oras pull fails when --config is used and there is more than one config in the reference tree

[qweeah]

What happened in your environment?

Suppose I have uses an registry that doesn't support OCI artifact, and I have a OCI Image A stored in the registry.

If I use oras attach to created a OCI image B as OCI artifact fallback in the registry, pulling B with oras pull --config config.json $REF_B will fail with Error: config.json: duplicate name.

+-----------------+         +-----------------+
|  oci image B    | subject |  oci image A    |
|    (attached)   +--------->    (pushed)     |
+-----------------+         +-----------------+

What did you expect to happen?

oras pull --config config.json $REF_B should only pull only the config of root node, in this case config of image B.

How can we reproduce it?

1. start a oss distribution

docker run -dp 5000:5000 registry

2. generate an image and push

echo image > image
echo config > image.config.json
oras push localhost:5000/test:image --config image.config.json image

3. attach an artifact and obtain DIGEST from the result

echo sbom > sbom
oras attach localhost:5000/test:image sbom --artifact-type sbom.type

4. pull the attached artifact

oras pull localhost:5000/test@${DIGEST} --config config.json

This step will fail with Error: config.json: duplicate name.

What is the version of your ORAS CLI?

Version: 0.16.0
Go version: go1.19.2
Git commit: d606fed
Git tree state: clean

What is your OS environment?

Ubuntu 20.04

Are you willing to submit PRs to fix it?

• Yes, I am willing to fix it.