umoci

This is a fairly major update to umoci.

This update to umoci includes support for v1.1.1 of the OCI image specification. For the most part, this mostly involves supporting reading new features added to the specification (such as embedded-data descriptors and subject references used by OCI artifact images), but at the moment umoci does not yet support creating images utilising these features...

This is a fairly minor update to umoci, containing a few bugfixes for some potential issues, as well as finally removing the requirement for oci-image-tool validation. We still do not support the latest image-spec release, but decoupling for oci-image-tool is a very important first step.

Fixed

• For images with an empty index.json, umoci will no longer incorrectly set the `man...

This is a long-awaited release of umoci containing some Go API breaking changes, some new features, and many other minor changes and improvements.

Note that the Go API is still considered to be unstable, so downstream users should generally be aware that future updates may contain more breaking changes until we release umoci v1.0.0. However, the umoci CLI is considered to be stable (as it...

NOTE This release has a minor bug -- umoci --version will tell you that the version is "unknown". This was fixed in #369.

A security flaw was found in umoci, and has been fixed in this release. If umoci was used to unpack a malicious image (using either umoci unpack or umoci raw unpack) that contained a symlink entry for /., umoci would apply subsequent layers to the target of...

umoci has been adopted by the Open Container Initative as a reference implementation of the OCI Image Specification. This will have little impact on the roadmap or scope of umoci, but it does further solidify umoci as a useful piece of "boring container infrastructure" that can be used to build larger systems.

NOTICE: As part of the adoption procedure, the import path and module na...