Proposal to Maintain oras-credentials-go Repository for Experimental Features

[Wwwsylvia]

Background

In discussion #80, it was decided to merge oras-credential-go back into oras-go. The current features of oras-credentials-go will be moved to oras-go and will be marked as deprecated in oras-credentials-go.

Proposal

We propose to maintain the oras-credentials-go repository for staging experimental features, rather than archiving it after the move.

Going forward, stable features will be maintained in oras-go. If additional features are requested, they can be developed in oras-credentials-go and considered for a move to oras-go if applicable. For example, features with multiple dependency packages may not be suitable for oras-go, but can be added and iterated in the oras-credentials-go repository without affecting the stability of oras-go.

This approach will help us ensure that oras-go remains stable and clean, while also providing a space for experimentation and innovation.

References

• Merging `oras-credentials-go` to `oras-go` #80
• Merge oras-credentials-go back oras-go#584

---

cc @shizhMSFT @TerryHowe @FeynmanZhou @wangxiaoxuan273 @sajayantony @qweeah for discussions

[shizhMSFT]

That sounds a good idea.

The oras-credential-go package to the oras-go package is more like golang.org/x packages to golang built-in packages.

[TerryHowe]

Why not just create a new repo oras-experimental?

[TerryHowe]

Sure. We could just have a directory in it for each experimental project

[shizhMSFT]

A new repo named oras-experimental sounds a good idea.

[Wwwsylvia]

How about having a dedicated repo for each sub-project that needs experimental features? Such as oras-experimental-go?

[shizhMSFT]

If that's the direction, we can rename this repo oras-credentials-go to oras-experimental-go after oras-go v2.4.0. GitHub will handle the URL redirection for us.

[FeynmanZhou]

My suggestion is that we keep maintaining the oras-credential-go repo and focus on credential management. Keep this repo simple and have a specific scope so that people can use it independently and easily contribute to this library. For example, this user only needs the credential store from the oras-credential-go repo as explained in #89.

IMO, maintaining a separate experimental repo for the entire oras-go makes the maintenance effort very high. It may also confuse users if we have overlaps in two similar repos.