This is an older version. The current version is 1.3.6. ORAS CLI 1.3.6 · Released:
Installer files 1.3.4
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | ZIP → Portable | — | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom `--header` values, and `--debug` trace output — strictly to the configured registry origin, and adds an opt-in `--force` copy mode for registries that report incomplete content as present.
## Highlights
• 🔒 **Security:** three credential-scoping advisories are fixed — mTLS client certificates ([GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)), custom request headers ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)), and `--debug` HTTP traces ([GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)). All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)).
• ✨ **`oras cp` and `oras push` gain `--force`**, which walks every referenced manifest instead of trusting the destination's `Exists()` response — this fixes `manifest blob unknown` failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories).
• ⚡ **Shared authentication cache:** repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call.
• 🛡️ **Supply-chain hardening:** release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key.
## ✨ Features
• Add `--force` to `oras cp`/`oras push` to handle partially-populated destinations by @renshao in #2061
• Save authentication context between calls so in-process usage authenticates once by @TerryHowe in #1923
• Sign release checksums in the release workflow by @TerryHowe in #2112
## 🐛 Bug Fixes
• Avoid send on closed channel in the progress messenger by @harshasiddartha in #2126
• Route logger output to command stderr by @vigneshakaviki in #2123
## 🔒 Security
• **Registry mTLS client certificates are disclosed to cross-origin TLS peers** (CWE-201, [GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2))：a certificate supplied via `--cert-file`/`--key-file` was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin.
• **Registry custom credentials are forwarded across HTTP origins** ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3))：values passed with `--header`/`--from-header`/`--to-header` were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry.
• **Debug HTTP traces expose replayable bearer credentials** (CWE-532, [GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5))：`--debug` trace output persisted URL userinfo and query parameters (e.g. pre-signed `X-Amz-Signature`), `Location`/`Content-Location`/`Referer` headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted.
All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)).
## 🧹 Maintenance
• Replace `containerd/console` with `golang.org/x/term` by @TerryHowe in #2062
• Group GitHub Actions Dependabot updates by @TerryHowe in #2119
• Float the Go version in the release workflow to match the other workflows by @sooraj-sky in #2137
• Cover the shared auth client cache in tests by @subotac in #2127
• Strengthen display handler test assertions by @TerryHowe in #2055
• Expect scrubbed custom header values in e2e by @TerryHowe in #2133
• Dependency bumps：`sirupsen/logrus` 1.9.4 → 1.10.1 (#2130, #2138), `onsi/ginkgo/v2` 2.32.1 in `/test/e2e` (#2129), `library/golang` 1.26.5 → 1.27.0-alpine (#2134, #2139), and grouped GitHub Actions updates (#2115, #2116, #2117, #2120, #2122, #2124, #2128, #2135, #2140)
## New Contributors
• @renshao made their first contribution in #2061
• @vigneshakaviki made their first contribution in #2123
• @harshasiddartha made their first contribution in #2126
• @subotac made their first contribution in #2127
• @sooraj-sky made their first contribution in #2137
**Full Changelog**：https://github.com/oras-project/oras/compare/v1.3.3...v1.3.4
