oras-project/oras v1.3.6

on GitHub

Changes since v1.3.5

Dependencies

• Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#2284, fixes #2275)
  • Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
  • Authentication now works after a same-host HTTP-to-HTTPS redirect.
  • Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

• oras tag now checks that it gets a source reference and at least one tag (#2265, fixes #2264)
• --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#2282, fixes #2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#2283, fixes #2278)

Release and packaging

• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#2271, fixes #2269)
• Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#2274)

Other

• More unit tests for display JSON metadata handlers and contentutil (#2266, #2267)
• Bump GitHub Actions dependencies (#2263)

Full changelog: v1.3.5...v1.3.6

Changelog

• 9b1fc81 bump: tag and release ORAS CLI v1.3.6 (#2285)
• 5f03555 docs: make oras-www release updates explicit (#2286)
• 81f1656 fix: serialize progress console frames (#2292)
• 27c1796 fix: share auth caches only between clients with the same credentials (#2288)
• ecc3e87 fix: take the write lock in status.Render (#2290)
• 3d087a2 fix: make the TTY progress manager safe against concurrent and repeated Close (#2287)
• 9218890 fix: expose mount only for capable tracked targets (#2283)
• fdf2ba3 fix: keep --from-resolve and --to-resolve rules separate (#2282)
• cb601f5 chore: update oras-go to v2.7.0 (#2284)
• a325603 build: keep snap candidate channel current (#2274)
• 5236ba2 ci: publish build provenance attestations for release artifacts (#2271)
• ed26899 test(display): cover the remaining JSON metadata handlers (#2266)
• bd0668e test(contentutil): cover MultiReadOnlyTarget and IsDigest (#2267)
• 38812fe fix: validate minimum arguments for tag command (#2265)
• 17d5269 build(deps): bump the github-actions group with 3 updates (#2263)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.