https://github.com/oras-project/oras-go
artifact container go oras registry
Score: 33.4915024298243
Last synced: 1 day ago
JSON representation
Repository metadata:
ORAS Go library
- Host: GitHub
- URL: https://github.com/oras-project/oras-go
- Owner: oras-project
- License: apache-2.0
- Created: 2021-04-28T17:24:08.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2026-10-28T13:42:58.000Z (6 days ago)
- Last Synced: 2026-10-30T11:32:00.919Z (4 days ago)
- Topics: artifact, container, go, oras, registry
- Language: Go
- Homepage: https://oras.land
- Size: 8.39 MB
- Stars: 297
- Watchers: 8
- Forks: 186
- Open Issues: 13
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: CODEOWNERS
- Security: SECURITY.md
- Agents: AGENTS.md
Owner metadata:
- Name: OCI Registry As Storage (ORAS)
- Login: oras-project
- Email:
- Kind: organization
- Description: Tools and libraries to enable leveraging OCI registries for arbitrary artifacts
- Website: https://oras.land
- Location:
- Twitter: orasproject
- Company:
- Icon url: https://avatars.githubusercontent.com/u/81890686?v=4
- Repositories: 16
- Last Synced at: 2026-10-30T11:32:35.787Z
- Profile URL: https://github.com/oras-project
GitHub Events
Total
- Create event: 137
- Delete event: 127
- Discussion event: 1
- Fork event: 17
- Issue comment event: 369
- Issues event: 133
- Pull request event: 368
- Pull request review comment event: 360
- Pull request review event: 500
- Push event: 226
- Release event: 1
- Watch event: 47
- Total: 2286
Last Year
- Create event: 53
- Delete event: 54
- Discussion event: 1
- Fork event: 5
- Issue comment event: 73
- Issues event: 45
- Pull request event: 152
- Pull request review comment event: 84
- Pull request review event: 105
- Push event: 94
- Watch event: 9
- Total: 675
Committers metadata
Last synced: 2 days ago
Total Commits: 808
Total Committers: 132
Avg Commits per committer: 6.121
Development Distribution Score (DDS): 0.868
Commits in past year: 311
Committers in past year: 72
Avg Commits per committer in past year: 4.319
Development Distribution Score (DDS) in past year: 0.82
| Name | Commits | |
|---|---|---|
| Lixia (Sylvia) Lei | l****i@m****m | 107 |
| dependabot[bot] | 4****] | 104 |
| Shiwei Zhang | s****h@m****m | 87 |
| Josh Dolitsky | j****y@g****m | 76 |
| Terry Howe | t****e@g****m | 61 |
| Xiaoxuan Wang | 1****3 | 42 |
| Rohilalala | 2****a | 21 |
| Avi Deitcher | a****i@d****t | 19 |
| Spicy Shark | 3****o | 18 |
| ctxloop | 1****p | 12 |
| Billy Zha | j****1@m****m | 10 |
| Wei Meng | w****g@m****m | 10 |
| Steve Lasker | S****r@H****m | 9 |
| MohamedAliBouhaouala | 1****a | 9 |
| Shashank RM | s****8@g****m | 9 |
| BingEdward | 1****2@q****m | 8 |
| Isaac Emmanuel | 3****c | 8 |
| Gaurav Vijay Jadhav | g****1@g****m | 7 |
| Zoey Li | 1****T | 6 |
| Grada | 6****a | 6 |
| Hrushikesh Ramilla | r****h@g****m | 5 |
| Kyle Tarplee | k****e@i****g | 5 |
| ShravanthReddy | 3****y | 5 |
| Sajay Antony | 1****y | 5 |
| Liang Hu | 3****7 | 4 |
| Loi Nguyen | v****9@g****m | 4 |
| Nima Talebi | g****b@n****u | 4 |
| srikary12 | 1****2 | 4 |
| ump45nose | 5****e | 4 |
| Aswin Sreeraj | 3****j | 3 |
| and 102 more... | ||
Issue and Pull Request metadata
Last synced: 2 days ago
Total issues: 349
Total pull requests: 975
Average time to close issues: 2 months
Average time to close pull requests: 9 days
Total issue authors: 74
Total pull request authors: 104
Average comments per issue: 2.04
Average comments per pull request: 1.52
Merged pull request: 750
Bot issues: 0
Bot pull requests: 451
Past year issues: 172
Past year pull requests: 357
Past year average time to close issues: 14 days
Past year average time to close pull requests: 9 days
Past year issue authors: 25
Past year pull request authors: 69
Past year average comments per issue: 1.06
Past year average comments per pull request: 1.49
Past year merged pull request: 269
Past year bot issues: 0
Past year bot pull requests: 68
Top Issue Authors
- TerryHowe (155)
- Wwwsylvia (69)
- shizhMSFT (26)
- qweeah (12)
- ktarplee (5)
- Skarlso (4)
- akashsinghal (3)
- FeynmanZhou (3)
- AustinAbro321 (2)
- patrickzheng200 (2)
- wangxiaoxuan273 (2)
- brandtkeller (2)
- Clockwork-Muse (2)
- softpuff (2)
- jdolitsky (1)
Top Pull Request Authors
- dependabot[bot] (451)
- TerryHowe (125)
- Wwwsylvia (97)
- wangxiaoxuan273 (38)
- Rohilalala (19)
- shizhMSFT (15)
- spicysharkco (9)
- jadhavgaurav (9)
- ctxloop (9)
- MohamedAliBouhaouala (9)
- ktarplee (8)
- shashankxrm (8)
- qweeah (7)
- 7487 (6)
- 1cbyc (6)
Top Issue Labels
- v3 (116)
- help wanted (112)
- enhancement (91)
- good first issue (79)
- bug (48)
- documentation (25)
- question (17)
- v2 (14)
- perf (12)
- before GA (12)
- stale (10)
- dependencies (9)
- experimental (6)
- testing (4)
- v1 (4)
- github_actions (2)
- keep open (2)
Top Pull Request Labels
- dependencies (453)
- go (415)
- github_actions (35)
- v3 (35)
- keep open (17)
- stale (13)
- v1 (13)
- release (4)
- question (3)
- experimental (2)
- v2 (2)
- enhancement (1)
Package metadata
- Total packages: 12
- Total downloads: unknown
- Total docker downloads: 8,575,091,962
- Total dependent packages: 1,376 (may contain duplicates)
- Total dependent repositories: 2,348 (may contain duplicates)
- Total versions: 104
- Total advisories: 7
debian-12: golang-oras-oras-go
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://packages.debian.org/bookworm/golang-oras-oras-go
- Licenses: apache-2.0
- Latest release: 1.1.1-1 (published 9 months ago)
- Last Synced: 2026-03-13T01:14:07.883Z (8 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 0.495%
- Forks count: 0.785%
- Stargazers count: 1.196%
proxy.golang.org: github.com/oras-project/oras-go/v3
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/github.com/oras-project/oras-go/v3#section-documentation
- Licenses: Apache-2.0
- Latest release: v3.0.3-dev (published 2 months ago)
- Last Synced: 2026-10-31T17:33:42.920Z (2 days ago)
- Versions: 8
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 0.976%
- Average: 1.008%
- Dependent repos count: 1.04%
proxy.golang.org: oras.land/oras-go
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/oras.land/oras-go#section-documentation
- Licenses: Apache-2.0
- Latest release: v1.2.7 (published about 1 year ago)
- Last Synced: 2026-10-31T17:33:42.919Z (2 days ago)
- Versions: 20
- Dependent Packages: 1,042
- Dependent Repositories: 2,149
- Docker Downloads: 8,532,839,177
-
Rankings:
- Docker downloads count: 0.038%
- Dependent packages count: 0.134%
- Dependent repos count: 0.177%
- Average: 1.556%
- Forks count: 3.11%
- Stargazers count: 4.323%
- Advisories:
proxy.golang.org: oras.land/oras-go/v2
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/oras.land/oras-go/v2#section-documentation
- Licenses: Apache-2.0
- Latest release: v2.7.0 (published 11 days ago)
- Last Synced: 2026-11-01T10:20:10.673Z (2 days ago)
- Versions: 23
- Dependent Packages: 327
- Dependent Repositories: 185
- Docker Downloads: 42,252,741
-
Rankings:
- Dependent repos count: 0.466%
- Docker downloads count: 0.53%
- Dependent packages count: 0.532%
- Average: 1.711%
- Forks count: 2.876%
- Stargazers count: 4.15%
-
Advisories:
- oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
- oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
- ORAS Go forwards registry credentials across registry redirects
- `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
- oras-go has file store write outside workingDir via symlink traversal
- oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
- oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
proxy.golang.org: github.com/oras-project/oras-go
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/github.com/oras-project/oras-go#section-documentation
- Licenses: MIT
- Latest release: v1.2.7 (published about 1 year ago)
- Last Synced: 2026-10-31T17:33:41.108Z (2 days ago)
- Versions: 20
- Dependent Packages: 7
- Dependent Repositories: 14
- Docker Downloads: 44
-
Rankings:
- Dependent repos count: 1.427%
- Docker downloads count: 2.033%
- Dependent packages count: 2.048%
- Average: 2.625%
- Forks count: 3.187%
- Stargazers count: 4.43%
proxy.golang.org: github.com/oras-project/oras-go/v2
ExampleAttachBlobToRemoteRepository gives an example of attaching a blob to an existing artifact in a remote repository. The blob is packed as a manifest whose subject is the existing artifact. ExampleCopyArtifactFromRepository gives an example of copying an artifact from a remote repository into memory. ExampleExtendedCopyArtifactAndReferrersFromRepository gives an example of copying an artifact along with its referrers from a remote repository into memory. ExampleExtendedCopyArtifactAndReferrersToRepository is an example of pushing an artifact and its referrer to a remote repository. ExamplePullFilesFromRemoteRepository gives an example of pulling files from a remote repository to the local file system. ExamplePullImageFromRemoteRepository gives an example of pulling an image from a remote repository to an OCI Image layout folder. ExamplePullImageUsingDockerCredentials gives an example of pulling an image from a remote repository to an OCI Image layout folder using Docker credentials. ExamplePushFilesToRemoteRepository gives an example of pushing local files to a remote repository.
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/github.com/oras-project/oras-go/v2#section-documentation
- Licenses: Apache-2.0
- Latest release: v2.7.0 (published 11 days ago)
- Last Synced: 2026-10-31T17:33:39.938Z (2 days ago)
- Versions: 23
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Forks count: 1.923%
- Stargazers count: 2.63%
- Average: 5.225%
- Dependent packages count: 6.999%
- Dependent repos count: 9.346%
proxy.golang.org: github.com/oras-project/oras-go/pkg
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://pkg.go.dev/github.com/oras-project/oras-go/pkg#section-documentation
- Licenses: MIT
- Latest release: v0.3.0 (published almost 4 years ago)
- Last Synced: 2026-10-31T17:33:33.108Z (2 days ago)
- Versions: 4
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Forks count: 2.151%
- Stargazers count: 2.892%
- Average: 5.347%
- Dependent packages count: 6.999%
- Dependent repos count: 9.346%
debian-13: golang-oras-oras-go
- Homepage: https://github.com/oras-project/oras-go
- Documentation: https://packages.debian.org/trixie/golang-oras-oras-go
- Licenses: apache-2.0
- Latest release: 2.5.0-1 (published 9 months ago)
- Last Synced: 2026-03-13T21:23:11.720Z (8 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-23.04: golang-oras-oras-go
- Homepage: https://github.com/oras-project/oras-go
- Licenses: apache-2.0
- Latest release: 1.1.1-1ubuntu1 (published 9 months ago)
- Last Synced: 2026-03-11T21:29:03.094Z (8 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-24.04: golang-oras-oras-go
- Homepage: https://github.com/oras-project/oras-go
- Licenses: apache-2.0
- Latest release: 1.1.1-1ubuntu1 (published 9 months ago)
- Last Synced: 2026-08-13T22:53:23.420Z (3 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-23.10: golang-oras-oras-go
- Homepage: https://github.com/oras-project/oras-go
- Licenses: apache-2.0
- Latest release: 1.1.1-1ubuntu1 (published 9 months ago)
- Last Synced: 2026-08-07T14:59:44.930Z (3 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Dependencies
- actions/checkout v3 composite
- actions/setup-go v3 composite
- codecov/codecov-action v3 composite
- actions/checkout v3 composite
- actions/setup-go v3 composite
- github/codeql-action/analyze v2 composite
- github/codeql-action/init v2 composite
- actions/checkout v3 composite
- apache/skywalking-eyes/dependency v0.4.0 composite
- apache/skywalking-eyes/header v0.4.0 composite
- github.com/opencontainers/go-digest v1.0.0
- github.com/opencontainers/image-spec v1.1.0-rc2
- golang.org/x/sync v0.1.0
- github.com/opencontainers/go-digest v1.0.0
- github.com/opencontainers/image-spec v1.1.0-rc2
- golang.org/x/sync v0.1.0
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-go b7ad1dad31e06c5925ef5d2fc7ad053ef454303e composite
- goreleaser/goreleaser-action f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 composite
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-go b7ad1dad31e06c5925ef5d2fc7ad053ef454303e composite
- golangci/golangci-lint-action ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a composite
- actions/stale 4391f3da665fdf50b6810c1a66712fb9ba21aa93 composite
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-go b7ad1dad31e06c5925ef5d2fc7ad053ef454303e composite
- helm/kind-action 1544676c07bb3570fcb70166beaa07c4528fd4aa composite
- github.com/BurntSushi/toml v1.6.0
- github.com/ProtonMail/go-crypto v1.5.2
- github.com/cloudflare/circl v1.6.3
- github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
- github.com/emicklei/go-restful/v3 v3.11.0
- github.com/fxamacker/cbor/v2 v2.7.0
- github.com/go-logr/logr v1.4.2
- github.com/go-openapi/jsonpointer v0.21.0
- github.com/go-openapi/jsonreference v0.20.2
- github.com/go-openapi/swag v0.23.0
- github.com/gogo/protobuf v1.3.2
- github.com/golang/protobuf v1.5.4
- github.com/google/gnostic-models v0.6.8
- github.com/google/go-cmp v0.6.0
- github.com/google/gofuzz v1.2.0
- github.com/google/uuid v1.6.0
- github.com/gorilla/websocket v1.5.3
- github.com/josharian/intern v1.0.0
- github.com/json-iterator/go v1.1.12
- github.com/mailru/easyjson v0.7.7
- github.com/moby/spdystream v0.5.1
- github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
- github.com/modern-go/reflect2 v1.0.2
- github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
- github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f
- github.com/opencontainers/go-digest v1.0.0
- github.com/opencontainers/image-spec v1.1.1
- github.com/oras-project/oras-go/v3 v3.0.0
- github.com/pkg/errors v0.9.1
- github.com/spf13/pflag v1.0.5
- github.com/x448/float16 v0.8.4
- golang.org/x/crypto v0.52.0
- golang.org/x/net v0.55.0
- golang.org/x/oauth2 v0.27.0
- golang.org/x/sync v0.24.0
- golang.org/x/sys v0.45.0
- golang.org/x/term v0.43.0
- golang.org/x/text v0.37.0
- golang.org/x/time v0.7.0
- google.golang.org/protobuf v1.35.1
- gopkg.in/evanphx/json-patch.v4 v4.12.0
- gopkg.in/inf.v0 v0.9.1
- gopkg.in/yaml.v3 v3.0.1
- k8s.io/api v0.32.3
- k8s.io/apimachinery v0.32.3
- k8s.io/client-go v0.32.3
- k8s.io/klog/v2 v2.130.1
- k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
- k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
- sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3
- sigs.k8s.io/structured-merge-diff/v4 v4.4.2
- sigs.k8s.io/yaml v1.4.0
- 113 dependencies