{"id":3510077,"name":"github.com/deislabs/oras","ecosystem":"go","description":"","homepage":"https://github.com/deislabs/oras","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/deislabs/oras","keywords_array":[],"namespace":"github.com/deislabs","versions_count":47,"first_release_published_at":"2018-12-27T08:33:07.000Z","latest_release_published_at":"2026-04-18T09:21:16.000Z","latest_release_number":"v1.3.2","last_synced_at":"2026-10-11T03:29:11.381Z","created_at":"2022-04-10T21:02:36.800Z","updated_at":"2026-10-11T05:30:49.758Z","registry_url":"https://pkg.go.dev/github.com/deislabs/oras","install_command":"go get github.com/deislabs/oras","documentation_url":"https://pkg.go.dev/github.com/deislabs/oras#section-documentation","metadata":null,"repo_metadata":{"id":37369345,"uuid":"162945532","full_name":"oras-project/oras","owner":"oras-project","description":"OCI registry client - managing content like artifacts, images, packages","archived":false,"fork":false,"pushed_at":"2026-09-18T23:15:08.000Z","size":7749,"stargazers_count":2434,"open_issues_count":76,"forks_count":265,"subscribers_count":22,"default_branch":"main","last_synced_at":"2026-09-19T02:57:23.364Z","etag":null,"topics":["docker","hacktoberfest","oci","registry","storage"],"latest_commit_sha":null,"homepage":"https://oras.land","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oras-project.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS.md","copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2018-12-24T03:24:04.000Z","updated_at":"2026-09-19T01:50:46.000Z","dependencies_parsed_at":"2026-09-11T19:28:39.407Z","dependency_job_id":null,"html_url":"https://github.com/oras-project/oras","commit_stats":{"total_commits":794,"total_committers":71,"mean_commits":"11.183098591549296","dds":0.6687657430730478,"last_synced_commit":"97cb3766ad2055ddbf3cb5dd49c2725ae0b12148"},"previous_names":["deislabs/oras"],"tags_count":50,"template":false,"template_full_name":null,"purl":"pkg:github/oras-project/oras","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oras-project","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/sbom","scorecard":{"id":332757,"data":{"date":"2025-08-11","repo":{"name":"github.com/oras-project/oras","commit":"eb069c66d7c99e13e1f650efd6a072d4afbde302"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":7.5,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:33","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:34","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-ghcr.yml:25","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-snap.yml:37","Warn: no topLevel permission defined: .github/workflows/build.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/golangci-lint.yml:22","Warn: topLevel 'contents' permission set to 'write': .github/workflows/license-checker.yml:27","Warn: no topLevel permission defined: .github/workflows/release-ghcr.yml:1","Warn: no topLevel permission defined: .github/workflows/release-github.yml:1","Warn: no topLevel permission defined: .github/workflows/release-snap.yml:1","Warn: no topLevel permission defined: .github/workflows/stale.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":2,"reason":"badge detected: InProgress","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/build.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/build.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/codeql-analysis.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/codeql-analysis.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/codeql-analysis.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/codeql-analysis.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/golangci-lint.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/golangci-lint.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/golangci-lint.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/golangci-lint.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/golangci-lint.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/golangci-lint.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license-checker.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/license-checker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/license-checker.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/license-checker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/license-checker.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/license-checker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-ghcr.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-ghcr.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-ghcr.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-ghcr.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-github.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-github.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-github.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-github.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-github.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-github.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-snap.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-snap.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-snap.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-snap.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-snap.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/release-snap.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/oras-project/oras/stale.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:14","Warn: containerImage not pinned by hash: Dockerfile:23: pin your Docker image by updating docker.io/library/alpine:3.22.1 to docker.io/library/alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Warn: goCommand not pinned by hash: test/e2e/scripts/prepare.sh:37","Info:   0 out of  14 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   8 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned","Info:   0 out of   1 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Info: codeowner review is required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":8,"reason":"5 out of the last 5 releases have a total of 5 signed artifacts.","details":["Info: signed release artifact: oras_1.3.0-beta.4_checksums.txt.asc: https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.4","Info: signed release artifact: oras_1.2.3_checksums.txt.asc: https://github.com/oras-project/oras/releases/tag/v1.2.3","Info: signed release artifact: oras_1.3.0-beta.3_checksums.txt.asc: https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.3","Info: signed release artifact: oras_1.3.0-beta.2_checksums.txt.asc: https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.2","Info: signed release artifact: oras_1.2.2_checksums.txt.asc: https://github.com/oras-project/oras/releases/tag/v1.2.2","Warn: release artifact v1.3.0-beta.4 does not have provenance: https://api.github.com/repos/oras-project/oras/releases/238889294","Warn: release artifact v1.2.3 does not have provenance: https://api.github.com/repos/oras-project/oras/releases/215388292","Warn: release artifact v1.3.0-beta.3 does not have provenance: https://api.github.com/repos/oras-project/oras/releases/214702419","Warn: release artifact v1.3.0-beta.2 does not have provenance: https://api.github.com/repos/oras-project/oras/releases/202715451","Warn: release artifact v1.2.2 does not have provenance: https://api.github.com/repos/oras-project/oras/releases/191608138"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release-ghcr.yml:22"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-18T03:58:41.003Z","repository_id":37369345,"created_at":"2025-08-18T03:58:41.003Z","updated_at":"2025-08-18T03:58:41.003Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37479753,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-19T02:00:07.094Z","response_time":73,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"oras-project","name":"OCI Registry As Storage (ORAS)","uuid":"81890686","kind":"organization","description":"Tools and libraries to enable leveraging OCI registries for arbitrary artifacts","email":null,"website":"https://oras.land","location":null,"twitter":"orasproject","company":null,"icon_url":"https://avatars.githubusercontent.com/u/81890686?v=4","repositories_count":8,"last_synced_at":"2023-03-03T21:29:00.585Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/oras-project","funding_links":[],"total_stars":null,"followers":null,"following":null,"created_at":"2022-11-14T05:40:05.961Z","updated_at":"2023-03-03T21:29:00.603Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oras-project","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oras-project/repositories"},"tags":[{"name":"v1.3.4","sha":"db9e29505c3059f2b8fde34ae8cae266c5c765e9","kind":"tag","published_at":"2026-08-27T19:26:44.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.4","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.4/manifests"},{"name":"v1.3.3","sha":"210747c29c1d38732b3194878dfd8b5a6b9ad7eb","kind":"tag","published_at":"2026-07-10T18:40:53.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.3","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.3/manifests"},{"name":"untagged-82326db59e6888e8f3fd","sha":"210747c29c1d38732b3194878dfd8b5a6b9ad7eb","kind":"commit","published_at":"2026-07-10T18:27:45.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/untagged-82326db59e6888e8f3fd","html_url":"https://github.com/oras-project/oras/releases/tag/untagged-82326db59e6888e8f3fd","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@untagged-82326db59e6888e8f3fd","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/untagged-82326db59e6888e8f3fd","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/untagged-82326db59e6888e8f3fd/manifests"},{"name":"v1.3.2","sha":"fe425992fdfdf300a1cfb380bc4271b3e1a3d3db","kind":"tag","published_at":"2026-04-18T12:05:15.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.2/manifests"},{"name":"v1.3.1","sha":"e3f584fabe332396414a44b7a83d029cfa5fc201","kind":"tag","published_at":"2026-03-12T01:26:42.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"40530fe4c68e5825b868cd874bd46fc0cdd0f432","kind":"commit","published_at":"2025-09-03T08:18:05.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0/manifests"},{"name":"v1.3.0-rc.2","sha":"99b6e1ec698937a5b7e0984e747c7c61c6f2cbdd","kind":"commit","published_at":"2025-08-27T13:18:50.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-rc.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-rc.2/manifests"},{"name":"v1.3.0-rc.1","sha":"39748a41ba2fede9788f018cfb0fcb951093adf5","kind":"commit","published_at":"2025-08-25T07:09:55.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-rc.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-rc.1/manifests"},{"name":"v1.3.0-beta.4","sha":"582ae373493985fb8cda60a4306b52d4e9f70b8e","kind":"commit","published_at":"2025-08-07T08:49:24.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-beta.4","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.4/manifests"},{"name":"v1.2.3","sha":"10fb4e54ba99e8df2ec29a0f14eb12e4058bb500","kind":"commit","published_at":"2025-04-25T10:41:53.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.3","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.3/manifests"},{"name":"v1.3.0-beta.3","sha":"fce0546a012909e4d7234677f92a85b482030e39","kind":"commit","published_at":"2025-04-24T11:10:10.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-beta.3","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.3/manifests"},{"name":"v1.3.0-beta.2","sha":"87379d22f42b5132ed583587766f0a780f9bd322","kind":"commit","published_at":"2025-02-25T09:52:09.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-beta.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.2/manifests"},{"name":"v1.2.2","sha":"677529b4e7c38e3295e0883a2ee8a536e3a860f4","kind":"commit","published_at":"2024-12-17T09:51:20.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.2/manifests"},{"name":"v1.3.0-beta.1","sha":"2ca02f6f6514200366df26ba9ef6d1b311629dad","kind":"commit","published_at":"2024-12-09T08:43:19.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.3.0-beta.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.3.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.3.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.3.0-beta.1/manifests"},{"name":"v1.2.1","sha":"a0228556766b6276010d8feb937af512e8a50808","kind":"commit","published_at":"2024-12-05T08:41:54.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.1/manifests"},{"name":"v1.2.0","sha":"dcef719e208a9b226b15bc6512ad729a7dd93270","kind":"commit","published_at":"2024-05-28T07:33:43.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.0","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0/manifests"},{"name":"v1.2.0-rc.1","sha":"ed8d791300647bf5c5e4325af4e4280227640387","kind":"commit","published_at":"2024-05-14T13:42:27.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.0-rc.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0-rc.1/manifests"},{"name":"v1.2.0-beta.1","sha":"9ffdb3eec60b969d842af1a9e699202e0827fa01","kind":"commit","published_at":"2024-02-01T17:41:45.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.2.0-beta.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.2.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.2.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.2.0-beta.1/manifests"},{"name":"v1.1.0","sha":"7079c468a06fb5815c99395eb4aaf46dd459d3fa","kind":"commit","published_at":"2023-09-01T14:30:40.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.1.0","html_url":"https://github.com/oras-project/oras/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0/manifests"},{"name":"v1.1.0-rc.2","sha":"443242e41d469a911af6fa68f3338fcfb2f5f268","kind":"commit","published_at":"2023-08-24T07:17:26.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.1.0-rc.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.1.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.1.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0-rc.2/manifests"},{"name":"v1.0.1","sha":"acf147b7564f44f8637dc59937d6167e5427e612","kind":"commit","published_at":"2023-08-03T15:04:49.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.0.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.1/manifests"},{"name":"v1.1.0-rc.1","sha":"edfc253f8cc1bb71471158a55fb71fd7f723c846","kind":"commit","published_at":"2023-07-10T03:40:36.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.1.0-rc.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.1.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.1.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.1.0-rc.1/manifests"},{"name":"v1.0.0","sha":"b58e7b910ca556973d111e9bd734a71baef03db2","kind":"commit","published_at":"2023-03-17T08:36:19.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.0.0","html_url":"https://github.com/oras-project/oras/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0/manifests"},{"name":"v1.0.0-rc.2","sha":"3c5e899f6f32299080074e665ba7c44e25aa639f","kind":"commit","published_at":"2023-03-06T08:57:23.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.0.0-rc.2","html_url":"https://github.com/oras-project/oras/releases/tag/v1.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0-rc.2/manifests"},{"name":"v1.0.0-rc.1","sha":"a98931bc68a0e7a5de6c51df8e5aa09aadad3057","kind":"commit","published_at":"2023-01-31T08:30:21.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v1.0.0-rc.1","html_url":"https://github.com/oras-project/oras/releases/tag/v1.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v1.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v1.0.0-rc.1/manifests"},{"name":"v0.16.0","sha":"d606fed4be252fd6162f63548e024451c31f3864","kind":"commit","published_at":"2022-11-07T08:40:10.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.16.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.16.0/manifests"},{"name":"v0.15.1","sha":"36dc01d02c54bf410d56d5e16b597eedbe666ec6","kind":"commit","published_at":"2022-10-17T06:29:50.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.15.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.15.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.15.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.15.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.15.1/manifests"},{"name":"v0.15.0","sha":"94abaecb072d7c44bf484cb7070db2c94be2a028","kind":"commit","published_at":"2022-09-27T04:11:35.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.15.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.15.0/manifests"},{"name":"v0.14.1","sha":"a27b2d2ba151a39e29a227256ce1e2432d1e60f5","kind":"commit","published_at":"2022-09-05T08:55:21.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.14.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.14.1/manifests"},{"name":"v0.14.0","sha":"fcdc7697e7c9562d1fa1faade594dcd0088abefb","kind":"commit","published_at":"2022-08-22T08:42:02.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.14.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.14.0/manifests"},{"name":"v0.13.0","sha":"bb75f50fb5c21a59beb09ce1b632291182046632","kind":"commit","published_at":"2022-06-28T05:14:22.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.13.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.13.0/manifests"},{"name":"v0.2.1-alpha.1","sha":"58fa344544b34571012d91f523cea54bf364549b","kind":"commit","published_at":"2021-11-11T05:18:10.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.2.1-alpha.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.2.1-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.2.1-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.1-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.1-alpha.1/manifests"},{"name":"v0.2.0-alpha.1","sha":"f01d9756e9257b9ae222b297f92c81bb85d208a7","kind":"tag","published_at":"2021-09-15T00:23:23.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.2.0-alpha.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.2.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.2.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.0-alpha.1/manifests"},{"name":"v0.12.0","sha":"1e6a64e1789f5145bf669b75bebfe013100f6253","kind":"commit","published_at":"2021-06-02T01:40:09.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.12.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.12.0/manifests"},{"name":"v0.11.1","sha":"5bfe0ab04a0f6fcdc5de4294cc79fb5b2e23a9a5","kind":"commit","published_at":"2021-03-18T17:47:26.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.11.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.11.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.11.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.11.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.11.1/manifests"},{"name":"v0.11.0","sha":"ec34f5103ff1c00e83acb0e0160653bda4477a69","kind":"commit","published_at":"2021-03-16T19:40:45.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.11.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.11.0/manifests"},{"name":"v0.10.0","sha":"173c010570c48e4aa18ce186cae8cc812f8e8b6e","kind":"commit","published_at":"2021-02-04T17:08:47.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.10.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.10.0/manifests"},{"name":"v0.9.0","sha":"96cd90423303f1bb42bd043cb4c36085e6e91e8e","kind":"commit","published_at":"2021-01-22T15:26:41.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.9.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.9.0/manifests"},{"name":"v0.8.1","sha":"237ac925cb6a308a5523cc048292bb53037f6975","kind":"tag","published_at":"2020-02-03T20:14:29.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.8.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.8.1/manifests"},{"name":"v0.8.0","sha":"5229f7ad65cfe672c311283a26bd295247100d2e","kind":"tag","published_at":"2019-11-01T15:35:37.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.8.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.8.0/manifests"},{"name":"v0.7.0","sha":"7467008b2683c5eff5fb13fe91c5b17b2eec75a3","kind":"tag","published_at":"2019-08-26T12:52:10.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.7.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"b285197778e05cd348abb8ff50faf0ef7e3554a2","kind":"tag","published_at":"2019-08-09T15:04:27.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.6.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.6.0/manifests"},{"name":"v0.5.0","sha":"b3b6ce7eeb31a5c0d891d33f585c84ae3dcc9046","kind":"tag","published_at":"2019-05-10T16:35:47.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.5.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.5.0/manifests"},{"name":"v0.4.0","sha":"9f7669048990b0d0c186985737e6a6c3bb3f7ecc","kind":"tag","published_at":"2019-04-19T17:44:32.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.4.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.4.0/manifests"},{"name":"v0.3.3","sha":"e8a1fa6ff9a507b99eedd45745959e8c5b826d9f","kind":"tag","published_at":"2019-01-25T21:08:16.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.3.3","html_url":"https://github.com/oras-project/oras/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.3/manifests"},{"name":"v0.3.2","sha":"147c927dcfcff79566766d569863b5a7da8245ad","kind":"tag","published_at":"2019-01-10T06:56:58.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.3.2","html_url":"https://github.com/oras-project/oras/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.2/manifests"},{"name":"v0.3.1","sha":"0e921ccfaf27d6a1c01d86d3407d7d1b93f4f57f","kind":"tag","published_at":"2019-01-09T09:13:25.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.3.1","html_url":"https://github.com/oras-project/oras/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"9499859cba37fe7358fcc7b78113b05a850f65fa","kind":"tag","published_at":"2019-01-07T04:56:32.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.3.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"3e12356bb4bc398b12106927796df65382481159","kind":"tag","published_at":"2018-12-28T10:22:26.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.2.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.2.0/manifests"},{"name":"v0.1.0","sha":"a6eaed33ac7f150fb6b18dc9d2e59e889adaca18","kind":"tag","published_at":"2018-12-27T08:35:47.000Z","download_url":"https://codeload.github.com/oras-project/oras/tar.gz/v0.1.0","html_url":"https://github.com/oras-project/oras/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/oras-project/oras@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-09-22T16:06:38.145Z","dependent_packages_count":407,"downloads":null,"downloads_period":null,"dependent_repos_count":3232,"rankings":{"downloads":null,"dependent_repos_count":0.14270651634913611,"dependent_packages_count":0.2081051141292798,"stargazers_count":2.110721776706395,"forks_count":2.429501440925149,"docker_downloads_count":0.2204251011522268,"average":1.0222919898524374},"purl":"pkg:golang/github.com/deislabs/oras","advisories":[{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1djQtNXgzOS12d2h4","url":"https://github.com/advisories/GHSA-g5v4-5x39-vwhx","title":"Zip slip directory exploit in github.com/deislabs/oras","description":"### Impact\nThe directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.\n\nA well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. \n\nPrecisely, the following users of the affected versions are impacted\n- `oras` CLI users who runs `oras pull`.\n- Go programs, which invokes `github.com/deislabs/oras/pkg/content.FileStore`.\n\n### Patches\nThe problem has been patched by the PR linked with this advisory. Users should upgrade their `oras` CLI and packages to `0.9.0`.\n\n### Workarounds\nFor `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider.\n\nFor `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.\n\n### References\n- [Zip Slip](https://github.com/snyk/zip-slip-vulnerability)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue on the [GitHub repo](https://github.com/deislabs/oras)\n* Email the [list of maintainers](https://github.com/deislabs/oras/blob/main/MAINTAINERS)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-02-15T00:32:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":["https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx","https://nvd.nist.gov/vuln/detail/CVE-2021-21272","https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e","https://github.com/deislabs/oras/releases/tag/v0.9.0","https://pkg.go.dev/github.com/deislabs/oras/pkg/oras","https://pkg.go.dev/vuln/GO-2021-0099","https://github.com/advisories/GHSA-g5v4-5x39-vwhx"],"source_kind":"github","identifiers":["GHSA-g5v4-5x39-vwhx","CVE-2021-21272"],"repository_url":"https://github.com/deislabs/oras","blast_radius":0.0,"created_at":"2022-12-21T16:13:01.408Z","updated_at":"2026-10-11T05:20:37.181Z","epss_percentage":0.01448,"epss_percentile":0.72524,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1djQtNXgzOS12d2h4","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1djQtNXgzOS12d2h4","packages":[{"ecosystem":"go","package_name":"github.com/deislabs/oras","versions":[{"first_patched_version":"0.9.0","vulnerable_version_range":"\u003c 0.9.0"}],"purl":"pkg:go/github.com%2Fdeislabs%2Foras","statistics":{"dependent_packages_count":407,"dependent_repos_count":3232,"downloads":null,"downloads_period":null},"affected_versions":["v0.1.0","v0.2.0","v0.2.0-alpha.1","v0.2.1-alpha.1","v0.3.0","v0.3.1","v0.3.2","v0.3.3","v0.4.0","v0.5.0","v0.6.0","v0.7.0","v0.8.0","v0.8.1"],"unaffected_versions":["v0.9.0","v0.10.0","v0.11.0","v0.11.1","v0.12.0","v0.13.0","v0.14.0","v0.14.1","v0.15.0","v0.15.1","v0.16.0","v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.1","v1.3.2"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1djQtNXgzOS12d2h4/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/deislabs/oras","docker_dependents_count":449,"docker_downloads_count":179357105,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/deislabs/oras","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/deislabs/oras/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-22T15:00:12.674Z","issues_count":339,"pull_requests_count":1024,"avg_time_to_close_issue":9948999.925233645,"avg_time_to_close_pull_request":983255.5627802691,"issues_closed_count":214,"pull_requests_closed_count":892,"pull_request_authors_count":62,"issue_authors_count":106,"avg_comments_per_issue":3.4306784660766962,"avg_comments_per_pull_request":1.7763671875,"merged_pull_requests_count":781,"bot_issues_count":2,"bot_pull_requests_count":274,"past_year_issues_count":26,"past_year_pull_requests_count":64,"past_year_avg_time_to_close_issue":2370285.75,"past_year_avg_time_to_close_pull_request":1104988.1956521738,"past_year_issues_closed_count":12,"past_year_pull_requests_closed_count":46,"past_year_pull_request_authors_count":23,"past_year_issue_authors_count":16,"past_year_avg_comments_per_issue":3.5,"past_year_avg_comments_per_pull_request":2.03125,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":27,"past_year_merged_pull_requests_count":42,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/oras-project%2Foras/issues","maintainers":[{"login":"TerryHowe","count":228,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/TerryHowe"},{"login":"Wwwsylvia","count":73,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Wwwsylvia"},{"login":"FeynmanZhou","count":60,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/FeynmanZhou"}],"active_maintainers":[{"login":"TerryHowe","count":20,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/TerryHowe"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fdeislabs%2Foras/codemeta","maintainers":[]}