Add ability to get the digests of repositories

[TerryHowe]

What is the version of your ORAS CLI

1.0.0

What would you like to be added?

Add the ability to list the digests for a repository similar to oras repo tags, but for digests. Also have the ability to look up a digest for a particular tag.

Why is this needed for ORAS?

Digests are immutable, so they are more secure and deterministic. Often I want to get the digest of a particular version to be used for later installations, etc.

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.

[qweeah]

This sounds good to me. Maybe we can use a flag like --descriptor to show the full descriptor in json format?
cc @FeynmanZhou for UX discuss

[shizhMSFT]

Unfortunately, there is no such an API for listing manifests of a repository in neither the docker registry v2 spec nor the OCI distribution spec.

The manifest list API is vendor specific.

• ACR supports manifest listing. Customers can also easily list manifests using az acr manifest list.
• AWS ECR supports manifest listing. Customers can also easily list manifests using aws ecr list-images.

[shizhMSFT]

This sounds good to me. Maybe we can use a flag like --descriptor to show the full descriptor in json format? cc @FeynmanZhou for UX discuss

The full command is oras manifest fetch --descriptor. We probably need a better documentation in oras.land.

[TerryHowe]

The oras manifest fetch --descriptor command does print out the digest:

{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:c551125a624189cece9135981621f3f3144564ddabe14b523507bf74c2281d9b","size":912}

The problem with this is there is no formatting option to only print the sha and I think this would be hard for a customer to discover. Most people wouldn't think of looking for this command.

[qweeah]

@TerryHowe Is digest important if no filter is applied? e.g. oras repo tags docker.io/library/alpine will print 100+ tags, should we should digest for every tag? If it is, what's the preferred format of show digest for each tag in your mind?

I am asking because if it's not, then we can gracefully showing only one digest at the end of tag lists when filter is applied, and maybe verbose mode only

[qweeah]

@TerryHowe Can you help confirm whether we can close this issue since oras 1.0.0-rc.2 is able to 1) show what digest a tag is associated to and 2) list out other tags pointing to the same digest.

E.g. In mcr.microsoft.com/dotnet/sdk, latest is pointing to a manifest with digest sha256:bd1ccc2332fc03c6df1659ed125f67f02666f9f188947a80cec4e7afd3c7f98d and 7.0, 7.0.201 are also pointing to the same manifest, we can easily get these information via running below commands:

$ oras version
Version:        1.0.0-rc.2
Go version:     go1.20.1
Git commit:     3c5e899f6f32299080074e665ba7c44e25aa639f
Git tree state: clean

$ oras repo tags mcr.microsoft.com/dotnet/sdk:latest -v
INFO[0000] [Preview] Querying tags associated to sha256:bd1ccc2332fc03c6df1659ed125f67f02666f9f188947a80cec4e7afd3c7f98d, it may take a while.
7.0
7.0.201
latest

[TerryHowe]

#907 is what I wanted for this issue