Downgrade oras version due to ECR bug.

[jonahjon]

Signed-off-by: jonahjon [email protected]

Issue #, if available:

This is issue actively blocking pipelines.

Description of changes:

Oras 13 is not working correctly, and blocking pipeline.

Link to issue, and comment from maintainers.

As a registry client, ORAS should do the layer pushing in two step:

Try to initiate an upload process via a POST request
Do the blob upload via PUT or PATCHes
During PUT(step 2), ORAS fails to reuse the token obtained by POST(step 1) and ends in rewinding the request body.

Why it only fails for ECR:
An credential cache was introduced in oras-go v2. The cache was keyed by the scopes in the oauth challenge. An OCI-compliant format of the scope should be like repository:some-project/some-repo:pull,push. ECR returns aws and that unexpected key prevents PUT(step 2) from getting the token cached by POST(step 1).

We had a fix in oras-go and will apply the change to CLI. This issue will be fixed in upcoming ORAS release.

cc @nima

[TerryHowe]

Suggested change

	awsAuth "ecr-public" | "$ORAS_BIN" push "${REPO}:v${version}-${CODEBUILD_BUILD_NUMBER}" bundle.yaml
	awsAuth "ecr-public" | "$ORAS_BIN" push "${REPO}:v${version}-latest" bundle.yaml
	awsAuth "ecr-public"
	"$ORAS_BIN" push "${REPO}:v${version}-${CODEBUILD_BUILD_NUMBER}" bundle.yaml
	"$ORAS_BIN" push "${REPO}:v${version}-latest" bundle.yaml

[TerryHowe]

That is how it used to be. I was just wondering why you were piping the output of that to oras push. I think what you have will work fine, it is just a bit odd.

[jonahjon]

I think it's because of the changes Eric made to the common.sh it required being piped now.

[TerryHowe]

/lgtm
/approve

[TerryHowe]

That is how it used to be. I was just wondering why you were piping the output of that to oras push. I think what you have will work fine, it is just a bit odd.

[eks-distro-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jonahjon, TerryHowe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [TerryHowe,jonahjon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment