A new release candidate of OCI 1.1 spec is released.

• image-spec v1.1.0-rc.3
• image-spec v1.1.0-rc4
• distribution-spec v1.1.0-rc.2
• distribution-spec v1.1.0-rc.3

We need to discuss how oras-go should support / implement the latest release candidate, or we should hold on for the stable release.

Summary of ORAS Related Changes

image-spec: v1.1.0-rc2 --> v1.1.0-rc4

• BREAKING CHANGE Removed artifact manifest
• BREAKING CHANGE Removed pre-defined annotation keys
  • org.opencontainers.artifact.created
  • org.opencontainers.artifact.description
  • org.opencontainers.referrers.filtersApplied
• Minimum golang version changed to 1.18
• Non-distributable layers a.k.a. foreign layers are deprecated
• Introduced empty descriptor
  • Media type: application/vnd.oci.empty.v1+json
• artifactType field is introduced to the image manifest. This field MUST be set if the config media type is set to empty
• artifactType and subject fields are introduced to the image index
• layers field of an image manifest SHOULD NOT be empty, which was a MUST. If the config media type is application/vnd.oci.image.config.v1+json, layers MUST NOT be empty.
• Introduced Guidelines for Artifact Usage

Full change set: opencontainers/image-spec@v1.1.0-rc2...v1.1.0-rc4

distribution-spec: v1.1.0-rc1 --> v1.1.0-rc.3

• Removed docs to the OCI Artifacts repository
• Updated conformance tests
• BREAKING CHANGE Removed artifact manifest
• Introduced the OCI-Chunk-Min-Length header
• Introduced new endpoint end-13: GET /v2/<name>/blobs/uploads/<reference>.

  Note This endpoint exists in the Docker Registry HTTP API V2

• IMPORTANT The OCI-Subject header is returned on PUT manifest with subject if the remote registry supports Referrers API.
• BREAKING CHANGE Applying filters on the Referrers API will not return a result JSON with the annotation org.opencontainers.referrers.filtersApplied. Instead, the registry server returns a header OCI-Filters-Applied.
• Introduced Warning headers
• Minimum golang version changed to 1.18
• Repository name is relaxed. However, it is still a subset of the docker spec. Related oras-go code:
  

  oras-go/registry/reference.go

  Lines 30 to 37 in 0e20275

  	// repositoryRegexp is adapted from the distribution implementation. The
  	// repository name set under OCI distribution spec is a subset of the docker
  	// spec. For maximum compatability, the docker spec is verified client-side.
  	// Further checks are left to the server-side.
  	// References:
  	// - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
  	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
  	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)

Full change set: opencontainers/distribution-spec@v1.1.0-rc1...v1.1.0-rc.3

Detailed Changes by Release

image-spec: v1.1.0-rc2 --> v1.1.0-rc.3

• BREAKING CHANGE Removed artifact manifest
• BREAKING CHANGE Removed pre-defined annotation keys
  • org.opencontainers.artifact.created
  • org.opencontainers.artifact.description
  • org.opencontainers.referrers.filtersApplied
• Minimum golang version changed to 1.18
• Non-distributable layers a.k.a. foreign layers are deprecated
• Introduced scratch config
  • Media type: application/vnd.oci.scratch.v1+json
• artifactType field is introduced to the image manifest. This field MUST be set if the config media type is set to scratch
• layers field of an image manifest SHOULD NOT be empty, which was a MUST. If the config media type is application/vnd.oci.image.config.v1+json, layers MUST NOT be empty.
• Introduced Guidelines for Artifact Usage

Full change set: opencontainers/image-spec@v1.1.0-rc2...v1.1.0-rc.3

image-spec: v1.1.0-rc.3 --> v1.1.0-rc4

• artifactType and subject fields are introduced to the image index
• scratch config is changed to empty descriptor
  • Media type: application/vnd.oci.empty.v1+json

Full change set: opencontainers/image-spec@v1.1.0-rc.3...v1.1.0-rc4

distribution-spec: v1.1.0-rc1 --> v1.1.0-rc.2

• Removed docs to the OCI Artifacts repository
• Updated conformance tests
• BREAKING CHANGE Removed artifact manifest
• Introduced the OCI-Chunk-Min-Length header
• Introduced new endpoint end-13: GET /v2/<name>/blobs/uploads/<reference>.

  Note This endpoint exists in the Docker Registry HTTP API V2

• IMPORTANT The OCI-Subject header is returned on PUT manifest with subject if the remote registry supports Referrers API.
• BREAKING CHANGE Applying filters on the Referrers API will not return a result JSON with the annotation org.opencontainers.referrers.filtersApplied. Instead, the registry server returns a header OCI-Filters-Applied.
• Introduced Warning headers
• Minimum golang version changed to 1.18

Full change set: opencontainers/distribution-spec@v1.1.0-rc1...v1.1.0-rc.2

distribution-spec: v1.1.0-rc.2 --> v1.1.0-rc.3

• Repository name is relaxed. However, it is still a subset of the docker spec. Related oras-go code:
  

  oras-go/registry/reference.go

  Lines 30 to 37 in 0e20275

  	// repositoryRegexp is adapted from the distribution implementation. The
  	// repository name set under OCI distribution spec is a subset of the docker
  	// spec. For maximum compatability, the docker spec is verified client-side.
  	// Further checks are left to the server-side.
  	// References:
  	// - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
  	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
  	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)

Full change set: opencontainers/distribution-spec@v1.1.0-rc.2...v1.1.0-rc.3