Migrate oras Go libraries to libs-go/

[jdolitsky]

Commit history has been maintained, and all references to "deislabs" or "oras" removed.

See this discussion for more info: oras-project/oras#181

[SteveLasker]

The raises the question of whether ORAS should be both a set of reference libraries and a CLI.
See; Discussion: ORAS to split go-libraries and ORAS binary, with a 3rd Ref Implementation #181

I think the big question you're asking is: can we close on a good place to host ORAS as it's had good adoption, needs an official LF type home. OCI or CNCF? We've previously discussed the value of it being in OCI.

[jdolitsky]

I think the big question you're asking is: can we close on a good place to host ORAS as it's had good adoption, needs an official LF type home. OCI or CNCF? We've previously discussed the value of it being in OCI.

Ya.

This an attempt to move the ball. I can also open the equivalent PR at a different location as well.

Seeing as it builds heavily on containerd and distribution, might be more appropriate in CNCF-land. Perhaps tools in OCI should be pure to spec, vs. pulling in code established prior to spec finalization(s).

[caniszczyk]

re: ORAS + CNCF... it's a fairly simple lift and may make more sense than OCI tbh

The next sandbox project review will be next month in March, all you need to do for ORAS is to apply here and ensure you meet the minimum bar around having a code of conduct, rough roadmap etc https://docs.google.com/forms/d/1bJhG1MuM981uQXcnBMv4Mj9yfV5_q5Kwk3qhBCLa_5A/edit

[samuelkarp]

Given that we've previously discussed accepting ORAS into OCI without reaching consensus, I'm 👎 on this PR. If you're looking to contribute ORAS to OCI, the appropriate path would be to reopen the discussion with the TOB.

[SteveLasker]

If you're looking to contribute ORAS to OCI, the appropriate path would be to reopen the discussion with the TOB.

WIthin the TOB discussions, we did have specific action items to refactor the code, and refocus on the unique ORAS libraries and CLI. oras-project/oras#181

The question has been:

• who can take some time to do this work
• what does the refactoring look like?

Josh is making a reasonable suggestion to add directly to the Artifacts repo.

I still have this preference to submit to OCI, as it's so coupled to the distribution and artifacts specs. We've been focused on adding the next round of Artifact enhancements

Once we get more traction on the new manifest, we'll be allocating time to enhance ORAS to support the new manifest. That should be the time we can address oras-project/oras#181 and other blocking issues.

I think the question could be:
Is there a pressing issue to solve the ORAS location now?
Can we adapt as we update with Artifact enhancements

[sudo-bmitch]

I could see moving the pkg/oras folder over, but agree with the others that the rest of the CLI and other parts of the project are better off spun up as a standalone project that's donated to the CNCF rather than absorbed into the artifact spec.

[samuelkarp]

WIthin the TOB discussions, we did have specific action items to refactor the code, and refocus on the unique ORAS libraries and CLI.

That's not really my understanding. We didn't reach consensus on accepting ORAS, and those were some suggestions if we wanted to revisit in the future. There was not consensus on "if you make these changes, we'll add ORAS to OCI".

[jdolitsky]