Command to push a manifest to a remote registry

[qweeah]

User can use this command to push a manifest with any media type to a target registry.

The proposed commands is:

Usage:
  oras manifest push REG/REPO<:TAG|@DIGEST> PATH [flags]

Flags:
  --ca-file string               server certificate authority file for the remote registry
  -d, --debug                    debug mode
  -h, --help                     help for pushing a manifest
      --insecure                 allow connections to SSL registry without certs
  -p, --password string          registry password or identity token
      --password-stdin           read password or identity token from stdin
      --plain-http               allow insecure connections to registry without SSL check
  -u, --username string          registry username
  -v, --verbose                  verbose output

User need to make sure that successor nodes in the manifest are already pushed to the registry.

Related to #459

[yuehaoliang]

Hi team, I'm interested in resolving both this issue and #473.

[yuehaoliang]

May need suggestions for the UX.

ORAS needs to know the media type of the manifest it tries to push, yet the command mentioned above doesn't ask user to provide the media type. We can let ORAS try to parse the provided manifest file, unmarshalling json, to get the media type. However, in the future we may want to support manifests not in OCI or ORAS specs, even manifest as a YAML file. In this case, we may not be able to fetch the media type from the provided file.

Therefore, a suggestion is to add a --media-type flag to allow user to define the media type of the manifest. ORAS will first identify the media type as what is given by the flag, and if the flag is not given, then it tries to fetch it by parsing the provided manifest file. If this flag is not given and media type cannot be unmarshalled from json, it will exit with an error.

[yuehaoliang]

In addition, the ORAS client side will not check whether the manifest file provided by user is valid or supported, the checking will be done by the server (distribution/registry). If users try to push manifest with a wrong file, the server will through "invalid manifest" error.

[sajayantony]

Sounds good. If the flag is not passed then inferring the mediaType from the manifest makes sense since the OCI spec does specify that the manifest SHOULD have a mediaType.

Also requiring the user to pass this flag in makes it harder for tools to maybe download a manifest edit and upload it since they need to now also extract and pass an additional argument.

For e.g.

oras manifest pull myregistry.io/myimage:v1 ...
vim manifest.json ...
oras manifest push myregistry.io/myimage:v1