What happened in your environment?
When using ORAS CLI to interact with OCI v1.0 compliant registries such as GHCR or registries that don't support deletion API (e.g. Docker Hub), ORAS will return an unexpected error message and may mislead or confuse users. It happens when attaching an artifact to the image for the second time.
What did you expect to happen?
Improve the error message to be more descriptive and user-friendly, and tell users about the right result exactly. Giving an example:
This artifact has been attached to `xxx`.
Warning: Please note that ORAS can't delete the referrers index since this is an OCI v1.0 compliant registry or the Deletion API is disabled by the registry.
How can we reproduce it?
I have attached a file to the sample Alpine image in GHCR. Then I attached another file to the same image and it returned the error message as follows:
oras attach --artifact-type=sbom/test ghcr.io/feynmanzhou/alpine:latest sbom.json -u feynmanzhou --password-stdin
Uploading 57761fa432ee sbom.json
Uploaded 57761fa432ee sbom.json
Error: failed to delete dangling referrers index sha256:de0b503017452ba6b070981414bfc31f8e6096852a36ff4f3223fdc0ff411566 for referrers tag sha256-1304f174557314a7ed9eddb4eab12fed12cb0cd9809e4c28f29af86979a3c870: DELETE "https://ghcr.io/v2/feynmanzhou/alpine/manifests/sha256:de0b503017452ba6b070981414bfc31f8e6096852a36ff4f3223fdc0ff411566": response status code 405: unsupported: The operation is unsupported.
It may confuse users why this attach behavior failed due to an old index manifest deletion failure. In fact, this file has been attached to the image successfully but it doesn't tell users the right result unless users verify it using oras discover as below.
oras discover ghcr.io/feynmanzhou/alpine:latest -o tree -u feynmanzhou --password-stdin
ghcr.io/feynmanzhou/alpine@sha256:1304f174557314a7ed9eddb4eab12fed12cb0cd9809e4c28f29af86979a3c870
├── application/vnd.cncf.notary.signature
│ └── sha256:85f65b60a6e260d52ba5f8d556d444320b92c2ac140ec8d4944dbd8b03deb18c
└── sbom/test
└── sha256:ee375fb1111ca3d0c60663115e2cdce3e7061821ab26059852ecc43ceb8ee8cd
What is the version of your ORAS CLI?
Version: 1.0.0
Go version: go1.20.2
Git commit: b58e7b910ca556973d111e9bd734a71baef03db2
Git tree state: clean
What is your OS environment?
Ubuntu 20.08
Are you willing to submit PRs to fix it?
What happened in your environment?
When using ORAS CLI to interact with OCI v1.0 compliant registries such as GHCR or registries that don't support deletion API (e.g. Docker Hub), ORAS will return an unexpected error message and may mislead or confuse users. It happens when attaching an artifact to the image for the second time.
What did you expect to happen?
Improve the error message to be more descriptive and user-friendly, and tell users about the right result exactly. Giving an example:
How can we reproduce it?
I have attached a file to the sample Alpine image in GHCR. Then I attached another file to the same image and it returned the error message as follows:
It may confuse users why this
attachbehavior failed due to an old index manifest deletion failure. In fact, this file has been attached to the image successfully but it doesn't tell users the right result unless users verify it usingoras discoveras below.What is the version of your ORAS CLI?
What is your OS environment?
Ubuntu 20.08
Are you willing to submit PRs to fix it?