@FeynmanZhou Yes, I will be able to look into this later in the week week of (Jan 19-20)

Thank @vsoch for pointing this out. The issue 119 is mainly for the auth protocol, which is covered by the package oras.land/oras-go/v2/regsitry/auth in oras-go v2.

The new repository in this discussion is mainly about obtaining the credentials used for auth.

You don't think credentials for auth would become part of some new auth spec? I don't think we can rule that out.

From my own understanding, the PR opencontainers/tob#119 proposes a new WG for specs of Authentication (AuthN) and Authorization (AuthZ) for the interactions between servers and clients. However, accessing credentials used for authentication is in the scope of Key Management.

Here's a simple scenario showing the differences of the concepts:

1. Type username and password memorized in my brain --> Key Management. Since there are lots of username and password pairs, I may store those credentials directly on the disk (insecure way) or use a Key Management Service (more secure way).
2. The remote registry recognizes me as identified by the username after verifying the password --> Authentication.
3. The remote registry denies my push artifact request since I'm only authorized to pull artifacts by looking up the access control list of the identity identified by my username --> Authorization.

Thank you yes I’m aware of the the difference :)

The credential files are often the first step in a registry interaction and thus could be determined to be in scope, as determined by the working group. It cannot be ruled out until they decide it is or is not in scope.

Will this SDK be compatible with credential helpers as already are used by Docker compatible registries?

Yes! That's one of the goals.