v1.3.0

New Features

Stable

• oras is compliant with OCI distribution-spec v1.1.1
• Show OS and architecture in oras version
• Add alias oras manifest get for oras manifest fetch

Preview

• Improve tree view in oras discover
  • Display annotations by default
  • Colorize tree view 🌈

Experimental

• Introduce portable backup and restore of OCI artifacts, images, and repositories
  • oras backup: New command to back up artifacts from remote registries into local OCI image layouts, either as directories or tar archives.
  • oras restore: New command to restore artifacts from local OCI image layouts (directories or tar archives) back to remote registries.
• Introduce multi-arch image/artifact management
  • Add the oras manifest index command set to manage OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • Add --artifact-platform to oras push to push artifacts with platform information
  • Add --format to oras repo ls and oras repo tags with text, json, and go-template options
  • Support fully qualified references for OCI image layout via --oci-layout-path
• Refine the oras discover output for the json and go-template formats
  • BREAKING CHANGE: Rename the manifests field to referrers
  • Add subject manifest details to the json output
• oras discover now displays referrers recursively by default; the maximum recursion depth can be controlled via the --depth flag

Feature Promotions

• Promote the following commands and flags from Preview to Stable:
  • oras attach
  • oras attach --platform
  • oras pull --include-subject
• Promote oras resolve from Experimental to Preview

Deprecations

Stable

• Deprecate the -v, --verbose flag (verbose output is now enabled by default)

Preview

• BREAKING CHANGE Remove the global --no-tty flag
  • --no-tty remains available on individual TTY-capable commands

Experimental

• Deprecate the table option of the --format flag in oras discover

Bug Fixes

• Fix #1436: oras tag creates referrers tags unexpectedly
• Fix #1442: invalid progress bar shown for empty layers
• Fix #1494: invalid reference in the formatted output of oras pull
• Fix #1593: unable to download an artifact twice if it contains symbolic links
• Fix #1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #1623: Should show KB instead of kB in the progress bar
• Fix #1728: oras cp now correctly copies the root index when the index has no referrers
• Fix #1795, #1825: redundant blank lines in terminal output

Other Changes

• Add support for the loong64 architecture
• Upgrade to Go 1.25.0
• Enhance UX:
  • Improve diagnostic experience through --debug logs
  • Improve error messages
• Improve documentation
• Optimize code structure
• Update dependencies
• Minor security enhancements

New Contributors

• @bcho made their first contribution in #1408
• @njucjc made their first contribution in #1435
• @nmiyake made their first contribution in #1477
• @mauriciovasquezbernal made their first contribution in #1507
• @Horiodino made their first contribution in #1607
• @chrisguitarguy made their first contribution in #1658
• @kysucix made their first contribution in #1671
• @RohanMishra315 made their first contribution in #1650
• @apparentlymart made their first contribution in #1696
• @Copilot made their first contribution in #1755
• @tanyabhatnagar made their first contribution in #1761
• @amazingfate made their first contribution in #1787

Full Changelog: v1.2.0...v1.3.0

What's Changed Since RC.2

• bump: tag and release ORAS CLI v1.3.0-rc.2 by @Wwwsylvia in #1834
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.2 in /test/e2e by @dependabot[bot] in #1836
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #1837

Full Changelog: v1.3.0-rc.2...v1.3.0

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@Wwwsylvia's GPG key) which can be found here.

v1.3.0-rc.2

UX Enhancements

• Refine the color scheme for the tree view in oras discover for better visual clarity
• Improve the error message for oras backup when the output file exists as a directory

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-rc.1 by @Wwwsylvia in #1830
• chore(ux): update colors for oras discover tree view by @Wwwsylvia in #1832
• chore(ux): improve oras backup error message by @Wwwsylvia in #1833

Full Changelog: v1.3.0-rc.1...v1.3.0-rc.2

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@Wwwsylvia's GPG key) which can be found here.

v1.3.0-rc.1

Feature Stability Updates

• Promote the following commands and flags from Preview to Stable:
  • oras attach
  • oras attach --platform
  • oras pull --include-subject
• Promote oras resolve from Experimental to Preview

Bug Fixes

• Fix #1795, #1825: redundant blank lines in terminal output

Other Changes

• Upgrade to Go 1.25.0
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.4 by @Wwwsylvia in #1799
• build(deps): bump library/golang from 1.24.5-alpine to 1.24.6-alpine by @dependabot[bot] in #1804
• build(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 by @dependabot[bot] in #1800
• chore: add Sylvia's GPG key by @Wwwsylvia in #1806
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #1814
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 in /test/e2e by @dependabot[bot] in #1816
• build(go): upgrade to Go 1.25.0 by @Wwwsylvia in #1817
• chore: mark --platform flag of oras attach from preview to stable by @wangxiaoxuan273 in #1822
• chore: mark oras resolve from experimental to preview by @wangxiaoxuan273 in #1823
• chore: remove [Preview] label on --include-subject for oras pull by @Wwwsylvia in #1821
• chore(ux): remove [Preview] label for oras attach by @Wwwsylvia in #1824
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.24.0 to 2.25.0 in /test/e2e by @dependabot[bot] in #1826
• fix: improve tty UX to avoid redundant blank by @wangxiaoxuan273 in #1827
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.0 to 2.25.1 in /test/e2e by @dependabot[bot] in #1828
• build(deps): bump github.com/onsi/gomega from 1.38.0 to 1.38.1 in /test/e2e by @dependabot[bot] in #1829

Full Changelog: v1.3.0-beta.4...v1.3.0-rc.1

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@Wwwsylvia's GPG key) which can be found here.

v1.3.0-beta.4

Experimental Features

• Introduce portable backup and restore of OCI artifacts, images, and repositories
  • oras backup: New command to back up artifacts from remote registries into local OCI image layouts, either as directories or tar archives.
  • oras restore: New command to restore artifacts from local OCI image layouts (directories or tar archives) back to remote registries.
• Add --format flag support for the oras repo ls and oras repo tags commands with text, json, and go-template output options
• Add --artifact-type flag support for oras manifest index create and oras manifest index update commands to set the artifact type of an OCI image index
• Enhance multi-repository OCI image layout support for oras repo tags to list tags under a specified repository

Bug Fixes

• Fix #1728: oras cp now correctly copies root index when the index has no referrers
• Fix #1715: oras discover --format json now properly shows referrers field when no referrer is found

Other Changes

• Add support for the loong64 architecture
• Improve UX with clearer error messages
• Improve code quality and performance
• Upgrade to Go 1.24.5
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.3 by @Wwwsylvia in #1705
• build: use alpine 3.21.3 by @Wwwsylvia in #1709
• Add test coverage for discover handler by @TerryHowe in #1712
• build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 by @dependabot[bot] in #1720
• build(deps): bump golang.org/x/term from 0.31.0 to 0.32.0 by @dependabot[bot] in #1721
• fix: packer decode json lint failure by @TerryHowe in #1688
• build(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0 in /test/e2e by @dependabot[bot] in #1724
• build(deps): bump oras.land/oras-go/v2 from 2.5.1-0.20250417082913-f7a6126986d9 to 2.6.0 by @dependabot[bot] in #1725
• fix: discover handler errors for lint by @TerryHowe in #1677
• fix: calls to close in tests unchecked for lint by @TerryHowe in #1678
• refactor: move different targets to different files by @TerryHowe in #1722
• fix: Change receiver name for Remote by @TerryHowe in #1727
• refactor(perf): optimize cases with no child referrers in recursiveCopy by @qweeah in #1729
• fix: lint explicitly ignore various close errors by @TerryHowe in #1684
• fix: rename interfaces file by @TerryHowe in #1730
• refactor: rename Target AnnotatedReference method by @TerryHowe in #1726
• fix(docs): remove a discover example with -v by @Wwwsylvia in #1742
• fix(lint): ignore returns from test defer calls by @TerryHowe in #1734
• fix: discover json format should show referrers field when no referrer is found by @wangxiaoxuan273 in #1731
• build(deps): bump github.com/containerd/console from 1.0.4 to 1.0.5 by @dependabot[bot] in #1743
• fix: replace slave var for child by @TerryHowe in #1736
• fix: rename slave to child for cp test by @TerryHowe in #1738
• docs(spec): artifactType in multi-platform index manifests by @apparentlymart in #1696
• docs: add examples for oci-layout-path by @wangxiaoxuan273 in #1746
• build(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 by @dependabot[bot] in #1750
• feat: oras manifest index: artifactType for index and child manifest descriptors by @apparentlymart in #1700
• feat: support --format for oras repo tags by @Wwwsylvia in #1756
• fix: resolve golangci-lint issues with unchecked error returns and embedded field access by @Copilot in #1755
• build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot[bot] in #1717
• ci: add dependabot support for Dockerfile by @tanyabhatnagar in #1761
• build(deps): bump library/golang from 1.24.2-alpine to 1.24.4-alpine by @dependabot[bot] in #1764
• build(deps): bump library/alpine from 3.21.3 to 3.22.0 by @dependabot[bot] in #1765
• docs: backup and restore specification by @TerryHowe in #1610
• docs(spec): define output formats for oras repo commands by @Wwwsylvia in #1763
• feat: support --format for oras repo ls by @Wwwsylvia in #1758
• fix(tests): fix packer test that failed on Windows by @Wwwsylvia in #1774
• docs: backup and restore to single OCI layout by @TerryHowe in #1775
• test: exclude incompatible test Go OSes by @TerryHowe in #1779
• refactor: ApplyFlags with prefix for Remote and Target by @TerryHowe in #1733
• build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by @dependabot[bot] in #1781
• build(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 by @dependabot[bot] in #1780
• feat: show repo tags with --oci-layout-path in repo tags command by @wangxiaoxuan273 in #1759
• chore(ux): improve copy error message by @Wwwsylvia in #1773
• build(deps): bump library/golang from 1.24.4-alpine to 1.24.5-alpine by @dependabot[bot] in #1782
• fix: oras cp should copy root index when the index has no referrers by @wangxiaoxuan273 in #1749
• build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #1785
• build(deps): bump library/alpine from 3.22.0 to 3.22.1 by @dependabot[bot] in #1786
• build: release loong64 by @amazingfate in #1787
• docs: add scenario doc for Backup and Restore of OCI Artifacts and Images by @FeynmanZhou in #1778
• docs: enrich the CLI design of oras backup and oras restore by @FeynmanZhou in #1767
• feat: oras backup to backup artifacts to a directory or a tar by @Wwwsylvia in #1790
• build(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 in /test/e2e by @dependabot[bot] in #1789
• feat: add oras restore command by @Wwwsylvia in #1792
• build(go): upgrade go version and dependencies by @Wwwsylvia in #1796

New Contributors

• @apparentlymart made their first contribution in #1696
• @Copilot made their first contribution in #1755
• @tanyabhatnagar made their first contribution in #1761
• @amazingfate made their first contribution in #1787

Full Changelog: v1.3.0-beta.3...v1.3.0-beta.4

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.2.3

Bug Fixes

• Fix #1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #1623: Should show KB instead of kB in the progress bar

Other Changes

• Minor security enhancements
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.2 by @shizhMSFT in #1592
• fix: scope action only has pull when get service token in executing cmd org push by @hopegi in #1600
• build: upgrade Go version and dependencies to the latest by @Wwwsylvia in #1706
• backport(fix): show KB in progress bar instead of kB (#1623) by @Wwwsylvia in #1707
• build: use alpine 3.21.3 by @Wwwsylvia in #1708

New Contributors

• @hopegi made their first contribution in #1600

Full Changelog: v1.2.2...v1.2.3

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.3.0-beta.3

New Features

• Add oras manifest get as an alias for oras manifest fetch

Preview Features

• Improve tree view in oras discover
  • Annotations are displayed by default
  • Trees are colorized 🌈
• BREAKING CHANGE Remove the global --no-tty flag
  • The --no-tty flag is kept for TTY-capable commands

Experimental Features

• Refine the output of oras discover
  • BREAKING CHANGE Rename the manifests field to referrers
  • Add subject manifest details for the json format
• oras discover displays referrers recursively by default
  • Add a --depth flag to control the maximum depth of referrers discovered

Deprecation

• Mark the table option for the --format flag in oras discover as deprecated

Bug Fixes

• Fix #1659, #1694, #1695: Unexpected error "compare and swap of inconsistently typed value into Value" was returned
• Fix #1640: The --verbose flag was removed in v1.3.0-beta.1
• Minor fixes

Other Changes

• Upgrade to Go 1.24.2
• Update dependencies
• Improve documentation
• Optimize code structure

Detailed Commits

• refactor: add manifest delete metadata handler by @wangxiaoxuan273 in #1633
• bump: tag and release ORAS CLI v1.3.0-beta.2 by @Wwwsylvia in #1635
• refactor: use iter for cleaner code by @shizhMSFT in #1637
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 in /test/e2e by @dependabot in #1643
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 by @dependabot in #1642
• docs: add goreportcard to README by @TerryHowe in #1641
• build(deps): bump golang.org/x/sync from 0.11.0 to 0.12.0 by @dependabot in #1645
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0 in /test/e2e by @dependabot in #1647
• build(deps): bump golang.org/x/term from 0.29.0 to 0.30.0 by @dependabot in #1646
• feat: add alias for manifest fetch by @wangxiaoxuan273 in #1644
• refactor: split a run and main function so defers Execute by @chrisguitarguy in #1658
• build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 in /test/e2e by @dependabot in #1655
• docs(spec): multi-arch image management by @FeynmanZhou in #1514
• refactor: deprecate table format by @wangxiaoxuan273 in #1656
• fix: bring back --verbose flag by @wangxiaoxuan273 in #1660
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.0 to 2.23.1 in /test/e2e by @dependabot in #1662
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.1 to 2.23.2 in /test/e2e by @dependabot in #1663
• fix: target NewReadonlyTarget comment by @TerryHowe in #1665
• build(deps): bump github.com/onsi/gomega from 1.36.2 to 1.36.3 in /test/e2e by @dependabot in #1667
• docs: improve formatted output for oras discover by @FeynmanZhou in #1625
• feat!: refine oras discover JSON format by @wangxiaoxuan273 in #1649
• build(deps): upgrade go crypto module to v0.36.0 by @kysucix in #1671
• feat!: support showing indirect referrers for all formats of oras discover by @wangxiaoxuan273 in #1653
• fix: Change receiver name for target by @TerryHowe in #1666
• fix: use test Setenv during tests by @TerryHowe in #1675
• fix: staticcheck fails for embedded member by @TerryHowe in #1676
• fix: unneeded error check by @TerryHowe in #1680
• fix: staticcheck lint failures of embedded member by @TerryHowe in #1679
• build(deps): bump github.com/onsi/gomega from 1.36.3 to 1.37.0 in /test/e2e by @dependabot in #1685
• fix: blob file close handling for lint by @TerryHowe in #1687
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 in /test/e2e by @dependabot in #1690
• build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0 by @dependabot in #1692
• build(deps): bump golang.org/x/sync from 0.12.0 to 0.13.0 by @dependabot in #1691
• fix: explicitly ignore return for newest lint by @TerryHowe in #1683
• docs: update the help doc for oras manifest index create by @RohanMishra315 in #1650
• feat: show annotations in default discovery output by @Horiodino in #1602
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in /test/e2e by @dependabot in #1697
• docs: update help doc for oras manifest index update by @wangxiaoxuan273 in #1698
• build(deps): bump oras-go to the latest commit which fixes the "compare and swap" error by @Wwwsylvia in #1702
• build(go): upgrade go version to 1.24.2 by @Wwwsylvia in #1703
• refactor: move --no-tty out of option.Common by @wangxiaoxuan273 in #1699

New Contributors

• @chrisguitarguy made their first contribution in #1658
• @kysucix made their first contribution in #1671
• @RohanMishra315 made their first contribution in #1650

Full Changelog: v1.3.0-beta.2...v1.3.0-beta.3

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.3.0-beta.2

New Features

• oras is compliant with OCI distribution-spec v1.1.1

Bug Fixes

• Fix #1576: Missing digests of fetched manifests in the output of oras manifest index create
• Fix #1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #1582: The --oci-layout-path flag was not marked as experimental
• Fix #1623: Should show KB instead of kB in the progress bar
• Fix #1593: Unable to download an artifact twice if it contains symbolic links
• Minor fixes

Other Changes

• Upgraded to Go 1.24.0
• Updated dependencies
• Improved documentation
• Optimized code structure

Detailed Commits

• bump: tag and release ORAS CLI v1.3.0-beta.1 by @qweeah in #1577
• build(deps): bump github.com/onsi/gomega from 1.36.0 to 1.36.1 in /test/e2e by @dependabot in #1580
• fix: handle errors returned by Close() in write paths by @wangxiaoxuan273 in #1581
• refactor: add metadata render interface and apply it to oras attach command by @wangxiaoxuan273 in #1578
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @dependabot in #1585
• chore: clean metadata handler for attach command by @qweeah in #1584
• refactor: apply metadata render interface to oras push command by @wangxiaoxuan273 in #1583
• refactor: add handlers to manifest push commmand by @wangxiaoxuan273 in #1555
• chore: add lint make file target by @TerryHowe in #1586
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 in /test/e2e by @dependabot in #1596
• build(deps): bump github.com/onsi/gomega from 1.36.1 to 1.36.2 in /test/e2e by @dependabot in #1598
• fix: add digest to fetched status output of manifest index create by @wangxiaoxuan273 in #1579
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 in /test/e2e by @dependabot in #1601
• build(deps): bump golang.org/x/term from 0.27.0 to 0.28.0 by @dependabot in #1603
• docs: add Sylvia Lei as a maintainer by @shizhMSFT in #1604
• fix: scope action only has pull when get service token in executing cmd org push by @Wwwsylvia in #1608
• fix: mark --oci-layout-path as experimental by @Horiodino in #1607
• docs: update the help doc for --oci-layout-path by @Wwwsylvia in #1609
• refactor: apply metadata render interface to oras discover command by @wangxiaoxuan273 in #1605
• refactor: apply metadata render interface to oras pull command by @wangxiaoxuan273 in #1587
• build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0 by @dependabot in #1615
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot in #1614
• refactor: apply metadata render interface to index commands by @wangxiaoxuan273 in #1606
• build(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot in #1617
• chore: add SVG file to license checker ignoring list by @FeynmanZhou in #1620
• fix(ux): show KB in progress bar instead of kB by @qweeah in #1623
• build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot in #1622
• refactor: improve metadata handler of oras cp by @wangxiaoxuan273 in #1624
• refactor(progress): generic progress tracking by @shizhMSFT in #1524
• docs: add an enhancement proposal doc template by @FeynmanZhou in #1621
• build: upgrade to Go 1.24.0 by @Wwwsylvia in #1629
• fix: bump oras-go to the latest commit which fixes the symlink issue by @Wwwsylvia in #1628
• refactor: use handlers for oras blob push command by @wangxiaoxuan273 in #1618
• refactor: add resolve metadata handler by @wangxiaoxuan273 in #1631
• refactor: add blob delete metadata handler by @wangxiaoxuan273 in #1632
• fix: fix errors in manifest index examples by @wangxiaoxuan273 in #1634

New Contributors

• @Horiodino made their first contribution in #1607

Full Changelog: v1.3.0-beta.1...v1.3.0-beta.2

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.2.2

Changes

• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.1 by @qweeah in #1563
• build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 by @Wwwsylvia in #1591

Full Changelog: v1.2.1...v1.2.2

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@shizhMSFT's GPG key) which can be found here.

v1.3.0-beta.1

New Features

• Add OS and architecture information to oras version

Experimental Features

• Introduce multi-arch image / artifact management
  • New command set oras manifest index to manipulate OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • New flag --artifact-platform for oras push to push artifacts with platform information
• Support fully qualified reference for OCI image layout with a new flag --oci-layout-path (#1505)

Deprecation

• -v, --verbose flag is marked as deprecated for all commands and is by default for the following commands:
  • oras attach
  • oras blob push
  • oras cp
  • oras manifest push
  • oras pull
  • oras push

Bug Fixes

• Remove redundant -v, --verbose flag from below commands:
  • oras blob delete
  • oras blob fetch
  • oras login
  • oras manifest delete
  • oras manifest fetch
  • oras manifest fetch-config
  • oras repo ls
  • oras repo tags
  • oras resolve
  • oras tag
• Fix #1436: oras tag no longer creates referrer tag
• Fix #1442: invalid progress bar shown for empty layers
• Fix #1494: invalid reference in the format output of oras pull
• Minor fixes

Other Changes

• Improve UX
  • Improve error messages
  • Improve diagnose experience
• Improve documentation
• Update dependencies
• Update to Golang 1.23.4
• Minor security enhancements

Detailed Commits

• bump: tag and release ORAS CLI v1.2.0 by @qweeah in #1393
• build(deps): bump golang.org/x/term from 0.20.0 to 0.21.0 by @dependabot in #1399
• chore: Remove deprecated Print method by @TerryHowe in #1398
• chore: Remove unused file by @TerryHowe in #1395
• chore: Update goreleaser to v6 and configuration to v2 by @TerryHowe in #1402
• refactor: Move printer to output package by @TerryHowe in #1394
• Update links in README.md by @bcho in #1408
• refactor: Clean up pull handlers by @TerryHowe in #1407
• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #1410
• refactor: Move verbose into printer object by @TerryHowe in #1406
• refactor: clean status prompts by @qweeah in #1409
• chore: Add format type text by @TerryHowe in #1397
• chore: Increase print test coverage by @TerryHowe in #1411
• refactor: Move descriptor logic to descriptor by @TerryHowe in #1413
• chore: Ignore e2e test go sum file by @TerryHowe in #1416
• refactor: Move generate content key method to descriptor by @TerryHowe in #1415
• refactor: Move two output functions to the output package by @TerryHowe in #1417
• fix(doc): resolve example error for oras tag by @qweeah in #1419
• build(ci): set codecov CLI version to avoid tokenless upload failure by @qweeah in #1421
• refactor: Pass printer to text handler by @TerryHowe in #1420
• refactor: Use printer object for output by @TerryHowe in #1426
• chore: Add json test coverage by @TerryHowe in #1425
• fix: Minor spelling error in test by @TerryHowe in #1429
• refactor: assembles printer in the common output option by @qweeah in #1428
• refactor: Handle stderr similar to stdout by @TerryHowe in #1427
• refactor: reduce printer instantiation & unify stdout/stderr usage by @qweeah in #1433
• build(ci): unset codecov CLI version by @qweeah in #1434
• fix: disable oras tag fallback to tag schema when tagging a referrer by @njucjc in #1435
• refactor: Create tag handlers by @TerryHowe in #1437
• chore: Remove last deprecated method by @TerryHowe in #1438
• refactor: add display handler for cp, tag and manifest push by @qweeah in #1439
• chore(ux): improve error message when attaching without subject artifact by @qweeah in #1430
• build(deps): bump golang.org/x/term from 0.21.0 to 0.22.0 by @dependabot in #1440
• refactor: Move channel write logic to manager by @TerryHowe in #1445
• fix: variable name conflicts with built in function by @TerryHowe in #1448
• refactor: Isolate progress channel in Messenger by @TerryHowe in #1447
• refactor: Take private memory store out of test function by @TerryHowe in #1453
• chore: Bring back the print error by @TerryHowe in #1451
• fix: A couple small fixes to the descriptor test by @TerryHowe in #1452
• refactor: Create text copy handler by @TerryHowe in #1441
• refactor: replace error-ignored cobra output functions by @qweeah in #1454
• build(deps): bump github.com/onsi/gomega from 1.33.1 to 1.34.0 in /test/e2e by @dependabot in #1458
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in /test/e2e by @dependabot in #1462
• feature: Add manifest fetch documentation for digest by @TerryHowe in #1465
• fix: oras repo tags exlude-digest-tags documentation by @TerryHowe in #1467
• fix: Mention the resolve command in manifest fetch help by @TerryHowe in #1466
• refactor: increase test coverage for mac for tty tests by @TerryHowe in #1460
• refactor: Move testutils to general location by @TerryHowe in #1459
• refactor: Make mock fetcher generally available by @TerryHowe in #1455
• build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot in #1468
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 in /test/e2e by @dependabot in #1471
• build(deps): bump golang.org/x/term from 0.22.0 to 0.23.0 by @dependabot in #1470
• refactor: Successor getting with separation of concerns by @TerryHowe in #1443
• refactor: DRY up text_test by @TerryHowe in #1473
• docs: fix typo in help text of 'attach' command by @nmiyake in #1477
• chore: lint fixes for new lint by @TerryHowe in #1478
• chore: reset test coverage package list by @qweeah in #1482
• refactor: remove build constraint from testutils console by @TerryHowe in #1480
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.0 to 2.20.1 in /test/e2e by @dependabot in #1486
• fix: copy prompt skipped was missing by @TerryHowe in #1484
• build(deps): bump github.com/onsi/gomega from 1.34.1 to 1.34.2 in /test/e2e by @dependabot in #1489
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in /test/e2e by @dependabot in #1488
• build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 by @dependabot in #1491
• build: upgrade to Go 1.23.0 by @Wwwsylvia in #1493
• build(deps): bump golang.org/x/term from 0.23.0 to 0.24.0 by @dependabot in #1495
• feat: create index from existing manifests (index create) by @wangxiaoxuan273 in #1475
• fix: reference in the formatted output of oras pull is invalid by @wangxiaoxuan273 in #1496
• docs: add examples for --format by @wangxiaoxuan273 in #1497
• docs: improve the description of cp by @wangxiaoxuan273 in #1498
• feat: --output for oras manifest index create by @wangxiaoxuan273 in #1490
• feature: build binary for OS an...

v1.2.1

Bug Fixes

• Fix #1436: oras tag creates referrers tags unexpectedly

Other Changes

• Improve documentation
• Update dependencies
• Update to Golang 1.23.4

Detailed Commits

• bump: golang version to fix CVE-2024-24790 and CVE-2024-34156 by @qweeah in #1562
• chore: bump golang and dependencies by @qweeah in #1564
• chore: backport main-branch fixes into release-1.2 branch by @qweeah in #1567
• docs: add experimental marks to examples by @qweeah in #1570

Full Changelog: v1.2.0...v1.2.1

Notes

This release was signed with 46D3 369B 393F 6F82 71FD 1CE8 F86E C70D 2B0C 404F (@qweeah's GPG key) which can be found here.