build(deps): bump oras.land/oras-go/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 (n…

…otaryproject#488)

Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go)
from 2.0.0-rc.5 to 2.0.0-rc.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oras-project/oras-go/releases">oras.land/oras-go/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.0-rc.6</h2>
<h2>New Features</h2>
<ul>
<li>Upgrade package <a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]/content/oci"><code>content/oci</code></a>
<ul>
<li>Support creating <a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]/content/oci#ReadOnlyStore">read-only
OCI store</a> from <a
href="https://pkg.go.dev/io/fs#FS"><code>fs.FS</code></a></li>
<li>Support reading <a
href="https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md">OCI
layout</a> from tar archives
<ul>
<li>Compatible with tar archives generated by <code>docker buildx
build</code> with option <a
href="https://docs.docker.com/engine/reference/commandline/buildx_build/#output"><code>--output=type=oci</code></a></li>
</ul>
</li>
<li>Support <a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]/content/oci#Store.Resolve">resolving</a>
a digest to a descriptor</li>
<li>Support <a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]/content/oci#Store.Predecessors">discovering
predecessors</a> that are not tagged in <a
href="https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md#indexjson-file"><code>index.json</code></a></li>
</ul>
</li>
<li><a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]#Copy"><code>oras.Copy()</code></a>
supports copying images with <a
href="https://github.com/opencontainers/image-spec/blob/main/layer.md#non-distributable-layers">non-distributable</a>
/ <a
href="https://docs.docker.com/registry/spec/manifest-v2-2/#media-types">foreign</a>
layers by skipping.</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/368">#368</a>:
Range query is attempted for fetching blob from registries without range
query support</li>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/374">#374</a>:
<a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]/registry/remote#Repository.FetchReference"><code>Repository.FetchReference()</code></a>
fails when registry responds with chunked transfer encoding</li>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/383">#383</a>:
<a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]#Copy"><code>oras.Copy()</code></a>
may fail when the option <a
href="https://pkg.go.dev/oras.land/oras-go/[email protected]#CopyGraphOptions"><code>FindSuccessors</code></a>
finds successors from external sources</li>
</ul>
<h2>Other Changes</h2>
<ul>
<li><strong>BREAKING CHANGE</strong>: Change the type of
<code>Concurrency</code> options from <code>int64</code> to
<code>int</code></li>
<li>Improve code quality (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/363">#363</a>,
<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/364">#364</a>)</li>
<li>Improve the readability of GoDoc</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>doc: fix testable example name by <a
href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/365">oras-project/oras-go#365</a></li>
<li>fix: avoid copying Repository mutex state by <a
href="https://github.com/abursavich"><code>@​abursavich</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/364">oras-project/oras-go#364</a></li>
<li>fix: attempt range query only if server explicitly supports by <a
href="https://github.com/shizhMSFT"><code>@​shizhMSFT</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/369">oras-project/oras-go#369</a></li>
<li>doc: make the default options displayed next to the option type on
godoc by <a
href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/372">oras-project/oras-go#372</a></li>
<li>fix: avoid panic from releasing unacquired semaphore by <a
href="https://github.com/abursavich"><code>@​abursavich</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/363">oras-project/oras-go#363</a></li>
<li>refactor!: update the type of <code>Concurrency</code> options to
<code>int</code> by <a
href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/376">oras-project/oras-go#376</a></li>
<li>fix: allow chunked responses via HEAD request fallback by <a
href="https://github.com/AaronFriel"><code>@​AaronFriel</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/370">oras-project/oras-go#370</a></li>
<li>feat: support creating read-only OCI store from <code>fs.FS</code>
by <a href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a>
in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/367">oras-project/oras-go#367</a></li>
<li>feat: support reading OCI layout from tarballs by <a
href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/379">oras-project/oras-go#379</a></li>
<li>feat: change foreign layer error message at repository.Fetch() by <a
href="https://github.com/wangxiaoxuan273"><code>@​wangxiaoxuan273</code></a>
in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/377">oras-project/oras-go#377</a></li>
<li>feat: skip foreign layers on <code>oras.Copy</code> by <a
href="https://github.com/shizhMSFT"><code>@​shizhMSFT</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/380">oras-project/oras-go#380</a></li>
<li>fix: use proxy when copying node with successors by <a
href="https://github.com/qweeah"><code>@​qweeah</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/384">oras-project/oras-go#384</a></li>
<li>refactor: refactor OCI store to fully support
<code>Predecessors()</code> and <code>Resolve()</code> by <a
href="https://github.com/Wwwsylvia"><code>@​Wwwsylvia</code></a> in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/385">oras-project/oras-go#385</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/abursavich"><code>@​abursavich</code></a> made
their first contribution in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/364">oras-project/oras-go#364</a></li>
<li><a
href="https://github.com/AaronFriel"><code>@​AaronFriel</code></a> made
their first contribution in <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/pull/370">oras-project/oras-go#370</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oras-project/oras-go/compare/v2.0.0-rc.5...v2.0.0-rc.6">https://github.com/oras-project/oras-go/compare/v2.0.0-rc.5...v2.0.0-rc.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oras-project/oras-go/commit/4e58192a513ea4cbda458dd696cf804b5d043dce"><code>4e58192</code></a>
refactor: refactor OCI store to fully support
<code>Predecessors()</code> and `Resolve()...</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/4b1d01612d89bb6ab4e613f7fb0ed8ccbef11d99"><code>4b1d016</code></a>
fix: use proxy when copying node with successors (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/384">#384</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/79e13bc490ffd0409ec4d6ce9d7b474c51d28865"><code>79e13bc</code></a>
feat: skip foreign layers on <code>oras.Copy</code> (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/380">#380</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/8500e54ba3ed54925db97a26c5281d699d1a5b79"><code>8500e54</code></a>
feat: change foreign layer error message at repository.Fetch() (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/377">#377</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/0382be2668cdb14b7f2a24fbad0b25e8a0596ae7"><code>0382be2</code></a>
feat: support reading OCI layout from tarballs (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/379">#379</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/04d11f9cc68bfa1b112133368b62fd45ca725976"><code>04d11f9</code></a>
feat: support creating read-only OCI store from <code>fs.FS</code> (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/367">#367</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/253d5ec980bc3a8507a32390970f47d1937fc456"><code>253d5ec</code></a>
fix: allow chunked responses via HEAD request fallback (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/370">#370</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/275b94010ff5d61284718eb78a5e67d1ca99f083"><code>275b940</code></a>
refactor!: update the type of <code>Concurrency</code> options to
<code>int</code> (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/376">#376</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/a5be49a42aed79dc98607660be6db5715e1d6069"><code>a5be49a</code></a>
fix: avoid panic from releasing unacquired semaphore (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/363">#363</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/ff0519565c10727ffbd2846b4e3d5c22a585287d"><code>ff05195</code></a>
doc: make the default options displayed next to the option type on godoc
(<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/372">#372</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/oras-project/oras-go/compare/v2.0.0-rc.5...v2.0.0-rc.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oras.land/oras-go/v2&package-manager=go_modules&previous-version=2.0.0-rc.5&new-version=2.0.0-rc.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/veraison/go-cose v1.0.0-rc.2
-	oras.land/oras-go/v2 v2.0.0-rc.5
+	oras.land/oras-go/v2 v2.0.0-rc.6
 )
 
 require (

go.sum

@@ -62,5 +62,5 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-oras.land/oras-go/v2 v2.0.0-rc.5 h1:enT2ZMNo383bH3INm1/+mw4d09AaMbqx0BMhsgEDUSg=
-oras.land/oras-go/v2 v2.0.0-rc.5/go.mod h1:YGHvWBGuqRlZgUyXUIoKsR3lcuCOb3DAtG0SEsEw1iY=
+oras.land/oras-go/v2 v2.0.0-rc.6 h1:jGWysqm8flq+X0Vj8bZ6rkASAqTab5k18Mx9hEjFc8g=
+oras.land/oras-go/v2 v2.0.0-rc.6/go.mod h1:iVExH1NxrccIxjsiq17L91WCZ4KIw6jVQyCLsZsu1gc=