Feature Stability Updates

• Promote the following commands and flags from Preview to Stable:
  • oras attach
  • oras attach --platform
  • oras pull --include-subject
• Promote oras resolve from Experimental to Preview

Bug Fixes

• Fix #1795, #1825: redundant blank lines in terminal output

Other Changes

• Upgrade to Go 1.25.0
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.4 by @Wwwsylvia in #1799
• build(deps): bump library/golang from 1.24.5-alpine to 1.24.6-alpine by @dependabot[bot] in #1804
• build(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 by @dependabot[bot] in #1800
• chore: add Sylvia's GPG key by @Wwwsylvia in #1806
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #1814
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 in /test/e2e by @dependabot[bot] in #1816
• build(go): upgrade to Go 1.25.0 by @Wwwsylvia in #1817
• chore: mark --platform flag of oras attach from preview to stable by @wangxiaoxuan273 in #1822
• chore: mark oras resolve from experimental to preview by @wangxiaoxuan273 in #1823
• chore: remove [Preview] label on --include-subject for oras pull by @Wwwsylvia in #1821
• chore(ux): remove [Preview] label for oras attach by @Wwwsylvia in #1824
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.24.0 to 2.25.0 in /test/e2e by @dependabot[bot] in #1826
• fix: improve tty UX to avoid redundant blank by @wangxiaoxuan273 in #1827
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.0 to 2.25.1 in /test/e2e by @dependabot[bot] in #1828
• build(deps): bump github.com/onsi/gomega from 1.38.0 to 1.38.1 in /test/e2e by @dependabot[bot] in #1829

Full Changelog: v1.3.0-beta.4...v1.3.0-rc.1

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@Wwwsylvia's GPG key) which can be found here.

Experimental Features

• Introduce portable backup and restore of OCI artifacts, images, and repositories
  • oras backup: New command to back up artifacts from remote registries into local OCI image layouts, either as directories or tar archives.
  • oras restore: New command to restore artifacts from local OCI image layouts (directories or tar archives) back to remote registries.
• Add --format flag support for the oras repo ls and oras repo tags commands with text, json, and go-template output options
• Add --artifact-type flag support for oras manifest index create and oras manifest index update commands to set the artifact type of an OCI image index
• Enhance multi-repository OCI image layout support for oras repo tags to list tags under a specified repository

Bug Fixes

• Fix #1728: oras cp now correctly copies root index when the index has no referrers
• Fix #1715: oras discover --format json now properly shows referrers field when no referrer is found

Other Changes

• Add support for the loong64 architecture
• Improve UX with clearer error messages
• Improve code quality and performance
• Upgrade to Go 1.24.5
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.3 by @Wwwsylvia in #1705
• build: use alpine 3.21.3 by @Wwwsylvia in #1709
• Add test coverage for discover handler by @TerryHowe in #1712
• build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 by @dependabot[bot] in #1720
• build(deps): bump golang.org/x/term from 0.31.0 to 0.32.0 by @dependabot[bot] in #1721
• fix: packer decode json lint failure by @TerryHowe in #1688
• build(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0 in /test/e2e by @dependabot[bot] in #1724
• build(deps): bump oras.land/oras-go/v2 from 2.5.1-0.20250417082913-f7a6126986d9 to 2.6.0 by @dependabot[bot] in #1725
• fix: discover handler errors for lint by @TerryHowe in #1677
• fix: calls to close in tests unchecked for lint by @TerryHowe in #1678
• refactor: move different targets to different files by @TerryHowe in #1722
• fix: Change receiver name for Remote by @TerryHowe in #1727
• refactor(perf): optimize cases with no child referrers in recursiveCopy by @qweeah in #1729
• fix: lint explicitly ignore various close errors by @TerryHowe in #1684
• fix: rename interfaces file by @TerryHowe in #1730
• refactor: rename Target AnnotatedReference method by @TerryHowe in #1726
• fix(docs): remove a discover example with -v by @Wwwsylvia in #1742
• fix(lint): ignore returns from test defer calls by @TerryHowe in #1734
• fix: discover json format should show referrers field when no referrer is found by @wangxiaoxuan273 in #1731
• build(deps): bump github.com/containerd/console from 1.0.4 to 1.0.5 by @dependabot[bot] in #1743
• fix: replace slave var for child by @TerryHowe in #1736
• fix: rename slave to child for cp test by @TerryHowe in #1738
• docs(spec): artifactType in multi-platform index manifests by @apparentlymart in #1696
• docs: add examples for oci-layout-path by @wangxiaoxuan273 in #1746
• build(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 by @dependabot[bot] in #1750
• feat: oras manifest index: artifactType for index and child manifest descriptors by @apparentlymart in #1700
• feat: support --format for oras repo tags by @Wwwsylvia in #1756
• fix: resolve golangci-lint issues with unchecked error returns and embedded field access by @Copilot in #1755
• build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot[bot] in #1717
• ci: add dependabot support for Dockerfile by @tanyabhatnagar in #1761
• build(deps): bump library/golang from 1.24.2-alpine to 1.24.4-alpine by @dependabot[bot] in #1764
• build(deps): bump library/alpine from 3.21.3 to 3.22.0 by @dependabot[bot] in #1765
• docs: backup and restore specification by @TerryHowe in #1610
• docs(spec): define output formats for oras repo commands by @Wwwsylvia in #1763
• feat: support --format for oras repo ls by @Wwwsylvia in #1758
• fix(tests): fix packer test that failed on Windows by @Wwwsylvia in #1774
• docs: backup and restore to single OCI layout by @TerryHowe in #1775
• test: exclude incompatible test Go OSes by @TerryHowe in #1779
• refactor: ApplyFlags with prefix for Remote and Target by @TerryHowe in #1733
• build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by @dependabot[bot] in #1781
• build(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 by @dependabot[bot] in #1780
• feat: show repo tags with --oci-layout-path in repo tags command by @wangxiaoxuan273 in #1759
• chore(ux): improve copy error message by @Wwwsylvia in #1773
• build(deps): bump library/golang from 1.24.4-alpine to 1.24.5-alpine by @dependabot[bot] in #1782
• fix: oras cp should copy root index when the index has no referrers by @wangxiaoxuan273 in #1749
• build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #1785
• build(deps): bump library/alpine from 3.22.0 to 3.22.1 by @dependabot[bot] in #1786
• build: release loong64 by @amazingfate in #1787
• docs: add scenario doc for Backup and Restore of OCI Artifacts and Images by @FeynmanZhou in #1778
• docs: enrich the CLI design of oras backup and oras restore by @FeynmanZhou in #1767
• feat: oras backup to backup artifacts to a directory or a tar by @Wwwsylvia in #1790
• build(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 in /test/e2e by @dependabot[bot] in #1789
• feat: add oras restore command by @Wwwsylvia in #1792
• build(go): upgrade go version and dependencies by @Wwwsylvia in #1796

New Contributors

• @apparentlymart made their first contribution in #1696
• @Copilot made their first contribution in #1755
• @tanyabhatnagar made their first contribution in #1761
• @amazingfate made their first contribution in #1787

Full Changelog: v1.3.0-beta.3...v1.3.0-beta.4

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

Bug Fixes

• Fix #1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #1623: Should show KB instead of kB in the progress bar

Other Changes

• Minor security enhancements
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.2 by @shizhMSFT in #1592
• fix: scope action only has pull when get service token in executing cmd org push by @hopegi in #1600
• build: upgrade Go version and dependencies to the latest by @Wwwsylvia in #1706
• backport(fix): show KB in progress bar instead of kB (#1623) by @Wwwsylvia in #1707
• build: use alpine 3.21.3 by @Wwwsylvia in #1708

New Contributors

• @hopegi made their first contribution in #1600

Full Changelog: v1.2.2...v1.2.3

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

New Features

• Add oras manifest get as an alias for oras manifest fetch

Preview Features

• Improve tree view in oras discover
  • Annotations are displayed by default
  • Trees are colorized 🌈
• BREAKING CHANGE Remove the global --no-tty flag
  • The --no-tty flag is kept for TTY-capable commands

Experimental Features

• Refine the output of oras discover
  • BREAKING CHANGE Rename the manifests field to referrers
  • Add subject manifest details for the json format
• oras discover displays referrers recursively by default
  • Add a --depth flag to control the maximum depth of referrers discovered

Deprecation

• Mark the table option for the --format flag in oras discover as deprecated

Bug Fixes

• Fix #1659, #1694, #1695: Unexpected error "compare and swap of inconsistently typed value into Value" was returned
• Fix #1640: The --verbose flag was removed in v1.3.0-beta.1
• Minor fixes

Other Changes

• Upgrade to Go 1.24.2
• Update dependencies
• Improve documentation
• Optimize code structure

Detailed Commits

• refactor: add manifest delete metadata handler by @wangxiaoxuan273 in #1633
• bump: tag and release ORAS CLI v1.3.0-beta.2 by @Wwwsylvia in #1635
• refactor: use iter for cleaner code by @shizhMSFT in #1637
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 in /test/e2e by @dependabot in #1643
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 by @dependabot in #1642
• docs: add goreportcard to README by @TerryHowe in #1641
• build(deps): bump golang.org/x/sync from 0.11.0 to 0.12.0 by @dependabot in #1645
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0 in /test/e2e by @dependabot in #1647
• build(deps): bump golang.org/x/term from 0.29.0 to 0.30.0 by @dependabot in #1646
• feat: add alias for manifest fetch by @wangxiaoxuan273 in #1644
• refactor: split a run and main function so defers Execute by @chrisguitarguy in #1658
• build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 in /test/e2e by @dependabot in #1655
• docs(spec): multi-arch image management by @FeynmanZhou in #1514
• refactor: deprecate table format by @wangxiaoxuan273 in #1656
• fix: bring back --verbose flag by @wangxiaoxuan273 in #1660
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.0 to 2.23.1 in /test/e2e by @dependabot in #1662
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.1 to 2.23.2 in /test/e2e by @dependabot in #1663
• fix: target NewReadonlyTarget comment by @TerryHowe in #1665
• build(deps): bump github.com/onsi/gomega from 1.36.2 to 1.36.3 in /test/e2e by @dependabot in #1667
• docs: improve formatted output for oras discover by @FeynmanZhou in #1625
• feat!: refine oras discover JSON format by @wangxiaoxuan273 in #1649
• build(deps): upgrade go crypto module to v0.36.0 by @kysucix in #1671
• feat!: support showing indirect referrers for all formats of oras discover by @wangxiaoxuan273 in #1653
• fix: Change receiver name for target by @TerryHowe in #1666
• fix: use test Setenv during tests by @TerryHowe in #1675
• fix: staticcheck fails for embedded member by @TerryHowe in #1676
• fix: unneeded error check by @TerryHowe in #1680
• fix: staticcheck lint failures of embedded member by @TerryHowe in #1679
• build(deps): bump github.com/onsi/gomega from 1.36.3 to 1.37.0 in /test/e2e by @dependabot in #1685
• fix: blob file close handling for lint by @TerryHowe in #1687
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e by @dependabot in #1690
• build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0 by @dependabot in #1692
• build(deps): bump golang.org/x/sync from 0.12.0 to 0.13.0 by @dependabot in #1691
• fix: explicitly ignore return for newest lint by @TerryHowe in #1683
• docs: update the help doc for oras manifest index create by @RohanMishra315 in #1650
• feat: show annotations in default discovery output by @Horiodino in #1602
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in /test/e2e by @dependabot in #1697
• docs: update help doc for oras manifest index update by @wangxiaoxuan273 in #1698
• build(deps): bump oras-go to the latest commit which fixes the "compare and swap" error by @Wwwsylvia in #1702
• build(go): upgrade go version to 1.24.2 by @Wwwsylvia in #1703
• refactor: move --no-tty out of option.Common by @wangxiaoxuan273 in #1699

New Contributors

• @chrisguitarguy made their first contribution in #1658
• @kysucix made their first contribution in #1671
• @RohanMishra315 made their first contribution in #1650

Full Changelog: v1.3.0-beta.2...v1.3.0-beta.3

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

New Features

• oras is compliant with OCI distribution-spec v1.1.1

Bug Fixes

• Fix #1576: Missing digests of fetched manifests in the output of oras manifest index create
• Fix #1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #1582: The --oci-layout-path flag was not marked as experimental
• Fix #1623: Should show KB instead of kB in the progress bar
• Fix #1593: Unable to download an artifact twice if it contains symbolic links
• Minor fixes

Other Changes

• Upgraded to Go 1.24.0
• Updated dependencies
• Improved documentation
• Optimized code structure

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.1 by @qweeah in #1577
• build(deps): bump github.com/onsi/gomega from 1.36.0 to 1.36.1 in /test/e2e by @dependabot in #1580
• fix: handle errors returned by Close() in write paths by @wangxiaoxuan273 in #1581
• refactor: add metadata render interface and apply it to oras attach command by @wangxiaoxuan273 in #1578
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @dependabot in #1585
• chore: clean metadata handler for attach command by @qweeah in #1584
• refactor: apply metadata render interface to oras push command by @wangxiaoxuan273 in #1583
• refactor: add handlers to manifest push commmand by @wangxiaoxuan273 in #1555
• chore: add lint make file target by @TerryHowe in #1586
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 in /test/e2e by @dependabot in #1596
• build(deps): bump github.com/onsi/gomega from 1.36.1 to 1.36.2 in /test/e2e by @dependabot in #1598
• fix: add digest to fetched status output of manifest index create by @wangxiaoxuan273 in #1579
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 in /test/e2e by @dependabot in #1601
• build(deps): bump golang.org/x/term from 0.27.0 to 0.28.0 by @dependabot in #1603
• docs: add Sylvia Lei as a maintainer by @shizhMSFT in #1604
• fix: scope action only has pull when get service token in executing cmd org push by @Wwwsylvia in #1608
• fix: mark --oci-layout-path as experimental by @Horiodino in #1607
• docs: update the help doc for --oci-layout-path by @Wwwsylvia in #1609
• refactor: apply metadata render interface to oras discover command by @wangxiaoxuan273 in #1605
• refactor: apply metadata render interface to oras pull command by @wangxiaoxuan273 in #1587
• build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0 by @dependabot in #1615
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot in #1614
• refactor: apply metadata render interface to index commands by @wangxiaoxuan273 in #1606
• build(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot in #1617
• chore: add SVG file to license checker ignoring list by @FeynmanZhou in #1620
• fix(ux): show KB in progress bar instead of kB by @qweeah in #1623
• build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot in #1622
• refactor: improve metadata handler of oras cp by @wangxiaoxuan273 in #1624
• refactor(progress): generic progress tracking by @shizhMSFT in #1524
• docs: add an enhancement proposal doc template by @FeynmanZhou in #1621
• build: upgrade to Go 1.24.0 by @Wwwsylvia in #1629
• fix: bump oras-go to the latest commit which fixes the symlink issue by @Wwwsylvia in #1628
• refactor: use handlers for oras blob push command by @wangxiaoxuan273 in #1618
• refactor: add resolve metadata handler by @wangxiaoxuan273 in #1631
• refactor: add blob delete metadata handler by @wangxiaoxuan273 in #1632
• fix: fix errors in manifest index examples by @wangxiaoxuan273 in #1634

New Contributors

• @Horiodino made their first contribution in #1607

Full Changelog: v1.3.0-beta.1...v1.3.0-beta.2

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

Changes

• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.1 by @qweeah in #1563
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @Wwwsylvia in #1591

Full Changelog: v1.2.1...v1.2.2

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

New Features

• Add OS and architecture information to oras version

Experimental Features

• Introduce multi-arch image / artifact management
  • New command set oras manifest index to manipulate OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • New flag --artifact-platform for oras push to push artifacts with platform information
• Support fully qualified reference for OCI image layout with a new flag --oci-layout-path (#1505)

Deprecation

• -v, --verbose flag is marked as deprecated for all commands and is by default for the following commands:
  • oras attach
  • oras blob push
  • oras cp
  • oras manifest push
  • oras pull
  • oras push

Bug Fixes

• Remove redundant -v, --verbose flag from below commands:
  • oras blob delete
  • oras blob fetch
  • oras login
  • oras manifest delete
  • oras manifest fetch
  • oras manifest fetch-config
  • oras repo ls
  • oras repo tags
  • oras resolve
  • oras tag
• Fix #1436: oras tag no longer creates referrer tag
• Fix #1442: invalid progress bar shown for empty layers
• Fix #1494: invalid reference in the format output of oras pull
• Minor fixes

Other Changes

• Improve UX
  • Improve error messages
  • Improve diagnose experience
• Improve documentation
• Update dependencies
• Update to Golang 1.23.4
• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0 by @qweeah in #1393
• build(deps): bump golang.org/x/term from 0.20.0 to 0.21.0 by @dependabot in #1399
• chore: Remove deprecated Print method by @TerryHowe in #1398
• chore: Remove unused file by @TerryHowe in #1395
• chore: Update goreleaser to v6 and configuration to v2 by @TerryHowe in #1402
• refactor: Move printer to output package by @TerryHowe in #1394
• Update links in README.md by @bcho in #1408
• refactor: Clean up pull handlers by @TerryHowe in #1407
• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #1410
• refactor: Move verbose into printer object by @TerryHowe in #1406
• refactor: clean status prompts by @qweeah in #1409
• chore: Add format type text by @TerryHowe in #1397
• chore: Increase print test coverage by @TerryHowe in #1411
• refactor: Move descriptor logic to descriptor by @TerryHowe in #1413
• chore: Ignore e2e test go sum file by @TerryHowe in #1416
• refactor: Move generate content key method to descriptor by @TerryHowe in #1415
• refactor: Move two output functions to the output package by @TerryHowe in #1417
• fix(doc): resolve example error for oras tag by @qweeah in #1419
• build(ci): set codecov CLI version to avoid tokenless upload failure by @qweeah in #1421
• refactor: Pass printer to text handler by @TerryHowe in #1420
• refactor: Use printer object for output by @TerryHowe in #1426
• chore: Add json test coverage by @TerryHowe in #1425
• fix: Minor spelling error in test by @TerryHowe in #1429
• refactor: assembles printer in the common output option by @qweeah in #1428
• refactor: Handle stderr similar to stdout by @TerryHowe in #1427
• refactor: reduce printer instantiation & unify stdout/stderr usage by @qweeah in #1433
• build(ci): unset codecov CLI version by @qweeah in #1434
• fix: disable oras tag fallback to tag schema when tagging a referrer by @njucjc in #1435
• refactor: Create tag handlers by @TerryHowe in #1437
• chore: Remove last deprecated method by @TerryHowe in #1438
• refactor: add display handler for cp, tag and manifest push by @qweeah in #1439
• chore(ux): improve error message when attaching without subject artifact by @qweeah in #1430
• build(deps): bump golang.org/x/term from 0.21.0 to 0.22.0 by @dependabot in #1440
• refactor: Move channel write logic to manager by @TerryHowe in #1445
• fix: variable name conflicts with built in function by @TerryHowe in #1448
• refactor: Isolate progress channel in Messenger by @TerryHowe in #1447
• refactor: Take private memory store out of test function by @TerryHowe in #1453
• chore: Bring back the print error by @TerryHowe in #1451
• fix: A couple small fixes to the descriptor test by @TerryHowe in #1452
• refactor: Create text copy handler by @TerryHowe in #1441
• refactor: replace error-ignored cobra output functions by @qweeah in #1454
• build(deps): bump github.com/onsi/gomega from 1.33.1 to 1.34.0 in /test/e2e by @dependabot in #1458
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in /test/e2e by @dependabot in #1462
• feature: Add manifest fetch documentation for digest by @TerryHowe in #1465
• fix: oras repo tags exlude-digest-tags documentation by @TerryHowe in #1467
• fix: Mention the resolve command in manifest fetch help by @TerryHowe in #1466
• refactor: increase test coverage for mac for tty tests by @TerryHowe in #1460
• refactor: Move testutils to general location by @TerryHowe in #1459
• refactor: Make mock fetcher generally available by @TerryHowe in #1455
• build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot in #1468
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 in /test/e2e by @dependabot in #1471
• build(deps): bump golang.org/x/term from 0.22.0 to 0.23.0 by @dependabot in #1470
• refactor: Successor getting with separation of concerns by @TerryHowe in #1443
• refactor: DRY up text_test by @TerryHowe in #1473
• docs: fix typo in help text of 'attach' command by @nmiyake in #1477
• chore: lint fixes for new lint by @TerryHowe in #1478
• chore: reset test coverage package list by @qweeah in #1482
• refactor: remove build constraint from testutils console by @TerryHowe in #1480
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.0 to 2.20.1 in /test/e2e by @dependabot in #1486
• fix: copy prompt skipped was missing by @TerryHowe in #1484
• build(deps): bump github.com/onsi/gomega from 1.34.1 to 1.34.2 in /test/e2e by @dependabot in #1489
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in /test/e2e by @dependabot in #1488
• build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 by @dependabot in #1491
• build: upgrade to Go 1.23.0 by @Wwwsylvia in #1493
• build(deps): bump golang.org/x/term from 0.23.0 to 0.24.0 by @dependabot in #1495
• feat: create index from existing manifests (index create) by @wangxiaoxuan273 in #1475
• fix: reference in the formatted output of oras pull is invalid by @wangxiaoxuan273 in #1496
• docs: add examples for --format by @wangxiaoxuan273 in #1497
• docs: improve the description of cp by @wangxiaoxuan273 in #1498
• feat: --output for oras manifest index create by @wangxiaoxuan273 in #1490
• feature: build binary for OS an...

Bug Fixes

• Fix #1436: oras tag creates referrers tags unexpectedly

Other Changes

• Improve documentation
• Update dependencies
• Update to Golang 1.23.4

Detailed Commits

• bump: golang version to fix CVE-2024-24790 and CVE-2024-34156 by @qweeah in #1562
• chore: bump golang and dependencies by @qweeah in #1564
• chore: backport main-branch fixes into release-1.2 branch by @qweeah in #1567
• docs: add experimental marks to examples by @qweeah in #1570

Full Changelog: v1.2.0...v1.2.1

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Introduce brand-new default terminal experience
  • Show live progress for the following commands:
    • oras copy
    • oras pull
    • oras push
    • oras attach
    • oras blob fetch
    • oras blob push
  • The new terminal experience can be turned off via the preview flag --no-tty
• Support deletion of manifests and blobs in OCI image layout
• Support X.509 mTLS authentication with OCI registries

Preview Features

• BREAKING CHANGE Registries supporting Referrers API prior to distribution-spec v1.1.0-rc4 will fall back to Referrers tag schema, causing unexpected results of oras attach and oras discover commands
• Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform
• Re-purpose the flag --recursive of oras cp from extended copy to copy an artifact or a multi-arch image and its referrers
• Promote --image-spec to a preview flag from experimental

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• Introduce formatted output via --format by implementing the specification
  • Formatted output is available to the following commands:
    • oras pull
    • oras push
    • oras attach
    • oras discover
    • oras manifest fetch
  • Examples:
    • --format json to print operation result as a JSON object
    • --format "go-template={{ .digest }}" to print the digest of the manifest using Go template
      • Template can also be specified by --template
• Introduce oras resolve to get the digest of an artifact

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: Snaps build cannot read default credentials file
• Fix #1096: Mixed request number in the debug mode
• Fix #1106: Flag --plain-http=false does not work for local registries
• Fix #1129: oras cp -r fails if index has a child manifest as subject
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve performance
  • Reduce authentication request count fororas copy, oras manifest delete, and oras blob delete
  • Support blob mounting across repositories in the same registry for oras copy
• Update dependencies
• Update to Golang 1.22.3
• Minor security enhancements

What's Changed Since RC.1

Other Changes

• Improve documentation
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-rc.1 by @qweeah in #1381
• fix: remove non-classic snap plugins by @qweeah in #1383
• fix: oras cp documentation by @TerryHowe in #1384
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #1385
• refactor: Get rid of deprecated PrintStatus method by @TerryHowe in #1378
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.3 to 2.18.0 in /test/e2e by @dependabot in #1388
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.18.0 to 2.19.0 in /test/e2e by @dependabot in #1390
• chore: Remove deprecated PrintStatus method by @TerryHowe in #1389
• doc: verify local files by @qweeah in #1386
• fix: remove call to deprecated print by @TerryHowe in #1392

Full Changelog: v1.2.0-rc.1...v1.2.0

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.

New Features

• oras is compliant with OCI image-spec v1.1.0 and distribution-spec v1.1.0
• Support X.509 mTLS authentication with OCI registries
• PREVIEW Introduce --platform to oras attach for better multi-arch attaching experience, which allows adding referrer artifact to a specific sub-platform

Experimental Features

• BREAKING CHANGE oras discover shows tree view output by default
• BREAKING CHANGE Introduce new go templating experience to all commands support --format based on the spec
  • BREAKING CHANGE Require explicit type assertion --format go-template=TEMPLATE
  • BREAKING CHANGE Change field selectors from uppercased to lowercased
  • BREAKING CHANGE Rename digested reference selector to reference
  • Examples:
    • --format go-template="{{ .digest }}" to print the digest of the newly pushed manifest using Go template
  • Template can also be specified by --template
• Introduce output control via --format to oras pull, oras manifest fetch, and oras discover

Deprecation

• oras discover: --output is marked as deprecated and succeeded by --format

Bug Fixes

• Fix #1079: snap build cannot read default credentials file
• Fix #1268: oras blob fetch failed to output to stdout in terminal mode
• Fix #1300: pushing with multiple tags will corrupt --format output
• Minor fixes

Other Changes

• Improve UX
  • oras discover: show placeholder when artifactType is not presented in an index referrer
  • oras push: show artifact type when pushing files
  • Improve error message based on ORAS CLI error handling guildline
  • Improve identity token input by a new flag --identity-token to replace --password without --username
• Improve live progress output for terminal
  • Introduce colored output
  • Smooth download speed display with reduced fluctuation
• Update dependencies
• Update to Golang 1.22.3

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0-beta.1 by @qweeah in #1266
• doc (spec): add error message guideline by @FeynmanZhou in #1163
• build(deps): bump github.com/containerd/console from 1.0.3 to 1.0.4 by @dependabot in #1269
• build(deps): bump golang.org/x/term from 0.16.0 to 0.17.0 by @dependabot in #1270
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.15.0 to 2.16.0 in /test/e2e by @dependabot in #1278
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in #1272
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 in /test/e2e by @dependabot in #1271
• fix(e2e): update ZOT image by @qweeah in #1284
• build(deps): bump golang.org/x/term from 0.17.0 to 0.18.0 by @dependabot in #1279
• test(unit): exclude darwin from go build constraint by @wangxiaoxuan273 in #1289
• refactor: pass cobra.Command to all cmd exec functions by @TerryHowe in #1285
• fix: make --output - implies --no-tty by @wangxiaoxuan273 in #1286
• build(actions): update github actions for Node 20 by @TerryHowe in #1287
• fix: Revert github actions coverage until fixed by @TerryHowe in #1290
• feat: Use cobra.Command.OutOrStdout method for output by @TerryHowe in #1288
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /test/e2e by @dependabot in #1296
• build(deps): bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /test/e2e by @dependabot in #1297
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /test/e2e by @dependabot in #1305
• refactor: add stdout to metadata handlers by @qweeah in #1312
• bump: bump oras-go to 2.5.0 by @wangxiaoxuan273 in #1303
• refactor: use command output in status output by @qweeah in #1314
• chore: using const to replace string by @LinuxSuRen in #1316
• refactor: make command accessible in option parser by @wangxiaoxuan273 in #1315
• bump: update golang to 1.22 by @TerryHowe in #1282
• build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #1323
• build(deps): bump golang.org/x/term from 0.18.0 to 0.19.0 by @dependabot in #1322
• bump(ci): update codecov gha to v4 by @qweeah in #1324
• bump(ci): update golangci-lint to v4 by @qweeah in #1325
• feat: support --format for oras pull by @qweeah in #1293
• feat: support --platform for oras attach by @qweeah in #1309
• feat: show artifact type when pushing files by @wangxiaoxuan273 in #1320
• fix: oras push should return error when artifacttype is empty for spec 1.1 by @wangxiaoxuan273 in #1317
• build(ci): add dependabot to update ci version automatically by @qweeah in #1326
• build(deps): bump apache/skywalking-eyes from 0.4.0 to 0.6.0 by @dependabot in #1328
• build(deps): bump goreleaser/goreleaser-action from 2 to 5 by @dependabot in #1329
• build(deps): bump actions/setup-go from 4 to 5 by @dependabot in #1331
• build(deps): bump actions/stale from 8 to 9 by @dependabot in #1330
• build(deps): bump github/codeql-action from 2 to 3 by @dependabot in #1332
• feat: support --format in manifest fetch command by @qweeah in #1295
• ux: improve the usage doc of --image-spec by @wangxiaoxuan273 in #1334
• feat: support --format in oras discover by @qweeah in #1299
• chore: add preview feature mark to platform-specific attaching by @qweeah in #1337
• feat: oras discover should show a placeholder of artifactType if it's not presented by @wangxiaoxuan273 in #1336
• feat: make image spec preview by @wangxiaoxuan273 in #1338
• feat: make --identity-token an alias of --password by @wangxiaoxuan273 in #1294
• fix: discard tagging output when pushing with formatted output by @qweeah in #1302
• feat: add color to progress mark and bar by @qweeah in #1344
• feat: make all go-template key lower-cased by @qweeah in #1343
• feat: improve error message when detecting conflicting flags by @wangxiaoxuan273 in #1345
• feat: add mTLS options by @sabre1041 in #1319
• chore: set go version to 1.22.0 in go.mod by @Amulyam24 in #1351
• fix: fix failed Windows unit test by @wangxiaoxuan273 in #1352
• chore(ux): optimize progress bar by @qweeah in #1349
• fix: fix error message when output is used before format for oras discover by @wangxiaoxuan273 in #1354
• fix: return error when --format and --pretty are both used by @wangxiaoxuan273 in #1359
• fix: ignore --pretty when --output is used for oras manifest fetch by @wangxiaoxuan273 in #1363
• build(deps): bump github.com/onsi/gomega from 1.32.0 to 1.33.0 in /test/e2e by @dependabot in #1364
• build(deps): bump golangci/golangci-lint-action from 4 to 5 by @dependabot in #1370
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.1 to 2.17.2 in /test/e2e by @dependabot in #1369
• feat: improve error message of when a set of flags is required to use together by @wangxiaoxuan273 in #1358
• build(deps): bump github.com/onsi/gomega from 1.33.0 to 1.33.1 in /test/e2e by @dependabot in #1371
• refactor: move logger method to command by @TerryHowe in #1355
• refactor: Move ShortDigest out of display package by @te...