Bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0 (#1668)

dependabot[bot] · ci-robot · commit 91f71a9e8e6a · 2025-05-28T00:04:47.000Z
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.5.0 to 2.6.0. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](oras-project/oras-go@v2.5.0...v2.6.0) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Upstream-repository: operator-registry Upstream-commit: 5288e322967e5c51b10652f395132398dd73c391
diff --git a/go.mod b/go.mod
@@ -248,7 +248,7 @@ require (
 	k8s.io/kms v0.32.3 // indirect
 	k8s.io/kube-aggregator v0.32.3 // indirect
 	k8s.io/kubectl v0.32.0 // indirect
-	oras.land/oras-go/v2 v2.5.0 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
diff --git a/go.sum b/go.sum
@@ -3281,8 +3281,8 @@ modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 modernc.org/z v1.7.0/go.mod h1:hVdgNMh8ggTuRG1rGU8x+xGRFfiQUIAw0ZqlPy8+HyQ=
-oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c=
-oras.land/oras-go/v2 v2.5.0/go.mod h1:z4eisnLP530vwIOUOJeBIj0aGI0L1C3d53atvCBqZHg=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/staging/operator-registry/go.mod b/staging/operator-registry/go.mod
@@ -52,7 +52,7 @@ require (
 	k8s.io/apimachinery v0.32.3
 	k8s.io/client-go v0.32.3
 	k8s.io/kubectl v0.32.0
-	oras.land/oras-go/v2 v2.5.0
+	oras.land/oras-go/v2 v2.6.0
 	sigs.k8s.io/controller-runtime v0.20.4
 	sigs.k8s.io/kind v0.27.0
 	sigs.k8s.io/yaml v1.4.0
diff --git a/staging/operator-registry/go.sum b/staging/operator-registry/go.sum
@@ -730,8 +730,8 @@ k8s.io/kubectl v0.32.0 h1:rpxl+ng9qeG79YA4Em9tLSfX0G8W0vfaiPVrc/WR7Xw=
 k8s.io/kubectl v0.32.0/go.mod h1:qIjSX+QgPQUgdy8ps6eKsYNF+YmFOAO3WygfucIqFiE=
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c=
-oras.land/oras-go/v2 v2.5.0/go.mod h1:z4eisnLP530vwIOUOJeBIj0aGI0L1C3d53atvCBqZHg=
+oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
+oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 h1:CPT0ExVicCzcpeN4baWEV2ko2Z/AsiZgEdwgcfwLgMo=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.20.4 h1:X3c+Odnxz+iPTRobG4tp092+CvBU9UK0t/bRf+n0DGU=
diff --git a/vendor/modules.txt b/vendor/modules.txt
@@ -2238,8 +2238,8 @@ k8s.io/utils/path
 k8s.io/utils/pointer
 k8s.io/utils/ptr
 k8s.io/utils/trace
-# oras.land/oras-go/v2 v2.5.0
-## explicit; go 1.21
+# oras.land/oras-go/v2 v2.6.0
+## explicit; go 1.23.0
 oras.land/oras-go/v2/content
 oras.land/oras-go/v2/content/oci
 oras.land/oras-go/v2/errdef
diff --git a/vendor/oras.land/oras-go/v2/content/oci/oci.go b/vendor/oras.land/oras-go/v2/content/oci/oci.go
@@ -14,7 +14,7 @@ limitations under the License.
 */
 
 // Package oci provides access to an OCI content store.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md
 package oci
 
 import (
@@ -44,7 +44,7 @@ import (
 
 // Store implements `oras.Target`, and represents a content store
 // based on file system with the OCI-Image layout.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md
 type Store struct {
 	// AutoSaveIndex controls if the OCI store will automatically save the index
 	// file when needed.
@@ -157,10 +157,11 @@ func (s *Store) Exists(ctx context.Context, target ocispec.Descriptor) (bool, er
 
 // Delete deletes the content matching the descriptor from the store. Delete may
 // fail on certain systems (i.e. NTFS), if there is a process (i.e. an unclosed
-// Reader) using target. If s.AutoGC is set to true, Delete will recursively
-// remove the dangling blobs caused by the current delete. If s.AutoDeleteReferrers
-// is set to true, Delete will recursively remove the referrers of the manifests
-// being deleted.
+// Reader) using target.
+//   - If s.AutoGC is set to true, Delete will recursively
+//     remove the dangling blobs caused by the current delete.
+//   - If s.AutoDeleteReferrers is set to true, Delete will recursively remove
+//     the referrers of the manifests being deleted.
 func (s *Store) Delete(ctx context.Context, target ocispec.Descriptor) error {
 	s.sync.Lock()
 	defer s.sync.Unlock()
@@ -220,9 +221,18 @@ func (s *Store) delete(ctx context.Context, target ocispec.Descriptor) ([]ocispe
 	return danglings, nil
 }
 
-// Tag tags a descriptor with a reference string.
-// reference should be a valid tag (e.g. "latest").
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md#indexjson-file
+// Tag associates a reference string (e.g. "latest") with the descriptor.
+// The reference string is recorded in the "org.opencontainers.image.ref.name"
+// annotation of the descriptor. When saved, the updated descriptor is persisted
+// in the `index.json` file.
+//
+//   - If the same reference string is tagged multiple times on different
+//     descriptors, the descriptor from the last call will be stored.
+//   - If the same descriptor is tagged multiple times with different reference
+//     strings, multiple copies of the descriptor with different reference tags
+//     will be stored in the `index.json` file.
+//
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#indexjson-file
 func (s *Store) Tag(ctx context.Context, desc ocispec.Descriptor, reference string) error {
 	s.sync.RLock()
 	defer s.sync.RUnlock()
@@ -260,11 +270,11 @@ func (s *Store) tag(ctx context.Context, desc ocispec.Descriptor, reference stri
 	return nil
 }
 
-// Resolve resolves a reference to a descriptor. If the reference to be resolved
-// is a tag, the returned descriptor will be a full descriptor declared by
-// github.com/opencontainers/image-spec/specs-go/v1. If the reference is a
-// digest the returned descriptor will be a plain descriptor (containing only
-// the digest, media type and size).
+// Resolve resolves a reference to a descriptor.
+//   - If the reference to be resolved is a tag, the returned descriptor will be
+//     a full descriptor declared by github.com/opencontainers/image-spec/specs-go/v1.
+//   - If the reference is a digest, the returned descriptor will be a
+//     plain descriptor (containing only the digest, media type and size).
 func (s *Store) Resolve(ctx context.Context, reference string) (ocispec.Descriptor, error) {
 	s.sync.RLock()
 	defer s.sync.RUnlock()
@@ -290,6 +300,13 @@ func (s *Store) Resolve(ctx context.Context, reference string) (ocispec.Descript
 	return desc, nil
 }
 
+// Untag disassociates a reference string from its descriptor.
+// When saved, the descriptor entry cotanining the reference in the
+// "org.opencontainers.image.ref.name" annotation is removed from the
+// `index.json` file.
+// The actual content identified by the descriptor is NOT deleted.
+//
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md#indexjson-file
 func (s *Store) Untag(ctx context.Context, reference string) error {
 	if reference == "" {
 		return errdef.ErrMissingReference
@@ -379,6 +396,7 @@ func (s *Store) loadIndexFile(ctx context.Context) error {
 			Versioned: specs.Versioned{
 				SchemaVersion: 2, // historical value
 			},
+			MediaType: ocispec.MediaTypeImageIndex,
 			Manifests: []ocispec.Descriptor{},
 		}
 		return s.writeIndexFile()
diff --git a/vendor/oras.land/oras-go/v2/content/oci/readonlyoci.go b/vendor/oras.land/oras-go/v2/content/oci/readonlyoci.go
@@ -36,7 +36,7 @@ import (
 
 // ReadOnlyStore implements `oras.ReadonlyTarget`, and represents a read-only
 // content store based on file system with the OCI-Image layout.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md
 type ReadOnlyStore struct {
 	fsys        fs.FS
 	storage     content.ReadOnlyStorage
@@ -83,11 +83,11 @@ func (s *ReadOnlyStore) Exists(ctx context.Context, target ocispec.Descriptor) (
 	return s.storage.Exists(ctx, target)
 }
 
-// Resolve resolves a reference to a descriptor. If the reference to be resolved
-// is a tag, the returned descriptor will be a full descriptor declared by
-// github.com/opencontainers/image-spec/specs-go/v1. If the reference is a
-// digest the returned descriptor will be a plain descriptor (containing only
-// the digest, media type and size).
+// Resolve resolves a reference to a descriptor.
+//   - If the reference to be resolved is a tag, the returned descriptor will be
+//     a full descriptor declared by github.com/opencontainers/image-spec/specs-go/v1.
+//   - If the reference is a digest, the returned descriptor will be a
+//     plain descriptor (containing only the digest, media type and size).
 func (s *ReadOnlyStore) Resolve(ctx context.Context, reference string) (ocispec.Descriptor, error) {
 	if reference == "" {
 		return ocispec.Descriptor{}, errdef.ErrMissingReference
diff --git a/vendor/oras.land/oras-go/v2/content/oci/readonlystorage.go b/vendor/oras.land/oras-go/v2/content/oci/readonlystorage.go
@@ -31,7 +31,7 @@ import (
 
 // ReadOnlyStorage is a read-only CAS based on file system with the OCI-Image
 // layout.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md
 type ReadOnlyStorage struct {
 	fsys fs.FS
 }
diff --git a/vendor/oras.land/oras-go/v2/content/oci/storage.go b/vendor/oras.land/oras-go/v2/content/oci/storage.go
@@ -43,7 +43,7 @@ var bufPool = sync.Pool{
 }
 
 // Storage is a CAS based on file system with the OCI-Image layout.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md
 type Storage struct {
 	*ReadOnlyStorage
 	// root is the root directory of the OCI layout.
@@ -141,13 +141,16 @@ func (s *Storage) ingest(expected ocispec.Descriptor, content io.Reader) (path s
 
 	path = fp.Name()
 	defer func() {
-		// remove the temp file in case of error.
-		// this executes after the file is closed.
+		// close the temp file and check close error
+		if err := fp.Close(); err != nil && ingestErr == nil {
+			ingestErr = fmt.Errorf("failed to close ingest file: %w", err)
+		}
+
+		// remove the temp file in case of error
 		if ingestErr != nil {
 			os.Remove(path)
 		}
 	}()
-	defer fp.Close()
 
 	buf := bufPool.Get().(*[]byte)
 	defer bufPool.Put(buf)
diff --git a/vendor/oras.land/oras-go/v2/content/reader.go b/vendor/oras.land/oras-go/v2/content/reader.go
@@ -99,6 +99,11 @@ func (vr *VerifyReader) Verify() error {
 
 // NewVerifyReader wraps r for reading content with verification against desc.
 func NewVerifyReader(r io.Reader, desc ocispec.Descriptor) *VerifyReader {
+	if err := desc.Digest.Validate(); err != nil {
+		return &VerifyReader{
+			err: fmt.Errorf("failed to validate %s: %w", desc.Digest, err),
+		}
+	}
 	verifier := desc.Digest.Verifier()
 	lr := &io.LimitedReader{
 		R: io.TeeReader(r, verifier),
diff --git a/vendor/oras.land/oras-go/v2/internal/fs/tarfs/tarfs.go b/vendor/oras.land/oras-go/v2/internal/fs/tarfs/tarfs.go
@@ -22,6 +22,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 
 	"oras.land/oras-go/v2/errdef"
@@ -67,7 +68,7 @@ func New(path string) (*TarFS, error) {
 // ValidPath(name), returning a *PathError with Err set to
 // ErrInvalid or ErrNotExist.
 func (tfs *TarFS) Open(name string) (file fs.File, openErr error) {
-	entry, err := tfs.getEntry(name)
+	entry, err := tfs.getEntry("open", name)
 	if err != nil {
 		return nil, err
 	}
@@ -98,26 +99,26 @@ func (tfs *TarFS) Open(name string) (file fs.File, openErr error) {
 // Stat returns a FileInfo describing the file.
 // If there is an error, it should be of type *PathError.
 func (tfs *TarFS) Stat(name string) (fs.FileInfo, error) {
-	entry, err := tfs.getEntry(name)
+	entry, err := tfs.getEntry("stat", name)
 	if err != nil {
 		return nil, err
 	}
 	return entry.header.FileInfo(), nil
 }
 
 // getEntry returns the named entry.
-func (tfs *TarFS) getEntry(name string) (*entry, error) {
-	if !fs.ValidPath(name) {
-		return nil, &fs.PathError{Path: name, Err: fs.ErrInvalid}
+func (tfs *TarFS) getEntry(operation string, path string) (*entry, error) {
+	if !fs.ValidPath(path) {
+		return nil, &fs.PathError{Op: operation, Path: path, Err: fs.ErrInvalid}
 	}
-	entry, ok := tfs.entries[name]
+	entry, ok := tfs.entries[path]
 	if !ok {
-		return nil, &fs.PathError{Path: name, Err: fs.ErrNotExist}
+		return nil, &fs.PathError{Op: operation, Path: path, Err: fs.ErrNotExist}
 	}
 	if entry.header.Typeflag != tar.TypeReg {
 		// support regular files only
 		return nil, fmt.Errorf("%s: type flag %c is not supported: %w",
-			name, entry.header.Typeflag, errdef.ErrUnsupported)
+			path, entry.header.Typeflag, errdef.ErrUnsupported)
 	}
 	return entry, nil
 }
@@ -143,12 +144,13 @@ func (tfs *TarFS) indexEntries() error {
 		if err != nil {
 			return err
 		}
-		tfs.entries[header.Name] = &entry{
+
+		name := path.Clean(header.Name)
+		tfs.entries[name] = &entry{
 			header: header,
 			pos:    pos - blockSize,
 		}
 	}
-
 	return nil
 }
 
diff --git a/vendor/oras.land/oras-go/v2/internal/resolver/memory.go b/vendor/oras.land/oras-go/v2/internal/resolver/memory.go
@@ -17,6 +17,7 @@ package resolver
 
 import (
 	"context"
+	"fmt"
 	"maps"
 	"sync"
 
@@ -48,7 +49,7 @@ func (m *Memory) Resolve(_ context.Context, reference string) (ocispec.Descripto
 
 	desc, ok := m.index[reference]
 	if !ok {
-		return ocispec.Descriptor{}, errdef.ErrNotFound
+		return ocispec.Descriptor{}, fmt.Errorf("%s: %w", reference, errdef.ErrNotFound)
 	}
 	return desc, nil
 }
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/limit.go b/vendor/oras.land/oras-go/v2/internal/syncutil/limit.go
@@ -67,18 +67,41 @@ type GoFunc[T any] func(ctx context.Context, region *LimitedRegion, t T) error
 
 // Go concurrently invokes fn on items.
 func Go[T any](ctx context.Context, limiter *semaphore.Weighted, fn GoFunc[T], items ...T) error {
+	ctx, cancel := context.WithCancelCause(ctx)
+	defer cancel(nil)
+
 	eg, egCtx := errgroup.WithContext(ctx)
 	for _, item := range items {
-		region := LimitRegion(ctx, limiter)
+		region := LimitRegion(egCtx, limiter)
 		if err := region.Start(); err != nil {
-			return err
+			cancel(err)
+			// break loop instead of returning to allow previously scheduled
+			// goroutines to finish their deferred region.End() calls
+			break
 		}
-		eg.Go(func(t T) func() error {
+
+		eg.Go(func(t T, lr *LimitedRegion) func() error {
 			return func() error {
-				defer region.End()
-				return fn(egCtx, region, t)
+				defer lr.End()
+
+				select {
+				case <-egCtx.Done():
+					// skip the task if the context is already cancelled
+					return nil
+				default:
+				}
+
+				if err := fn(egCtx, lr, t); err != nil {
+					cancel(err)
+					return err
+				}
+				return nil
 			}
-		}(item))
+		}(item, region))
+	}
+
+	if err := eg.Wait(); err != nil {
+		cancel(err)
 	}
-	return eg.Wait()
+	return context.Cause(ctx)
 }
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/limitgroup.go b/vendor/oras.land/oras-go/v2/internal/syncutil/limitgroup.go
@@ -21,7 +21,7 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-// A LimitedGroup is a collection of goroutines working on subtasks that are part of
+// LimitedGroup is a collection of goroutines working on subtasks that are part of
 // the same overall task.
 type LimitedGroup struct {
 	grp *errgroup.Group
diff --git a/vendor/oras.land/oras-go/v2/registry/reference.go b/vendor/oras.land/oras-go/v2/registry/reference.go
@@ -34,13 +34,13 @@ var (
 	//
 	// References:
 	//   - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
-	//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#pulling-manifests
+	//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.1/spec.md#pulling-manifests
 	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)
 
 	// tagRegexp checks the tag name.
 	// The docker and OCI spec have the same regular expression.
 	//
-	// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#pulling-manifests
+	// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.1/spec.md#pulling-manifests
 	tagRegexp = regexp.MustCompile(`^[\w][\w.-]{0,127}$`)
 )
 
diff --git a/vendor/oras.land/oras-go/v2/registry/registry.go b/vendor/oras.land/oras-go/v2/registry/registry.go
@@ -31,7 +31,7 @@ type Registry interface {
 	// Note: When implemented by a remote registry, the catalog API is called.
 	// However, not all registries supports pagination or conforms the
 	// specification.
-	// Reference: https://docs.docker.com/registry/spec/api/#catalog
+	// Reference: https://distribution.github.io/distribution/spec/api/#catalog
 	// See also `Repositories()` in this package.
 	Repositories(ctx context.Context, last string, fn func(repos []string) error) error
 
diff --git a/vendor/oras.land/oras-go/v2/registry/repository.go b/vendor/oras.land/oras-go/v2/registry/repository.go

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ import (`
`31`	`31`
`32`	`32`	`// ReadOnlyStorage is a read-only CAS based on file system with the OCI-Image`
`33`	`33`	`// layout.`
`34`		`-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/image-layout.md`
	`34`	`+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.1/image-layout.md`
`35`	`35`	`type ReadOnlyStorage struct {`
`36`	`36`	`fsys fs.FS`
`37`	`37`	`}`