New Features

• oras is compliant with OCI image-spec v1.1.0-rc4 and distribution-spec v1.1.0-rc3
  • Support copying or pulling image index with a subject field
  • Output OCI distribution warning headers
• Improve oras push
  • Formalize the default config to empty descriptor (previously application/vnd.unknown.config.v1+json)
  • Default to artifact type application/vnd.unknown.artifact.v1 if not specified
  • Allow artifact type and config to be specified at the same time

Experimental Features

• BREAKING CHANGE: Redesign the flag --image-spec
  • Add options v1.0 and v1.1
  • Remove options v1.1-image and v1.1-artifact
  • No longer produce manifests of type application/vnd.oci.artifact.manifest.v1+json
• BREAKING CHANGE: Remove the flag --image-spec from oras attach

Bug Fixes

• Fix #995: oras push and oras attach generates unwanted manifest file
• Fix #983, #980, #973: Flag --disable-path-validation not working for oras attach and oras push
• Fix #897: Wrong error log when --distribution-spec is provided with invalid value
• Fix #1003: Tree view output of oras discover prints unexpected nodes

Other Changes

• Improve UX, documentation, performance, tests and code coverage
• Update dependencies
• Update to Golang 1.21.0

What's Changed Since RC.2

Other Changes

• Improve performance
  • Reduced number of auth requests for push and attach (#1084)
• Improve documentation
  • Update security guide (#1017)
  • Update compatibility mode doc (#1065)
• Update dependencies
  • Bump oras-go to 2.3.0
• Improve tests

Detailed Commits

• bump: tag and release ORAS CLI v1.1.0-rc.2 by @qweeah in #1078
• test(e2e): add zot as a testing backend by @qweeah in #1072
• Add SECURITY.md file by @TerryHowe in #1082
• test(e2e): update e2e specs for oras attach by @qweeah in #1081
• test(e2e): use ZOT as testing backend for oras blob specs by @qweeah in #1083
• test(e2e): fix logging when e2e test fails by @qweeah in #1090
• test(e2e): migrate oras push specs to ZOT by @qweeah in #1085
• test(e2e): migrate oras pull specs to ZOT by @qweeah in #1086
• test(e2e): migrate oras tag specs to ZOT by @qweeah in #1087
• test(e2e): migrate oras repo specs to ZOT by @qweeah in #1088
• test(e2e): migrate oras manifest specs to ZOT by @qweeah in #1089
• perf: save auth requests for push and attach by @Wwwsylvia in #1097
• test(e2e): re-bake test data by @qweeah in #1094
• test(e2e): migrate oras cp and oras discover specs to ZOT by @qweeah in #1093
• test(e2e): cover pulling test for image spec 1.1.0-rc.2 artifact by @qweeah in #1098
• test(e2e): add tests to cover OCI spec v1.1.0-rc.4 and OCI distribution spec 1.1.0-rc3 by @qweeah in #1099
• test(e2e): add doc for ZOT test data by @qweeah in #1100
• build(deps): bump oras-go to v2.3.0 by @qweeah in #1101
• doc: update example for oras push by @qweeah in #1102
• doc: update compatibility mode doc to align with ORAS v1.1.0 by @FeynmanZhou in #1068

Full Changelog: v1.1.0-rc.2...v1.1.0

Notes

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.