ORAS CLI: vanhemmat versiot ja versiohistoria

### Changes since v1.3.5

#### Dependencies
• Update `oras.land/oras-go/v2` from v2.6.4 to v2.7.0 (#2284, fixes #2275)
• **Behavior change:** v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
• Authentication now works after a same-host HTTP-to-HTTPS redirect.
• Copy and verification fixes：`FilterArtifactType` matching for referrers with an empty config and for image indexes, `PreCopy` returning `SkipNode` after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

#### Bug fixes
• `oras tag` now checks that it gets a source reference and at least one tag (#2265, fixes #2264)
• `--from-resolve` and `--to-resolve` rules no longer overwrite each other when combined with `--resolve` (#2282, fixes #2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#2283, fixes #2278)

#### Release and packaging
• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with `gh attestation verify` in addition to GPG signatures (#2271, fixes #2269)
• Stable snap releases now publish to the `candidate` channel as well as `stable`. The classic snap no longer bundles its own `ca-certificates` and uses the host certificate store instead (#2274)

#### Other
• More unit tests for display JSON metadata handlers and `contentutil` (#2266, #2267)
• Bump GitHub Actions dependencies (#2263)

**Full changelog:** https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6

## Changelog
• 9b1fc815f6b7fba743f08b9b5c5846639cc11d3c bump：tag and release ORAS CLI v1.3.6 (#2285)
• 5f0355536403621f11cb264e7082577d4cc7ea45 docs：make oras-www release updates explicit (#2286)
• 81f1656d2f78f5e1a3c1a350530369857234d6e2 fix：serialize progress console frames (#2292)
• 27c179624c30cc54016cbe02ad05764cede6022c fix：share auth caches only between clients with the same credentials (#2288)
• ecc3e870f435e18f25fe7e5b18be70d95ad3a8f9 fix：take the write lock in status.Render (#2290)
• 3d087a2208f06e16a0d0ef5086d873521286ccbb fix：make the TTY progress manager safe against concurrent and repeated Close (#2287)
• 92188903a597b72d9678ddc0527e109ce5b4b268 fix：expose mount only for capable tracked targets (#2283)
• fdf2ba3f9047a91978985cb0c74744a045246b10 fix：keep --from-resolve and --to-resolve rules separate (#2282)
• cb601f51874d1f025f4ef1b0446fb3bf125caa63 chore：update oras-go to v2.7.0 (#2284)
• a3256036f43cd17d01e9def3a9e01778afa0e995 build：keep snap candidate channel current (#2274)
• 5236ba228aeae1078ce0d7219c2994c3a85aa427 ci：publish build provenance attestations for release artifacts (#2271)
• ed26899244145c32092d3a317eed2863d957a505 test(display)：cover the remaining JSON metadata handlers (#2266)
• bd0668e9c6e56faf1122fb2eeac33617f8df53c9 test(contentutil)：cover MultiReadOnlyTarget and IsDigest (#2267)
• 38812fe3b372034c1489976054d3758b4a580ca4 fix：validate minimum arguments for tag command (#2265)
• 17d5269b20d68df29b548bbbfa7742996f2ad674 build(deps)：bump the github-actions group with 3 updates (#2263)

## Verification

Release artifacts are signed with the ORAS project release key `C6FC42F0DE84A345FAADB742F44418110791EF37`. Signatures (`.asc` files) are attached to this release.

Public keys are available in the [KEYS](https://github.com/oras-project/oras/blob/main/KEYS) file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

```sh
gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras
```

The attestations are Sigstore bundles, so they can also be downloaded with `gh attestation download` and checked with `cosign verify-blob-attest

## Changelog
• d6e7b583b9afc7fa3798de77181c53c94418d727 bump：tag and release ORAS CLI v1.3.5 (#2244)
• 44318293132b5725ca03f279ca58ba258f3e9303 docs：require cve fixes to land before preparing a release (#2258)
• 8ee66acb5b8ecb97c2bcb8c8e350f8919c656f8b docs：add ORAS CLI release process (#2248)
• e09a8bbe9837a70465801a6a9fc400fcf4c29a4f chore：bump oras-go to v2.6.4 in e2e tests (#2247)
• 8270f5ffa9ed7076bddd8120cc184c66494f8c30 chore：update oras-go to v2.6.4 (#2242)
• ba3a3dc53c8d676d1ed721673f9739bbab7b0130 fix：validate extra destination tags before pushing (#2237)
• 6ca02d0623152537dee5a066070d82d6b9f2f8f6 build(deps)：bump the github-actions group across 1 directory with 3 updates (#2240)
• c9ccd9587f4856f84568337e217923a4471ae58d build(deps)：bump library/golang from 1.27.1-alpine to 1.27.2-alpine (#2239)
• b2dc64558706a21d8bc02705fc2584b80b62ed1f build(deps)：bump github.com/onsi/ginkgo/v2 from 2.33.0 to 2.33.1 in /test/e2e (#2238)
• bae5056ea14f8f0cbcc7e1cfcbc8a75d02bcfbd1 Preserve the index media type when the index body omits it (#2235)
• 227fc742ae383c12a135ec314dc8e1eef38d2438 chore：update oras-go to v2.6.3 (#2234)
• 4d6c6e8669cc914b7661dca3ecb349c517aad3dd build(deps)：bump golang.org/x/term from 0.46.0 to 0.47.0 (#2232)
• 21193d8f5a5d072442cf36f213997d9c079f6fbd build(deps)：bump golang.org/x/sync from 0.23.0 to 0.24.0 (#2231)
• 8b3b8bd42a49c06b0263a2715c6d93df4b9cf4c4 Fall back to config media type for old-style artifact types (#2114)
• e58fee37ea27a1b7a372c68d5c0d1c1b1c73f523 fix：validate format before special handling (#2205)
• 4e9a756e8e56ad9d88edfaa91c1fa672470e956e fix：validate empty OCI layout path with digest (#2230)
• b0a7bdafe0bf643c9ebea893da7bd4b894f95a82 fix：restore pretty output for manifest fetch-config (#2228)
• ab0ff3d60601d15851fc8efe22061c35d3ea67e6 fix：limit manifest config fetch size (#2222)
• 80f72e14f17bfc635f311994e56ca06637b166ea build(deps)：bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the github-actions group (#2223)
• d60888982bb434831a1186d01f281f672368cd80 docs(e2e)：correct test/e2e/README.md references (#2219)
• 8d737cd0042cefe441c2c21f302d0bf87cf4c14c chore：drop dead .gitignore entries for the Docker e2e registry mounts (#2220)
• 02c5c20b29a857cc5c02b07303926a4423939db0 ci：remove Docker-based e2e test run (#2208)
• d41f4ebf6fc5f1135de9cc4c0e573ff692fd1c17 fix：detect credentials in multiple JSON values (#2218)
• 5c33ab2eb1688246d9019a0f77086b910dc928fd ci：pin e2e-k8s.yml action refs to commit SHAs (#2216)
• 1033ebb7ad67e45d32ec744d7177258b456c1f4e fix：generate coverage report in covhtml (#2214)
• ccf3e265b6663e070a74a65bf03a207a112982e6 chore：update golang.org/x/crypto (#2207)
• 715917d0e3f7f2c44fcaf8f2db98adf1de9eb7c2 feat(cp)：support multiple platforms (#2191)
• 488b3fab108b77fa2d3ac54eca6e56db41dbcdcb fix：correct manifest fetch format error (#2203)
• a826d9aa24c1ee82a84e27c4df0584859d1bcb22 fix：clarify absolute path validation warning (#2201)
• 73270644f4c1be45334af635b55233239acba6d2 ci：replace action-publish with snapcraft CLI (#2199)
• 1dd0de89bd4292d78d817b4c934c70c826df9540 build(deps)：bump the github-actions group with 4 updates (#2200)
• 7c53cbf2c880ed160c9e08b0e6c22c6820a70f78 fix：clean up partial pull output on failure (#2194)
• bdf7835108c666aa9206146de715fb890ed99f6f test(errors)：cover the CLI error type and its constructors (#2196)
• 88f46a4b0be1426385ffa4201c66b550da696ed5 build(deps)：bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in /test/e2e (#2195)
• 8c979f1f30d0a4049addff5fcff8de48a4afe583 test(display)：cover the pulled-file model (#2189)
• a0cd4de5cfcddc825d8e9979bda5edcd6d422f6b feat：add Kubernetes-based e2e testing infrastructure (#1913)
• be7921423828a0d4d4b56c995fe98c96de9f7a40 fix：fix concurrency in Tagged (#2183)
• 44e831af07247fdf99ff7c1ee9697944b53580e8 ci：publish stable rolling image tags (#2184)
• bc28b9c7db34b286e10861f30fe6de2b1e210d5e fix：keep an index's own children out of its reported referrers (#2174)
• 458c1865e441537092ee2bdb1e2924

ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom `--header` values, and `--debug` trace output — strictly to the configured registry origin, and adds an opt-in `--force` copy mode for registries that report incomplete content as present.

## Highlights

• 🔒 **Security:** three credential-scoping advisories are fixed — mTLS client certificates ([GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)), custom request headers ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)), and `--debug` HTTP traces ([GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)). All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)).
• ✨ **`oras cp` and `oras push` gain `--force`**, which walks every referenced manifest instead of trusting the destination's `Exists()` response — this fixes `manifest blob unknown` failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories).
• ⚡ **Shared authentication cache:** repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call.
• 🛡️ **Supply-chain hardening:** release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key.

## ✨ Features

• Add `--force` to `oras cp`/`oras push` to handle partially-populated destinations by @renshao in #2061
• Save authentication context between calls so in-process usage authenticates once by @TerryHowe in #1923
• Sign release checksums in the release workflow by @TerryHowe in #2112

## 🐛 Bug Fixes

• Avoid send on closed channel in the progress messenger by @harshasiddartha in #2126
• Route logger output to command stderr by @vigneshakaviki in #2123

## 🔒 Security

• **Registry mTLS client certificates are disclosed to cross-origin TLS peers** (CWE-201, [GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2))：a certificate supplied via `--cert-file`/`--key-file` was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin.
• **Registry custom credentials are forwarded across HTTP origins** ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3))：values passed with `--header`/`--from-header`/`--to-header` were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry.
• **Debug HTTP traces expose replayable bearer credentials** (CWE-532, [GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5))：`--debug` trace output persisted URL userinfo and query parameters (e.g. pre-signed `X-Amz-Signature`), `Location`/`Content-Location`/`Referer` headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted.

All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)).

## 🧹 Maintenance

• Replace `containerd/console` with `golang.org/x/term` by @TerryHowe in #2062
• Group GitHub Actions Dependabot updates by @TerryHowe in #2119
• Float the Go version in the release workflow to match the other workflows by @sooraj-sky in #2137
• Cover the shared auth client cache in tests by @subotac in #2127
• Strengthen display handler test assertions by @TerryHowe in #2055
• Expect scrubbed custom header values in e2e by @TerryHowe in #2133
• Dependency bumps：`sirupsen/logrus` 1.9.4 → 1.10.1 (#2130, #2138), `onsi/ginkgo/v2` 2.32.1 in `/test/e2e` (#2129), `library/golang` 1.26.5 → 1.27.0-alpine (#2134, #2139), and grouped GitHub Actions updates (#2115, #2116,

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to `oras attach`.

## Highlights

🔒 **Security:** upgraded `oras-go` to **v2.6.2**, which addresses a tar-extraction path-traversal advisory ([GHSA-fxhp-mv3v-67qp](https://github.com/advisories/GHSA-fxhp-mv3v-67qp)) affecting hardlink entries during `pull`/extract.
✨ **`oras attach` gains `--config`** support, and `--annotation $config:*` values now flow through to the packed manifest.
🛡️ **Supply-chain hardening:** GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

## ✨ Features

Add `--config` flag support for `oras attach` by @ogulcanaydogan in #2000
Pass `--annotation $config:*` through to `PackManifestOptions` for `attach` by @SAY-5 in #2037
Allow setting `org.opencontainers.image.title` in the annotation file by @rafaelgieschke in #1872
Add SBOMs to the release workflow by @bupd in #1940

## 🐛 Bug Fixes

`cp` should not mount when source and destination credentials differ by @wangxiaoxuan273 in #1903
Fall back to blob upload when cross-repo mount fails by @bupd in #1924
Redact password values from e2e test execution logs by @TerryHowe in #2042
Revert Alpine base image to fix multi-arch build by @bupd in #1933
Set `GOTOOLCHAIN=local` in `snapcraft.yaml` to prevent auto-download by @TerryHowe in #2012
Fix typo in `logEntrySeparator` const by @Ahmad-Faraj in #2087

## 🔒 Security

Bump `oras.land/oras-go/v2` to **2.6.2** (addresses GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106
Add static security scanning (gosec) to CI by @bupd in #1934; resolve gosec findings (G703, G117, G704) by @TerryHowe in #1985
Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin to full version comments by @alliasgher in #2038
Add `golangci-lint` configuration with additional linters by @bupd in #1936

## 📖 Documentation

Add examples to the `logout` command help text by @ogulcanaydogan in #2079
Add multi-repository backup and restore proposal by @shizhMSFT in #1917

## 🧰 Maintenance

Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, #1910
Migrate from unmaintained `gopkg.in/yaml.v3` to `go.yaml.in/yaml/v4` by @bupd in #1922
Add `goheader` (license headers) and `revive` linters, plus `gofmt`/`go modernize` passes
~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot

## New Contributors

* @rafaelgieschke made their first contribution in #1872
* @ManishhDev made their first contribution in #1883
* @johnsonshi made their first contribution in #1889
* @vr-varad made their first contribution in #1898
* @adriansali made their first contribution in #1910
* @bupd made their first contribution in #1933
* @alliasgher made their first contribution in #2038
* @ogulcanaydogan made their first contribution in #2000
* @bimakw made their first contribution in #1950
* @SAY-5 made their first contribution in #2037
* @gaoflow made their first contribution in #2093
* @Ahmad-Faraj made their first contribution in #2087

**Full Changelog**: https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3