Merge branch 'oras-project:main' into main

.github/workflows/build.yml

@@ -43,11 +43,13 @@ jobs:
         run: make test
       - name: Run E2E Tests
         run: |
-          bash $GITHUB_WORKSPACE/test/e2e/scripts/e2e.sh $GITHUB_WORKSPACE --clean
-          make e2e-covdata
+          if [[ $GITHUB_REF_NAME == v* && $GITHUB_REF_TYPE == tag ]]; then
+            make teste2e
+          else
+            make teste2e-covdata
+          fi
         env:
           ORAS_PATH: bin/linux/amd64/oras
-          COVERAGE_DUMP_ROOT: .cover
       - name: Check Version
         run: bin/linux/amd64/oras version
       - name: Upload coverage to codecov.io

.github/workflows/golangci-lint.yml

@@ -0,0 +1,41 @@
+# Copyright The ORAS Authors.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: golangci-lint
+
+on:
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go-version: ['1.20']
+      fail-fast: true
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+    - name: Setup Go ${{ matrix.go-version }}
+      uses: actions/setup-go@v4
+      with:
+        go-version: ${{ matrix.go-version }}
+        check-latest: true
+    - name: golangci-lint
+      uses: golangci/golangci-lint-action@v3

.github/workflows/release-ghcr.yml

@@ -35,8 +35,7 @@ jobs:
           if [[ "${VERSION}" == "${BRANCH_NAME}" ]]; then
             VERSION=$(git rev-parse --short HEAD)
           fi
-          echo ::set-output name=version::${VERSION}
-          echo ::set-output name=ref::ghcr.io/${{ github.repository }}:${VERSION}
+          echo "ref=ghcr.io/${{ github.repository }}:${VERSION}" >> $GITHUB_OUTPUT
       - name: docker login
         uses: docker/login-action@v2
         with:

.github/workflows/release-github.yml

@@ -29,7 +29,7 @@ jobs:
       - name: setup go environment
         uses: actions/setup-go@v3
         with:
-          go-version: '1.20.2'
+          go-version: '1.20.5'
       - name: run goreleaser
         uses: goreleaser/goreleaser-action@v2
         with:

.github/workflows/stale.yml

@@ -0,0 +1,33 @@
+# Copyright The ORAS Authors.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "Close stale issues and PRs"
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v8
+        with:
+          stale-issue-message: "This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days."
+          stale-pr-message: "This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 30 days."
+          close-issue-message: "This issue was closed because it has been stalled for 30 days with no activity."
+          close-pr-message: "This PR was closed because it has been stalled for 30 days with no activity."
+          days-before-issue-stale: 60
+          days-before-pr-stale: 45
+          days-before-issue-close: 30
+          days-before-pr-close: 30
+          exempt-all-milestones: true

CONTRIBUTING.md

@@ -1,3 +1,3 @@
 # Contributing
 
-Please refer to the [ORAS Contributing guide](https://oras.land/docs/contributing).
+Please refer to the [ORAS Contributing guide](https://oras.land/docs/community/contributing_guide).

Dockerfile

@@ -11,7 +11,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.20.2-alpine as builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.20.5-alpine as builder
 ARG TARGETPLATFORM
 RUN apk add git make
 ENV ORASPKG /oras

Makefile

@@ -32,103 +32,110 @@ LDFLAGS += -X $(PROJECT_PKG)/internal/version.GitCommit=${GIT_COMMIT}
 LDFLAGS += -X $(PROJECT_PKG)/internal/version.GitTreeState=${GIT_DIRTY}
 
 .PHONY: test
-test: tidy vendor check-encoding
+test: tidy vendor check-encoding  ## tidy and run tests
 	$(GO_EXE) test -race -v -coverprofile=coverage.txt -covermode=atomic ./...
 
 .PHONY: teste2e
-teste2e:
+teste2e:  ## run end to end tests
 	./test/e2e/scripts/e2e.sh $(shell git rev-parse --show-toplevel) --clean 
 
 .PHONY: covhtml
-covhtml:
+covhtml:  ## look at code coverage
 	open .cover/coverage.html
 
 .PHONY: clean
-clean:
+clean:  ## clean up build
 	git status --ignored --short | grep '^!! ' | sed 's/!! //' | xargs rm -rf
 
 .PHONY: build
-build: build-linux build-mac build-windows
+build: build-linux build-mac build-windows  ## build for all targets
 
 .PHONY: build-linux
-build-linux: build-linux-amd64 build-linux-arm64 build-linux-arm-v7 build-linux-s390x
+build-linux: build-linux-amd64 build-linux-arm64 build-linux-arm-v7 build-linux-s390x  ## build all linux architectures
 
 .PHONY: build-linux-amd64
-build-linux-amd64:
+build-linux-amd64:  ## build for linux amd64
 	GOARCH=amd64 CGO_ENABLED=0 GOOS=linux $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/linux/amd64/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-linux-arm64
-build-linux-arm64:
+build-linux-arm64:  ## build for linux arm64
 	GOARCH=arm64 CGO_ENABLED=0 GOOS=linux $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/linux/arm64/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-linux-arm-v7
-build-linux-arm-v7:
+build-linux-arm-v7:  ## build for linux arm v7
 	GOARCH=arm CGO_ENABLED=0 GOOS=linux $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/linux/arm/v7/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-linux-s390x
-build-linux-s390x:
+build-linux-s390x:  ## build for linux s390x
 	GOARCH=s390x CGO_ENABLED=0 GOOS=linux $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/linux/s390x/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-mac
-build-mac: build-mac-arm64 build-mac-amd64
+build-mac: build-mac-arm64 build-mac-amd64  ## build all mac architectures
 
 .PHONY: build-mac-amd64
-build-mac-amd64:
+build-mac-amd64:  ## build for mac amd64
 	GOARCH=amd64 CGO_ENABLED=0 GOOS=darwin $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/darwin/amd64/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-mac-arm64
-build-mac-arm64:
+build-mac-arm64:  ## build for mac arm64
 	GOARCH=arm64 CGO_ENABLED=0 GOOS=darwin $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/darwin/arm64/$(CLI_EXE) $(CLI_PKG)
 
 .PHONY: build-windows
-build-windows: build-windows-amd64 build-windows-arm64
+build-windows: build-windows-amd64 build-windows-arm64  ## build all windows architectures
 
 .PHONY: build-windows-amd64
-build-windows-amd64:
+build-windows-amd64:  ## build for windows amd64
 	GOARCH=amd64 CGO_ENABLED=0 GOOS=windows $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/windows/amd64/$(CLI_EXE).exe $(CLI_PKG)
 
 .PHONY: build-windows-arm64
-build-windows-arm64:
+build-windows-arm64:  ## build for windows arm64
 	GOARCH=arm64 CGO_ENABLED=0 GOOS=windows $(GO_EXE) build -v --ldflags="$(LDFLAGS)" \
 		-o bin/windows/arm64/$(CLI_EXE).exe $(CLI_PKG)
 
 .PHONY: check-encoding
-check-encoding:
+check-encoding:  ## check file CR/LF encoding
 	! find cmd internal -name "*.go" -type f -exec file "{}" ";" | grep CRLF
 
 .PHONY: fix-encoding
-fix-encoding:
+fix-encoding:  ## fix file CR/LF encoding
 	find cmd internal -type f -name "*.go" -exec sed -i -e "s/\r//g" {} +
 
 .PHONY: tidy
-tidy:
+tidy:  ## go mod tidy
 	GO111MODULE=on $(GO_EXE) mod tidy
 
 .PHONY: vendor
-vendor:
+vendor:  ## go mod vendor
 	GO111MODULE=on $(GO_EXE) mod vendor
 
 .PHONY: fetch-dist
-fetch-dist:
+fetch-dist:  ## fetch distribution
 	mkdir -p _dist
 	cd _dist && \
 	for obj in ${TARGET_OBJS} ; do \
 		curl -sSL -o oras_${VERSION}_$${obj} https://github.com/oras-project/oras/releases/download/v${VERSION}/oras_${VERSION}_$${obj} ; \
 	done
 
 .PHONY: sign
-sign:
+sign:  ## sign
 	for f in $$(ls _dist/*.{gz,txt} 2>/dev/null) ; do \
 		gpg --armor --detach-sign $${f} ; \
 	done
 
-.PHONY: e2e-covdata
-e2e-covdata:
-	$(GO_EXE) tool covdata textfmt -i="test/e2e/${COVERAGE_DUMP_ROOT}" -o test/e2e/coverage.txt
+.PHONY: teste2e-covdata
+teste2e-covdata:  ## test e2e coverage
+	export GOCOVERDIR=$(CURDIR)/test/e2e/.cover; \
+	rm -rf $$GOCOVERDIR; \
+	mkdir -p $$GOCOVERDIR; \
+	$(MAKE) teste2e && $(GO_EXE) tool covdata textfmt -i=$$GOCOVERDIR -o "$(CURDIR)/test/e2e/coverage.txt"
+
+.PHONY: help
+help:  ## Display this help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[%\/0-9A-Za-z_-]+:.*?##/ { printf "  \033[36m%-45s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

README.md

@@ -11,11 +11,11 @@
 ## Docs
 
 Documentation for the ORAS CLI is located on
-the project website: [oras.land/cli](https://oras.land/docs/category/cli)
+the project website: [oras.land/cli](https://oras.land/docs/category/oras-commands)
 
 ## Development Environment Setup
 
-Refer to the [development guide](https://oras.land/docs/CLI/developer_guide) to get started [contributing to ORAS](https://oras.land/docs/contributing).
+Refer to the [development guide](https://oras.land/docs/community/developer_guide) to get started [contributing to ORAS](https://oras.land/docs/community/contributing_guide).
 
 ## Code of Conduct
 

cmd/oras/internal/display/print.go

@@ -116,7 +116,7 @@ func (p *tagManifestStatusForRepo) PushReference(ctx context.Context, expected o
 	if p.printHint != nil {
 		p.printHint.Do(func() {
 			ref := p.refPrefix + "@" + expected.Digest.String()
-			Print("Tagging", ref)
+			_ = Print("Tagging", ref)
 		})
 	}
 	if err := p.Repository.PushReference(ctx, expected, content, reference); err != nil {
@@ -136,9 +136,10 @@ func (p *tagManifestStatusForTarget) Tag(ctx context.Context, desc ocispec.Descr
 	if p.printHint != nil {
 		p.printHint.Do(func() {
 			ref := p.refPrefix + "@" + desc.Digest.String()
-			Print("Tagging", ref)
+			_ = Print("Tagging", ref)
 		})
 	}
+
 	if err := p.Target.Tag(ctx, desc, reference); err != nil {
 		return err
 	}

cmd/oras/internal/errors/errors.go

@@ -16,9 +16,11 @@ limitations under the License.
 package errors
 
 import (
+	"errors"
 	"fmt"
 
 	"oras.land/oras-go/v2/registry"
+	"oras.land/oras-go/v2/registry/remote"
 )
 
 // NewErrInvalidReference creates a new error based on the reference string.
@@ -30,3 +32,9 @@ func NewErrInvalidReference(ref registry.Reference) error {
 func NewErrInvalidReferenceStr(ref string) error {
 	return fmt.Errorf("%s: invalid image reference, expecting <name:tag|name@digest>", ref)
 }
+
+// IsReferrersIndexDelete checks if err is a referrers index delete error.
+func IsReferrersIndexDelete(err error) bool {
+	var re *remote.ReferrersError
+	return errors.As(err, &re) && re.IsReferrersIndexDelete()
+}

cmd/oras/internal/option/applier.go

@@ -29,7 +29,7 @@ type FlagApplier interface {
 // NOTE: The option argument need to be a pointer to the options, so its value
 // becomes addressable.
 func ApplyFlags(optsPtr interface{}, target *pflag.FlagSet) {
-	rangeFields(optsPtr, func(fa FlagApplier) error {
+	_ = rangeFields(optsPtr, func(fa FlagApplier) error {
 		fa.ApplyFlags(target)
 		return nil
 	})

cmd/oras/internal/option/packer.go

@@ -21,11 +21,13 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/spf13/pflag"
 	"oras.land/oras-go/v2/content"
+	"oras.land/oras/cmd/oras/internal/fileref"
 )
 
 // Pre-defined annotation keys for annotation file
@@ -38,6 +40,7 @@ var (
 	errAnnotationConflict    = errors.New("`--annotation` and `--annotation-file` cannot be both specified")
 	errAnnotationFormat      = errors.New("missing key in `--annotation` flag")
 	errAnnotationDuplication = errors.New("duplicate annotation key")
+	errPathValidation        = errors.New("absolute file path detected. If it's intentional, use --disable-path-validation flag to skip this check")
 )
 
 // Packer option struct.
@@ -69,6 +72,25 @@ func (opts *Packer) ExportManifest(ctx context.Context, fetcher content.Fetcher,
 	}
 	return os.WriteFile(opts.ManifestExportPath, manifestBytes, 0666)
 }
+func (opts *Packer) Parse() error {
+	if !opts.PathValidationDisabled {
+		var failedPaths []string
+		for _, path := range opts.FileRefs {
+			// Remove the type if specified in the path <file>[:<type>] format
+			path, _, err := fileref.Parse(path, "")
+			if err != nil {
+				return err
+			}
+			if filepath.IsAbs(path) {
+				failedPaths = append(failedPaths, path)
+			}
+		}
+		if len(failedPaths) > 0 {
+			return fmt.Errorf("%w: %v", errPathValidation, strings.Join(failedPaths, ", "))
+		}
+	}
+	return nil
+}
 
 // LoadManifestAnnotations loads the manifest annotation map.
 func (opts *Packer) LoadManifestAnnotations() (annotations map[string]map[string]string, err error) {
@@ -77,7 +99,13 @@ func (opts *Packer) LoadManifestAnnotations() (annotations map[string]map[string
 	}
 	if opts.AnnotationFilePath != "" {
 		if err = decodeJSON(opts.AnnotationFilePath, &annotations); err != nil {
-			return nil, err
+			errStr :=  err.Error()
+			docLink := " Please refer to the document at https://oras.land/docs/how_to_guides/manifest_annotations."
+			if !strings.HasSuffix(errStr, ".") {
+				docLink = "."+docLink
+			}
+			return nil, fmt.Errorf("failed to load annotations from %s: %w" +
+				docLink, opts.AnnotationFilePath, err)
 		}
 	}
 	if len(opts.ManifestAnnotations) != 0 {