Can pull referrer with oras pull without knowing the digest #834
Description
What is the version of your ORAS CLI
Version: 1.0.0-rc.1+unreleased Go version: go1.20 Git commit: 8bda262 Git tree state: clean
What would you like to be added?
For example, if I take this multi-arch image and copy it to azure
docker.io/library/ubuntu:lunar -> xxx.azurecr.io/test:lunar
I now have an artefact named one.json. I attach it to the amd64 platform with this command, for example:
oras attach xxx.azurecr.io/test:lunar --platform linux/amd64 one.json
Now if I do
oras discover xxx.azurecr.io/test:lunar
I will have 0 artefacts discovered, but if I do
oras discover xxx.azurecr.io/test:lunar --platform linux/amd64
Oras will find the one.json artefact with this digest sha256:digestofsbom. These two outputs are excepted.
Now if I do:
oras pull xxx.azurecr.io/test:lunar --platform linux/amd64
It will say downloaded empty artefacts. But if I do
oras pull xxx.azurecr.io/test:lunar@sha256:digestofsbom
It downloads the one.json artefact.
What @SteveLasker and I proposed is to add this command, for example, to pull the artefacts:
oras pull xxx.azurecr.io/test:lunar --platform linux/amd64 --artifactType application/spdx+json --top 1 --orderby desc
Why is this needed for ORAS?
Some people will use Oras without knowing anything about digest or manifest. It will permit to have for them a great user experience. Also, if I attached multiple files to the amd64 ( sbom, license,...), it's great to be able to download all files with a single command and not need to get the digest for each file.
Are you willing to submit PRs to contribute to this feature?
- Yes, I am willing to implement it.