v1.2.0

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the preview flag --no-tty
• Support deletion of manifests and blobs in OCI image layout
• Support X.509 mTLS authentication with OCI registries

Preview Features

• BREAKING CHANGE Registries supporting Referrers API prior to distribution-spec v1.1.0-rc4 will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
• Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and its referrers
• Promote --image-spec to a preview flag from experimental

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• Introduce formatted output via --format by implementing the specification
  • Formatted output is available to the following commands:
    • oras pull
    • oras push
    • oras attach
    • oras discover
    • oras manifest fetch
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "go-template={{ .digest }}" to print the digest of the manifest using Go template
      • Template can also be specified by --template
• Introduce oras resolve to get the digest of an artifact

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: Snaps build cannot read default credentials file
• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.22.3
• Minor security enhancements

---

What's Changed Since RC.1

Other Changes

• Improve documentation
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-rc.1 by @qweeah in #1381
• fix: remove non-classic snap plugins by @qweeah in #1383
• fix: oras cp documentation by @TerryHowe in #1384
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #1385
• refactor: Get rid of deprecated PrintStatus method by @TerryHowe in #1378
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.3 to 2.18.0 in /test/e2e by @dependabot in #1388
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.18.0 to 2.19.0 in /test/e2e by @dependabot in #1390
• chore: Remove deprecated PrintStatus method by @TerryHowe in #1389
• doc: verify local files by @qweeah in #1386
• fix: remove call to deprecated print by @TerryHowe in #1392

Full Changelog: v1.2.0-rc.1...v1.2.0

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.