v2 from 2.1.0 to 2.2.0 in /test/e2e by @dependabot in #960
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.9.7 in /test/e2e by @dependabot in #963
• fix: correct spec flag description by @qweeah in #964
• build(deps): bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #966
• chore: add snap for ubuntu by @SamirPS in #965
• build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /test/e2e by @dependabot in #970
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.9.7 to 2.10.0 in /test/e2e by @dependabot in #969
• chore: simplify e2e scripts and github action by @qweeah in #967
• Revert "Add help to make file" by @TerryHowe in #974
• Add help to make file by @TerryHowe in #975
• build(deps): bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #971
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.10.0 to 2.11.0 in /test/e2e by @dependabot in #976
• test: add unit-tests for internal/version.go by @enraiha0307 in #977
• build(deps): bump github.com/oras-project/oras-credentials-go from 0.1.1 to 0.2.0 by @qweeah in #990
• fix: enforce path validation for push/attach and improve path traversal failure message for pull by @suganyas in #988
• chore: add experimental mark to filtered tag listing by @qweeah in #994
• test(e2e): add test for pushing via absolute path by @qweeah in #991
• test(e2e): update spec-related constants to string literal by @qweeah in #992
• chore: update help doc with OCI layout support by @qweeah in #997
• feat: add flag to skip deleting obsolete referrers index by @qweeah in #957
• fix: pushing based on temporary file store path by @qweeah in #996
• chore: update minor version by @qweeah in #1000
• fix: properly print tree for oras discover by @shizhMSFT in #1005
• build(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #1008
• build(deps): bump oras-go to main branch by @qweeah in #1004
• revert: "chore: update minor version (#1000)" by @qweeah in #1014
• bump: update golang from 1.20.2 to 1.20.5 by @qweeah in #1015

New Contributors

• @northtyphoon made their first contribution in #938
• @yash7raut made their first contribution in #951
• @SamirPS made their first contribution in #965
• @enraiha0307 made their first contribution in #977
• @suganyas made their first contribution in #988

Full Changelog: v1.0.0...v1.1.0-rc.1

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0

ORAS CLI V1

oras is a CLI tool to manage artifacts in OCI-compliant registries and also a fully functional registry client. After a long journey of development, oras has reached a critical milestone for its first stable release v1.0.0. 🎉🎉🎉

While most features are stable, some features are labeled as preview or experimental for early accesses (#865).

• Preview features are almost stable but subject to change
• Experimental features are working in progress and not stable

Changes after v0.16.0 are summarized as follows.

New Features

• Introduce OCI image layout support with the flag --oci-layout
• BREAKING CHANGE: oras push and oras attach publish OCI image manifest by default
  • Auto manifest type selection is disabled (#782)
• BREAKING CHANGE: oras pull pulls artifacts without referenced artifacts. Use flag --include-subject to pull all artifacts recursively.
• BREAKING CHANGE: oras cp --recursive is re-designed to copy artifacts with attached artifacts (#826, #827)
• oras discover supports showing annotations of the discovered artifacts via the flag -v
• oras repo ls supports listing repositories under a certain namespace
• oras repo tags supports showing tags associated with a particular tag or digest
• Improve registry developer experience
  • Support temporary DNS resolving with optional port forwarding via the flag --resolve
    • Example: debug and test local registry instances: oras push --resolve prod.registry.io:443:127.0.0.1:5000 prod.registry.io/hello:v1 hi.txt
  • Support custom HTTP header via flag -H, --header
    • Example: correlate operations for specific registry providers: oras repo ls -H X-Correlation-Id=$CORRELATION_ID prod.registry.io
• Experimental: Introduce compatibility mode for OCI image-spec and distribution-spec
• Support HTTP client retry on read operations for registry targets
• Support s390x architecture for releasing oras

Other Changes

• BREAKING CHANGE: oras blob delete and oras manifest delete return success on non-existent content when the flag --force is specified
• Improve UX
  • oras discover prints subject digest for root node in tree-view output
  • oras tag prints digest for oras tag command
• Update dependencies to the latest versions
• Update to golang 1.20.2
• Improve documentation
• Assure quality by end-to-end tests

What's Changed Since RC.2

Bug Fixes

• Fix #883: manifest entries got removed fromindex.json when tagging an artifact in the OCI layout
• Minor fixes

Other Changes

• Better debug experiences by correlating debug logs for HTTP requests
• More E2E test cases
• Improved documentation

Detailed Commits

• docs: Add development environment section to readme by @TerryHowe in #822
• feat!: improve debug log readability by @wangxiaoxuan273 in #861
• doc: add feature marks to cmd description and log by @qweeah in #865
• test(e2e): add OCI layout e2e specs for oras cp by @qweeah in #869
• test: add e2e tests for custom header feature by @wangxiaoxuan273 in #837
• test(e2e): OCI layout specs for oras discover by @qweeah in #871
• build(deps): bump oras.land/oras-go/v2 from 2.0.0-20230224055117-216f081e33ba to 2.0.1 by @dependabot in #875
• chore: update owners by @shizhMSFT in #866
• test: add header e2e test cases for oras cp by @wangxiaoxuan273 in #874
• test(e2e): OCI layout specs for oras repo tags by @qweeah in #873
• test(e2e): OCI layout e2e specs for oras push by @qweeah in #878
• test(e2e): OCI layout specs for oras attach by @qweeah in #882
• test(e2e): add test specs for oras pull by @qweeah in #885
• test: add e2e specs for manifest fetch under oci-layout by @wangxiaoxuan273 in #888
• chore: e2e test code clean by @qweeah in #886
• test: add e2e tests for manifest fetch-config under oci-layout by @wangxiaoxuan273 in #889
• fix: add error when using media type assertion with oci layout by @wangxiaoxuan273 in #890
• fix: return error if content and password are both read from stdin by @qweeah in #892
• test(e2e): layout specs for oras manifest push by @qweeah in #880
• build(deps): bump oras.land/oras-go/v2 to 2.0.2 by @qweeah in #894
• bump: update go and release version by @qweeah in #895

Full Changelog: v1.0.0-rc.2...v1.0.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0-rc.2

New Features

• BREAKING CHANGE: The default value of --image-spec is set to v1.1-image for oras push and oras attach
  • Auto manifest type selection is disabled (#782)
• BREAKING CHANGE: oras cp --recursive is re-designed to copy artifacts with attached artifacts (#826, #827)
• oras repo ls supports listing repositories under a certain namespace
• oras repo tags supports showing tags associated with a particular tag or digest
• Support HTTP client retry on read operations for registry targets
• Improve registry developer experience
  • Support specifying port in custom DNS flag --resolve
    • Example: debug and test local registry instances: oras push --resolve prod.registry.io:443:127.0.0.1:5000 prod.registry.io/hello:v1 hi.txt
  • Support custom HTTP header via flag -H, --header
    • Example: correlate operations for specific registry providers: oras repo ls -H X-Correlation-Id=$CORRELATION_ID prod.registry.io

Bug Fixes

• Fix #782: root node's registry and repository are not shown in the tree view output of oras discover
• Fix #812: oras cp copies extra index and referrer nodes even when a platform flag is specified
• Fix #815: temp files remain after oras pull
• Fix #842: custom DNS rules not working for destination registry in oras cp
• Fix #846: credential config file is not working for destination registry in oras cp
• Fix #849: multi tagging fails when extra tags are provided in oras push
• Minor fixes

Other Changes

• Improve UX
  • oras discover prints subject digest for root node in tree-view output
  • oras tag prints digest for oras tag command
• Update to golang 1.20.1
• Update dependencies to the latest versions
• Add end-to-end test specs covering all registry-related cases

Detailed Commits

• bump: bump to golang 1.20 by @wangxiaoxuan273 in #784
• feat: suppport repo ls sub-namespace by @wangxiaoxuan273 in #768
• build(deps): bump github.com/docker/cli from 20.10.23+incompatible to 23.0.0+incompatible by @dependabot in #783
• chore: add vi and mac things to gitignore by @TerryHowe in #777
• fix: Have make file fail with wrong go version by @TerryHowe in #785
• feat!: show subject digest in oras discover by @qweeah in #798
• build(deps): bump github.com/docker/cli from 23.0.0+incompatible to 23.0.1+incompatible by @dependabot in #795
• feat: enable --header flag to specify headers with requests by @wangxiaoxuan273 in #794
• test(e2e): add e2e specs for oras cp by @qweeah in #749
• chore: add CODEOWNERS based on OWNERS.md by @shizhMSFT in #811
• fix: fix CODEOWNERS by @shizhMSFT in #819
• chore: move ParseRepoPath to internal package by @qweeah in #817
• test(e2e): add e2e specs for oras attach by @qweeah in #805
• chore: add Billy Zha as a maintainer by @shizhMSFT in #820
• chore: add Terry Howe as a maintainer by @shizhMSFT in #821
• fix: lazy close file store by @chi-qin in #831
• test(e2e): take registry logs when e2e fails by @qweeah in #830
• chore: Add basic PR template by @TerryHowe in #778
• feat: allow user to specify destination port via resolve flag by @qweeah in #801
• feat: Add ability query tags for oras repo tags command by @TerryHowe in #800
• test(e2e): specs for filtered tag listing by @qweeah in #832
• fix: fix bug when copying recursively with certain platforms by @qweeah in #818
• build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 in /test/e2e by @dependabot in #833
• fix: flaky test on multi referrers by @qweeah in #835
• test(e2e): add specs for oras discover by @qweeah in #828
• docs: Add CONTRIBUTING.md file by @TerryHowe in #781
• feat: add retry support to the auth client by @souleb in #838
• fix: support binary target in oras cp by @qweeah in #843
• fix!: support multiple config files in oras cp by @qweeah in #847
• feat: support --header for oras cp by @wangxiaoxuan273 in #848
• feat: return error when header flags used on oci layout by @qweeah in #841
• fix: push bug when multi tagging by @qweeah in #850
• refactor: clone default http transport for registry client by @qweeah in #840
• fix: Improve error message on oras copy.go with non-existent tags by @khanjasir90 in #852
• chore: add Billy Zha's GPG key by @qweeah in #844
• feat!: disable auto type conversion for manifests by @qweeah in #797
• feat: add digest hint in oras tag logs by @qweeah in #853
• bump: update oras-go by @qweeah in #856
• bump: update go to 1.20.1 by @qweeah in #857
• test(e2e): add e2e specs for custom DNS rules by @qweeah in #855
• bump: update version to rc.2 by @qweeah in #858

New Contributors

• @TerryHowe made their first contribution in #777
• @chi-qin made their first contribution in #831
• @souleb made their first contribution in #838
• @khanjasir90 made their first contribution in #852

Full Changelog: v1.0.0-rc.1...v1.0.0-rc.2

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

v1.0.0-rc.1

New Features

• Introduce OCI image layout support for ORAS with the flag --oci-layout
  • oras CLI is able to push / pull / copy artifacts from / to the local file system in OCI image layout
  • Folders and tar archives are supported on read
  • Folders are supported on write
  • Examples
    • Download an artifact into an OCI layout folder: oras cp localhost:5000/net-monitor:v1 --to-oci-layout download_folder:v1
    • Show tags in tar archives built by docker buildx build -o dest=out.tar,type=oci: oras repo tags --oci-layout out.tar
  • More examples can be found in the help pages of applicable commands
• Introduce compatibility mode for ORAS
  • oras push and oras attach allow building artifact using a specific manifest type via the flag --image-spec
    • Specify --image-spec v1.1-image to build artifact using OCI Image manifest
    • Specify --image-spec v1.1-artifact to build artifact using OCI Artifact manifest
  • oras push, oras attach, oras copy, oras discover, oras manifest push, and oras manifest delete allow opting for specific referrers implementation for listing referrers via the flag --distribution-spec
    • Specify --distribution-spec v1.1-referrers-api to opt for OCI Referrers API
    • Specify --distribution-spec v1.1-referrers-tag to opt for OCI Referrers Tag schema
• BREAKING CHANGE: oras pull will only pull direct artifacts. Use flag --include-subject to pull all artifacts recursively.
• oras discover supports showing annotations of the discovered artifacts via the flag -v
• Support temporary DNS resolving for remote server access via the flag --resolve host:port:address for applicable commands
• Support s390x architecture for releasing oras

Bug Fixes

• Fix #697: consistent file reference parsing on Windows and other platforms
• Fix #740: fail to extract symbols links when oras pull to an absolute path
• Minor fixes

Other Changes

• BREAKING CHANGE: oras blob delete and oras manifest delete return success on non-existent content when the flag --force is specified
• Update dependencies to the latest versions
• Improve documentation
• Assure quality by end-to-end tests

Detailed Commits

• test(e2e): add E2E testing utilities and sample specs by @qweeah in #639
• bump: update oras-go version by @qweeah in #683
• fix: only pull configuration in root by @qweeah in #684
• test: add test for oras push by @qweeah in #691
• bump: change oras-go version to rc6 and change concurrency type by @wangxiaoxuan273 in #715
• test: add utility for file matching by @qweeah in #701
• feat!: support configurable subject pulling by @qweeah in #689
• fix: add log when failed to scan confirmation by @qweeah in #705
• feat: add directional hints for debug logs by @qweeah in #713
• test: add e2e specs for oras pull by @qweeah in #693
• test: add e2e specs for oras blob fetch by @qweeah in #699
• test: add E2E specs for manifest fetch-config by @qweeah in #711
• test: add E2E specs covering repo subcommand by @qweeah in #716
• test: add e2e specs covering oras tag by @qweeah in #718
• test: add E2E specs for oras blob push by @qweeah in #706
• test: add E2E specs for manifest push by @qweeah in #702
• test: add E2E specs for oras manifest delete by @qweeah in #703
• test: add E2E specs covering blob delete by @qweeah in #708
• fix: add stdin password for discover, repo ls and repo tags by @qweeah in #725
• build(deps): bump github.com/docker/cli from 20.10.21+incompatible to 20.10.22+incompatible by @dependabot in #726
• fix: mandates empty referrer to empty array by @qweeah in #729
• feat: support customized DNS resolving for remote registry by @qweeah in #696
• fix!: fix colon in media type for windows by @qweeah in #698
• feat: add s390x release and image to support s390x architecture by @dmittelstaedt in #732
• feat: show annotations in oras discover tree format output by @qweeah in #735
• refactor(oci-layout): use Parser to process option input by @qweeah in #736
• feat!: force deleting a non-existent blob/manifest by @qweeah in #745
• feat: add compatibility mode for push and attach cmd by @qweeah in #741
• test(e2e): add oci artifact spec for common registry users by @qweeah in #746
• feat(oci-layout): support in oras cp by @qweeah in #748
• feat(oci-layout): support oras tag,oras repo tags and oras pull by @qweeah in #753
• feat(oci-layout): support in fetch and push for manifest and blob commands by @qweeah in #752
• feat(oci-layout): support in oras push and oras attach by @qweeah in #750
• build(deps): bump github.com/docker/cli from 20.10.22+incompatible to 20.10.23+incompatible by @dependabot in #758
• feat: support specifying distribution spec in discover, cp and manifest push commands by @qweeah in #757
• build(deps): bump oras-go to v2.0 by @qweeah in #759
• fix: support fetching manifest in oci image layout by @qweeah in #766
• feat: add distribution flag to manifest delete by @qweeah in #763
• feat: support artifact discovering in OCI image layout by @qweeah in #765
• doc: add ORAS CLI proposal doc for compatibility mode by @FeynmanZhou in #739
• fix: fix bugs related to the spec --distribution-spec by @Wwwsylvia in #772
• bump: upgrade golang and alpine versions by @Wwwsylvia in #773
• bump: release v1.0.0-rc.1 by @Wwwsylvia in #775

New Contributors

• @dmittelstaedt made their first contribution in #732
• @Wwwsylvia made their first contribution in #772

Full Changelog: v0.16.0...v1.0.0-rc.1

Notes

This release was signed with 95BB 6CD4 6CA3 0D2B 9CAE E56C 9F2C D437 A97D CB8F (@shizhMSFT's GPG key) which can be found here.