Merging oras-credentials-go to oras-go

[shizhMSFT]

Introduction

As proposed by oras-project/oras-go#413, oras-credentials-go is developed for oras-go to fill the gap of being not able to login and logout. Let's recall the original concern of splitting oras-credentials-go from oras-go from the FAQ section of oras-project/oras-go#413.

Q: Why not integrate the login SDK into oras-go v2?
A: oras-go v2 is designed to be generic, vendor neutral, and stable. Having the dependency on docker CLI means the oras-go library needs to be upgraded very frequently once there is an update on docker CLI although those updates are not related to auth.

However, it is not the case anymore as we have completely removed the dependencies on the docker go module since v0.2.0. Meanwhile, the oras-credentials-go is backward and forward compatible with the docker config files used by various docker CLI versions.

During the development and integration with various CLIs, we found the following drawbacks of splitting the oras-go SDK into two repositories.

1. Increased maintenance cost: Having two repositories means two sets of maintainers, settings, pipelines, etc.. It becomes harder to maintain.
2. Dependency on specific versions of oras-go: Surprisingly, it was unseen that oras-credentials-go depends on oras-go v2 and thus becomes a downstream project of oras-go. It becomes a problem if there is a version update in oras-go, especially when it upgrades to oras-go v3. If a single version of oras-credentials-go wants to support two major versions of oras-go, then it will have two dependencies, and thus burdens oras-go users. If we want to have multiple versions of oras-credentias-go to support multiple versions of oras-go, it further increases the maintenance cost.
3. Lower visibility: It is harder to discover the oras-credentials-go project from the oras-go project. No one will use it if no one knows it.

Proposal

It will improve the situation if we merge oras-credentials-go back to oras-go when oras-credentials-go reaches a fairly stable version like v1.0.0-rc.1 so that we can

1. Reduce maintenance cost
2. Include credentials package in oras-go as an incremental feature with no dependency penalty
3. Higher visibility as a package in oras-go

The oras-credentials-go package can be put at oras.land/oras-go/v2/registry/remote/credentials and / or github.com/oras-project/oras-go/v2/registry/remote/credentials.

Once the oras-credentials-go package is merged to oras-go, we can archive the oras-credentials-go repository. Since we will encourage developers to use the credentials package under oras-go, we will not release a stable version like v1.0.0 for github.com/oras-project/oras-credentials-go.

References

• SDK for `oras login` oras-go#413
• Proposal: Create a new oras-credentials-go repository community#24
• Remove dependency on docker CLI oras#414

/cc @Wwwsylvia @TerryHowe @sabre1041 @FeynmanZhou @wangxiaoxuan273 @sajayantony @qweeah for discussions

[TerryHowe]

SGTM

[Wwwsylvia]

This makes sense. LGTM.

[FeynmanZhou]

SGTM.