ORAS project provides a way to push and pull OCI Artifacts to and from OCI Registries. We have onboarded oras CLI v1.0.0 to Snapcraft so our Ubuntu users can easily install it. But to authenticate with OCI registries, oras CLI need to access below resources which are not in the snap sandbox:
an external system-wide configuration file shared with docker and other container tools to store credentials.
external helper tool binaries to save and load credentials securely.
Due to the above two use cases, oras CLI need to be installed in a classic way so both the configuration and external binaries installed on the Ubuntu host can be correctly found.
oras belongs to account(orasproject@gmail.com) and oras-test belongs to account(qweeah@gmail.com). We use oras to build and publish public snaps and oras-test to do PoC and validate our automated workflows.
Thanks for submitting this request. According to the process for reviewing classic snaps, we require that the request fit into one of the supported categories. Could you please identify if ORAS fits within any of those categories?
Have you considered if personal-files or system-files might be able to be used to satisfy this?
Would you be able to package those binaries into the snap using stage-packages?
Could you please identify if ORAS fits within any of those categories?
Our use case fits into this one: kubernetes tools requiring arbitrary authentication agents . ORAS can be used to upload and download container images. Other K8S tools are expected to share the auth config and agents with ORAS.
Have you considered if personal-files or system-files might be able to be used to satisfy this?
Since the file path is user-specified, we need to enable ORAS snap to access(read and write) files in every folder of $HOME, as well as every system files. I am not sure if it’s doable and it’s seems better not to sandbox those config files.
Would you be able to package those binaries into the snap using stage-packages ?
No we can’t. ORAS is expected to support any binaries compliant to the authentication mechanism and it’s not possible to enumerate all the applications during build(snapcraft) time.
