build(deps): bump oras.land/oras-go/v2 from 2.4.0 to 2.5.0

Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.4.0 to 2.5.0.
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Commits](oras-project/oras-go@v2.4.0...v2.5.0)

---
updated-dependencies:
- dependency-name: oras.land/oras-go/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

go.mod

@@ -39,7 +39,7 @@ require (
 	k8s.io/cli-runtime v0.29.3
 	k8s.io/client-go v0.29.3
 	k8s.io/klog/v2 v2.120.1
-	oras.land/oras-go/v2 v2.4.0
+	oras.land/oras-go/v2 v2.5.0
 	sigs.k8s.io/controller-runtime v0.17.3
 	sigs.k8s.io/controller-tools v0.14.0
 	sigs.k8s.io/mdtoc v1.3.0

go.sum

@@ -994,8 +994,8 @@ k8s.io/kube-openapi v0.0.0-20240103051144-eec4567ac022 h1:avRdiaB03v88Mfvum2S3BB
 k8s.io/kube-openapi v0.0.0-20240103051144-eec4567ac022/go.mod h1:sIV51WBTkZrlGOJMCDZDA1IaPBUDTulPpD4y7oe038k=
 k8s.io/utils v0.0.0-20240310230437-4693a0247e57 h1:gbqbevonBh57eILzModw6mrkbwM0gQBEuevE/AaBsHY=
 k8s.io/utils v0.0.0-20240310230437-4693a0247e57/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-oras.land/oras-go/v2 v2.4.0 h1:i+Wt5oCaMHu99guBD0yuBjdLvX7Lz8ukPbwXdR7uBMs=
-oras.land/oras-go/v2 v2.4.0/go.mod h1:osvtg0/ClRq1KkydMAEu/IxFieyjItcsQ4ut4PPF+f8=
+oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c=
+oras.land/oras-go/v2 v2.5.0/go.mod h1:z4eisnLP530vwIOUOJeBIj0aGI0L1C3d53atvCBqZHg=
 sigs.k8s.io/controller-runtime v0.17.3 h1:65QmN7r3FWgTxDMz9fvGnO1kbf2nu+acg9p2R9oYYYk=
 sigs.k8s.io/controller-runtime v0.17.3/go.mod h1:N0jpP5Lo7lMTF9aL56Z/B2oWBJjey6StQM0jRbKQXtY=
 sigs.k8s.io/controller-tools v0.14.0 h1:rnNoCC5wSXlrNoBKKzL70LNJKIQKEzT6lloG6/LF73A=

vendor/modules.txt

@@ -1921,8 +1921,8 @@ k8s.io/utils/pointer
 k8s.io/utils/ptr
 k8s.io/utils/strings/slices
 k8s.io/utils/trace
-# oras.land/oras-go/v2 v2.4.0
-## explicit; go 1.20
+# oras.land/oras-go/v2 v2.5.0
+## explicit; go 1.21
 oras.land/oras-go/v2
 oras.land/oras-go/v2/content
 oras.land/oras-go/v2/content/file
@@ -1940,7 +1940,6 @@ oras.land/oras-go/v2/internal/manifestutil
 oras.land/oras-go/v2/internal/platform
 oras.land/oras-go/v2/internal/registryutil
 oras.land/oras-go/v2/internal/resolver
-oras.land/oras-go/v2/internal/slices
 oras.land/oras-go/v2/internal/spec
 oras.land/oras-go/v2/internal/status
 oras.land/oras-go/v2/internal/syncutil

vendor/oras.land/oras-go/v2/README.md

@@ -20,7 +20,7 @@ The ORAS Go library follows [Semantic Versioning](https://semver.org/), where br
 The version `2` is actively developed in the [`main`](https://github.com/oras-project/oras-go/tree/main) branch with all new features.
 
 > [!Note]
-> The `main` branch follows [Go's Security Policy](https://github.com/golang/go/security/policy) and supports the two latest versions of Go (currently `1.20` and `1.21`).
+> The `main` branch follows [Go's Security Policy](https://github.com/golang/go/security/policy) and supports the two latest versions of Go (currently `1.21` and `1.22`).
 
 Examples for common use cases can be found below:
 

vendor/oras.land/oras-go/v2/content/file/file.go

@@ -283,7 +283,8 @@ func (s *Store) push(ctx context.Context, expected ocispec.Descriptor, content i
 	return nil
 }
 
-// restoreDuplicates restores successor files with same content but different names.
+// restoreDuplicates restores successor files with same content but different
+// names.
 // See Store.ForceCAS for more info.
 func (s *Store) restoreDuplicates(ctx context.Context, desc ocispec.Descriptor) error {
 	successors, err := content.Successors(ctx, s, desc)
@@ -310,8 +311,16 @@ func (s *Store) restoreDuplicates(ctx context.Context, desc ocispec.Descriptor)
 				return fmt.Errorf("%q: %s: %w", name, desc.MediaType, err)
 			}
 			return nil
-		}(); err != nil && !errors.Is(err, errdef.ErrNotFound) {
-			return err
+		}(); err != nil {
+			switch {
+			case errors.Is(err, errdef.ErrNotFound):
+				// allow pushing manifests before blobs
+			case errors.Is(err, ErrDuplicateName):
+				// in case multiple goroutines are pushing or restoring the same
+				// named content, the error is ignored
+			default:
+				return err
+			}
 		}
 	}
 	return nil

vendor/oras.land/oras-go/v2/internal/ioutil/io.go

@@ -44,15 +44,23 @@ func CopyBuffer(dst io.Writer, src io.Reader, buf []byte, desc ocispec.Descripto
 	return vr.Verify()
 }
 
-// nopCloserType is the type of `io.NopCloser()`.
-var nopCloserType = reflect.TypeOf(io.NopCloser(nil))
+// Types returned by `io.NopCloser()`.
+var (
+	nopCloserType         = reflect.TypeOf(io.NopCloser(nil))
+	nopCloserWriterToType = reflect.TypeOf(io.NopCloser(struct {
+		io.Reader
+		io.WriterTo
+	}{}))
+)
 
 // UnwrapNopCloser unwraps the reader wrapped by `io.NopCloser()`.
 // Similar implementation can be found in the built-in package `net/http`.
-// Reference: https://github.com/golang/go/blob/go1.17.6/src/net/http/transfer.go#L423-L425
-func UnwrapNopCloser(rc io.Reader) io.Reader {
-	if reflect.TypeOf(rc) == nopCloserType {
-		return reflect.ValueOf(rc).Field(0).Interface().(io.Reader)
+// Reference: https://github.com/golang/go/blob/go1.22.1/src/net/http/transfer.go#L1090-L1105
+func UnwrapNopCloser(r io.Reader) io.Reader {
+	switch reflect.TypeOf(r) {
+	case nopCloserType, nopCloserWriterToType:
+		return reflect.ValueOf(r).Field(0).Interface().(io.Reader)
+	default:
+		return r
 	}
-	return rc
 }

vendor/oras.land/oras-go/v2/internal/resolver/memory.go

@@ -17,6 +17,7 @@ package resolver
 
 import (
 	"context"
+	"maps"
 	"sync"
 
 	"github.com/opencontainers/go-digest"
@@ -90,11 +91,7 @@ func (m *Memory) Map() map[string]ocispec.Descriptor {
 	m.lock.RLock()
 	defer m.lock.RUnlock()
 
-	res := make(map[string]ocispec.Descriptor, len(m.index))
-	for key, value := range m.index {
-		res[key] = value
-	}
-	return res
+	return maps.Clone(m.index)
 }
 
 // TagSet returns the set of tags of the descriptor.
@@ -103,9 +100,5 @@ func (m *Memory) TagSet(desc ocispec.Descriptor) set.Set[string] {
 	defer m.lock.RUnlock()
 
 	tagSet := m.tags[desc.Digest]
-	res := make(set.Set[string], len(tagSet))
-	for tag := range tagSet {
-		res.Add(tag)
-	}
-	return res
+	return maps.Clone(tagSet)
 }

vendor/oras.land/oras-go/v2/internal/syncutil/once.go

@@ -15,10 +15,14 @@ limitations under the License.
 
 package syncutil
 
-import "context"
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+)
 
 // Once is an object that will perform exactly one action.
-// Unlike sync.Once, this Once allowes the action to have return values.
+// Unlike sync.Once, this Once allows the action to have return values.
 type Once struct {
 	result interface{}
 	err    error
@@ -68,3 +72,31 @@ func (o *Once) Do(ctx context.Context, f func() (interface{}, error)) (bool, int
 		}
 	}
 }
+
+// OnceOrRetry is an object that will perform exactly one success action.
+type OnceOrRetry struct {
+	done atomic.Bool
+	lock sync.Mutex
+}
+
+// OnceOrRetry calls the function f if and only if Do is being called for the
+// first time for this instance of Once or all previous calls to Do are failed.
+func (o *OnceOrRetry) Do(f func() error) error {
+	// fast path
+	if o.done.Load() {
+		return nil
+	}
+
+	// slow path
+	o.lock.Lock()
+	defer o.lock.Unlock()
+
+	if o.done.Load() {
+		return nil
+	}
+	if err := f(); err != nil {
+		return err
+	}
+	o.done.Store(true)
+	return nil
+}

vendor/oras.land/oras-go/v2/pack.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"maps"
 	"regexp"
 	"time"
 
@@ -53,7 +54,7 @@ var (
 	ErrInvalidDateTimeFormat = errors.New("invalid date and time format")
 
 	// ErrMissingArtifactType is returned by [PackManifest] when
-	// packManifestVersion is PackManifestVersion1_1_RC4 and artifactType is
+	// packManifestVersion is PackManifestVersion1_1 and artifactType is
 	// empty and the config media type is set to
 	// "application/vnd.oci.empty.v1+json".
 	ErrMissingArtifactType = errors.New("missing artifact type")
@@ -71,7 +72,15 @@ const (
 	// PackManifestVersion1_1_RC4 represents the OCI Image Manifest defined
 	// in image-spec v1.1.0-rc4.
 	// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc4/manifest.md
-	PackManifestVersion1_1_RC4 PackManifestVersion = 2
+	//
+	// Deprecated: This constant is deprecated and not recommended for future use.
+	// Use [PackManifestVersion1_1] instead.
+	PackManifestVersion1_1_RC4 PackManifestVersion = PackManifestVersion1_1
+
+	// PackManifestVersion1_1 represents the OCI Image Manifest defined in
+	// image-spec v1.1.0.
+	// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/manifest.md
+	PackManifestVersion1_1 PackManifestVersion = 2
 )
 
 // PackManifestOptions contains optional parameters for [PackManifest].
@@ -98,16 +107,16 @@ type PackManifestOptions struct {
 
 // mediaTypeRegexp checks the format of media types.
 // References:
-//   - https://github.com/opencontainers/image-spec/blob/v1.1.0-rc4/schema/defs-descriptor.json#L7
+//   - https://github.com/opencontainers/image-spec/blob/v1.1.0/schema/defs-descriptor.json#L7
 //   - https://datatracker.ietf.org/doc/html/rfc6838#section-4.2
 var mediaTypeRegexp = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9!#$&-^_.+]{0,126}/[A-Za-z0-9][A-Za-z0-9!#$&-^_.+]{0,126}$`)
 
 // PackManifest generates an OCI Image Manifest based on the given parameters
 // and pushes the packed manifest to a content storage using pusher. The version
 // of the manifest to be packed is determined by packManifestVersion
-// (Recommended value: PackManifestVersion1_1_RC4).
+// (Recommended value: PackManifestVersion1_1).
 //
-//   - If packManifestVersion is [PackManifestVersion1_1_RC4]:
+//   - If packManifestVersion is [PackManifestVersion1_1]:
 //     artifactType MUST NOT be empty unless opts.ConfigDescriptor is specified.
 //   - If packManifestVersion is [PackManifestVersion1_0]:
 //     if opts.ConfigDescriptor is nil, artifactType will be used as the
@@ -122,8 +131,8 @@ func PackManifest(ctx context.Context, pusher content.Pusher, packManifestVersio
 	switch packManifestVersion {
 	case PackManifestVersion1_0:
 		return packManifestV1_0(ctx, pusher, artifactType, opts)
-	case PackManifestVersion1_1_RC4:
-		return packManifestV1_1_RC4(ctx, pusher, artifactType, opts)
+	case PackManifestVersion1_1:
+		return packManifestV1_1(ctx, pusher, artifactType, opts)
 	default:
 		return ocispec.Descriptor{}, fmt.Errorf("PackManifestVersion(%v): %w", packManifestVersion, errdef.ErrUnsupported)
 	}
@@ -283,9 +292,9 @@ func packManifestV1_1_RC2(ctx context.Context, pusher content.Pusher, configMedi
 	return pushManifest(ctx, pusher, manifest, manifest.MediaType, manifest.Config.MediaType, manifest.Annotations)
 }
 
-// packManifestV1_1_RC4 packs an image manifest defined in image-spec v1.1.0-rc4.
-// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc4/manifest.md#guidelines-for-artifact-usage
-func packManifestV1_1_RC4(ctx context.Context, pusher content.Pusher, artifactType string, opts PackManifestOptions) (ocispec.Descriptor, error) {
+// packManifestV1_1 packs an image manifest defined in image-spec v1.1.0.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0/manifest.md#guidelines-for-artifact-usage
+func packManifestV1_1(ctx context.Context, pusher content.Pusher, artifactType string, opts PackManifestOptions) (ocispec.Descriptor, error) {
 	if artifactType == "" && (opts.ConfigDescriptor == nil || opts.ConfigDescriptor.MediaType == ocispec.MediaTypeEmptyJSON) {
 		// artifactType MUST be set when config.mediaType is set to the empty value
 		return ocispec.Descriptor{}, ErrMissingArtifactType
@@ -412,9 +421,8 @@ func ensureAnnotationCreated(annotations map[string]string, annotationCreatedKey
 
 	// copy the original annotation map
 	copied := make(map[string]string, len(annotations)+1)
-	for k, v := range annotations {
-		copied[k] = v
-	}
+	maps.Copy(copied, annotations)
+
 	// set creation time in RFC 3339 format
 	// reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/annotations.md#pre-defined-annotation-keys
 	now := time.Now().UTC()

vendor/oras.land/oras-go/v2/registry/reference.go

@@ -34,13 +34,13 @@ var (
 	//
 	// References:
 	//   - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
-	//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#pulling-manifests
+	//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#pulling-manifests
 	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)
 
 	// tagRegexp checks the tag name.
 	// The docker and OCI spec have the same regular expression.
 	//
-	// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#pulling-manifests
+	// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#pulling-manifests
 	tagRegexp = regexp.MustCompile(`^[\w][\w.-]{0,127}$`)
 )
 
@@ -192,7 +192,7 @@ func (r Reference) Validate() error {
 
 // ValidateRegistry validates the registry.
 func (r Reference) ValidateRegistry() error {
-	if uri, err := url.ParseRequestURI("dummy://" + r.Registry); err != nil || uri.Host != r.Registry {
+	if uri, err := url.ParseRequestURI("dummy://" + r.Registry); err != nil || uri.Host == "" || uri.Host != r.Registry {
 		return fmt.Errorf("%w: invalid registry %q", errdef.ErrInvalidReference, r.Registry)
 	}
 	return nil

vendor/oras.land/oras-go/v2/registry/remote/auth/scope.go

@@ -17,10 +17,9 @@ package auth
 
 import (
 	"context"
-	"sort"
+	"slices"
 	"strings"
 
-	"oras.land/oras-go/v2/internal/slices"
 	"oras.land/oras-go/v2/registry"
 )
 
@@ -276,14 +275,14 @@ func CleanScopes(scopes []string) []string {
 				}
 				actions = append(actions, action)
 			}
-			sort.Strings(actions)
+			slices.Sort(actions)
 			scope := resourceType + ":" + resourceName + ":" + strings.Join(actions, ",")
 			result = append(result, scope)
 		}
 	}
 
 	// sort and return
-	sort.Strings(result)
+	slices.Sort(result)
 	return result
 }
 
@@ -302,7 +301,7 @@ func cleanActions(actions []string) []string {
 	}
 
 	// slow path
-	sort.Strings(actions)
+	slices.Sort(actions)
 	n := 0
 	for i := 0; i < len(actions); i++ {
 		if actions[i] == "*" {

vendor/oras.land/oras-go/v2/registry/remote/errcode/errors.go

@@ -24,7 +24,7 @@ import (
 )
 
 // References:
-//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#error-codes
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#error-codes
 //   - https://docs.docker.com/registry/spec/api/#errors-2
 const (
 	ErrorCodeBlobUnknown         = "BLOB_UNKNOWN"
@@ -45,7 +45,7 @@ const (
 // Error represents a response inner error returned by the remote
 // registry.
 // References:
-//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#error-codes
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#error-codes
 //   - https://docs.docker.com/registry/spec/api/#errors-2
 type Error struct {
 	Code    string `json:"code"`
@@ -73,7 +73,7 @@ func (e Error) Error() string {
 // Errors represents a list of response inner errors returned by the remote
 // server.
 // References:
-//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc4/spec.md#error-codes
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#error-codes
 //   - https://docs.docker.com/registry/spec/api/#errors-2
 type Errors []Error