Release oras-go v1.0.0

[jdolitsky]

oras-go v0.5.0 has been validated in the Helm codebase (see helm/helm#10294)

IMO this was a primary blocker for releasing this library with a v1.0 version.

Now that we know it works, more comfortable with doing so.

cc @shizhMSFT @deitch @SteveLasker @sajayantony

[jdolitsky]

Was there anything else we wanted to add before this? Anything related to containerd removal? Discovery/referrers?

[sajayantony]

@shizhMSFT from my team has been working on this fully. I think if helm needs a stable 1.0 - we should focus on supporting it and patching as needed. For artifacts and other capabilities the focus might be a 2.0 in that case if there are breaking changes.
I think the helm community is a large enough dependency to require a supported 1.0 and also the main reason how ORAS started up.

[SteveLasker]

I largely agree with Sajay on this. We should deliver a stable build to the Helm community that has a declaration of a 1.0.
That said, stability is not just this 1.0 release, but subsequent releases. Since we've allocated @shizhMSFT fulltime on completing the work that @deitch started, I would like to understand how likely that refactoring work could converge as part of the 1.0.
The referrers API, oras artifacts support will take a bit more bake time, and are additive, so these seem like perfect candidates to wait for a 1.0+ release.

[shizhMSFT]

I agree with @sajayantony on the stability of the ORAS library. Since oras-go is being or going to be used as a fundamental building block of many products and even security products, we need to care about the maintainability. Therefore, I think the containerd removal work, which I am actively working, should be in the scope of 1.0. Otherwise, we would be overwhelmed by CVEs.

[scottrigby]

This was agreed upon in the last ORAS meeting (see meeting notes), and implemented here! https://github.com/oras-project/oras-go/releases/tag/v1.0.0

💪 🎉 🍾

[SteveLasker]

Closing as 1.0 is released