Upgrading to new OCI 1.1 spec

[shizhMSFT]

A new release candidate of OCI 1.1 spec is released.

• image-spec v1.1.0-rc.3
• image-spec v1.1.0-rc4
• distribution-spec v1.1.0-rc.2
• distribution-spec v1.1.0-rc.3

We need to discuss how oras-go should support / implement the latest release candidate, or we should hold on for the stable release.

---

Summary of ORAS Related Changes

image-spec: v1.1.0-rc2 --> v1.1.0-rc4

• BREAKING CHANGE Removed artifact manifest
• BREAKING CHANGE Removed pre-defined annotation keys
  • org.opencontainers.artifact.created
  • org.opencontainers.artifact.description
  • org.opencontainers.referrers.filtersApplied
• Minimum golang version changed to 1.18
• Non-distributable layers a.k.a. foreign layers are deprecated
• Introduced empty descriptor
  • Media type: application/vnd.oci.empty.v1+json
• artifactType field is introduced to the image manifest. This field MUST be set if the config media type is set to empty
• artifactType and subject fields are introduced to the image index
• layers field of an image manifest SHOULD NOT be empty, which was a MUST. If the config media type is application/vnd.oci.image.config.v1+json, layers MUST NOT be empty.
• Introduced Guidelines for Artifact Usage

Full change set: opencontainers/image-spec@v1.1.0-rc2...v1.1.0-rc4

distribution-spec: v1.1.0-rc1 --> v1.1.0-rc.3

• Removed docs to the OCI Artifacts repository
• Updated conformance tests
• BREAKING CHANGE Removed artifact manifest
• Introduced the OCI-Chunk-Min-Length header
• Introduced new endpoint end-13: GET /v2/<name>/blobs/uploads/<reference>.

  Note This endpoint exists in the Docker Registry HTTP API V2

• IMPORTANT The OCI-Subject header is returned on PUT manifest with subject if the remote registry supports Referrers API.
• BREAKING CHANGE Applying filters on the Referrers API will not return a result JSON with the annotation org.opencontainers.referrers.filtersApplied. Instead, the registry server returns a header OCI-Filters-Applied.
• Introduced Warning headers
• Minimum golang version changed to 1.18
• Repository name is relaxed. However, it is still a subset of the docker spec. Related oras-go code:
  

  oras-go/registry/reference.go

  Lines 30 to 37 in 0e20275

  	// repositoryRegexp is adapted from the distribution implementation. The
  	// repository name set under OCI distribution spec is a subset of the docker
  	// spec. For maximum compatability, the docker spec is verified client-side.
  	// Further checks are left to the server-side.
  	// References:
  	// - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
  	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
  	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)

Full change set: opencontainers/distribution-spec@v1.1.0-rc1...v1.1.0-rc.3

---

Detailed Changes by Release

image-spec: v1.1.0-rc2 --> v1.1.0-rc.3

• BREAKING CHANGE Removed artifact manifest
• BREAKING CHANGE Removed pre-defined annotation keys
  • org.opencontainers.artifact.created
  • org.opencontainers.artifact.description
  • org.opencontainers.referrers.filtersApplied
• Minimum golang version changed to 1.18
• Non-distributable layers a.k.a. foreign layers are deprecated
• Introduced scratch config
  • Media type: application/vnd.oci.scratch.v1+json
• artifactType field is introduced to the image manifest. This field MUST be set if the config media type is set to scratch
• layers field of an image manifest SHOULD NOT be empty, which was a MUST. If the config media type is application/vnd.oci.image.config.v1+json, layers MUST NOT be empty.
• Introduced Guidelines for Artifact Usage

Full change set: opencontainers/image-spec@v1.1.0-rc2...v1.1.0-rc.3

image-spec: v1.1.0-rc.3 --> v1.1.0-rc4

• artifactType and subject fields are introduced to the image index
• scratch config is changed to empty descriptor
  • Media type: application/vnd.oci.empty.v1+json

Full change set: opencontainers/image-spec@v1.1.0-rc.3...v1.1.0-rc4

distribution-spec: v1.1.0-rc1 --> v1.1.0-rc.2

• Removed docs to the OCI Artifacts repository
• Updated conformance tests
• BREAKING CHANGE Removed artifact manifest
• Introduced the OCI-Chunk-Min-Length header
• Introduced new endpoint end-13: GET /v2/<name>/blobs/uploads/<reference>.

  Note This endpoint exists in the Docker Registry HTTP API V2

• IMPORTANT The OCI-Subject header is returned on PUT manifest with subject if the remote registry supports Referrers API.
• BREAKING CHANGE Applying filters on the Referrers API will not return a result JSON with the annotation org.opencontainers.referrers.filtersApplied. Instead, the registry server returns a header OCI-Filters-Applied.
• Introduced Warning headers
• Minimum golang version changed to 1.18

Full change set: opencontainers/distribution-spec@v1.1.0-rc1...v1.1.0-rc.2

distribution-spec: v1.1.0-rc.2 --> v1.1.0-rc.3

• Repository name is relaxed. However, it is still a subset of the docker spec. Related oras-go code:
  

  oras-go/registry/reference.go

  Lines 30 to 37 in 0e20275

  	// repositoryRegexp is adapted from the distribution implementation. The
  	// repository name set under OCI distribution spec is a subset of the docker
  	// spec. For maximum compatability, the docker spec is verified client-side.
  	// Further checks are left to the server-side.
  	// References:
  	// - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
  	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
  	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)

Full change set: opencontainers/distribution-spec@v1.1.0-rc.2...v1.1.0-rc.3

[shizhMSFT]

Resolving this issue resolves

• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2 to 1.1.0-rc.3 #491
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc2.0.20221005185240-3a7f492d3f1b to 1.1.0-rc.3 #492

[rchincha]

zot depends on this library to support ORAS artifacts. So a rc or a branch that removes/fixes at least the symbols much appreciated.

For example:
https://github.com/oras-project/oras-go/blob/main/internal/descriptor/descriptor.go#L73

[shizhMSFT]

@rchincha The PR #496 is going to fix that.

[andaaron]

Hi,

We're testing the image spec master branch on zot, and we noticed this constant was removed from the spec:
there is a constant which got removed from the spec: opencontainers/image-spec@7f43cb4

And is currently used in:

oras-go/pack.go

Line 93 in 2e7b65f

annotations, err := ensureAnnotationCreated(opts.ManifestAnnotations, ocispec.AnnotationArtifactCreated)

[Wwwsylvia]

@andaaron Thanks for the reminder! We will fix that in the upcoming versions.

[Wwwsylvia]

For the next minor version of oras-go, we will update it to comply with image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3. The updated version will remain compatible with image-spec v1.1.0-rc2 and distribution-spec v1.1.0-rc1, and will not introduce any breaking changes.

The required changes for oras-go include:

• Upgrade go mod to image-spec v1.1.0-rc4 and fix the missing types #530
• Support Image Index with a subject #531
• Update oras.Pack to comply with image-spec v1.1.0-rc4 #532
• Update the implementation of Referrers API #533 (Related: Feature Request: Check filters-applied response header for Referrers API #443)
• Update the implementation of pushing manifest #534
• Update the implementation of deleting manifest #535
• Feature Request: Present Warning header to the end user #469

[shizhMSFT]

Closing this issue as oras-go has been up-to-date with image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3.