github oras-project/oras v1.3.4

3 hours ago

ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom --header values, and --debug trace output — strictly to the configured registry origin, and adds an opt-in --force copy mode for registries that report incomplete content as present.

Highlights

  • 🔒 Security: three credential-scoping advisories are fixed — mTLS client certificates (GHSA-h3wm-jjqf-8jm2), custom request headers (GHSA-whvf-jp7m-59f3), and --debug HTTP traces (GHSA-5jhf-2qmf-m8c5). All three were reported by Hardik Mehta (@hardw00t).
  • oras cp and oras push gain --force, which walks every referenced manifest instead of trusting the destination's Exists() response — this fixes manifest blob unknown failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories).
  • Shared authentication cache: repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call.
  • 🛡️ Supply-chain hardening: release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key.

✨ Features

  • Add --force to oras cp/oras push to handle partially-populated destinations by @renshao in #2061
  • Save authentication context between calls so in-process usage authenticates once by @TerryHowe in #1923
  • Sign release checksums in the release workflow by @TerryHowe in #2112

🐛 Bug Fixes

🔒 Security

  • Registry mTLS client certificates are disclosed to cross-origin TLS peers (CWE-201, GHSA-h3wm-jjqf-8jm2): a certificate supplied via --cert-file/--key-file was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin.
  • Registry custom credentials are forwarded across HTTP origins (GHSA-whvf-jp7m-59f3): values passed with --header/--from-header/--to-header were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry.
  • Debug HTTP traces expose replayable bearer credentials (CWE-532, GHSA-5jhf-2qmf-m8c5): --debug trace output persisted URL userinfo and query parameters (e.g. pre-signed X-Amz-Signature), Location/Content-Location/Referer headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted.

All three were reported by Hardik Mehta (@hardw00t).

🧹 Maintenance

New Contributors

Full Changelog: v1.3.3...v1.3.4

Don't miss a new oras release

NewReleases is sending notifications on new releases.