timothyswan/oras repository overview

⁠oras — RHHI rebase

oras⁠ is the canonical CLI for pushing, pulling, and copying arbitrary OCI artifacts (not just container images) to / from any OCI-compliant registry. The cosign signature ecosystem, the SBOM attestation flow, and tools like Helm's OCI mode all sit on top of ORAS. This image rebuilds oras from source on Red Hat Hardened Images⁠ so it gets the same supply-chain treatment as every other tool in the cii-tooling rebase line.

⁠Build

• Base: hi/go:latest-builder (build) → hi/core-runtime (runtime)
• Source pin: full upstream commit SHA recorded in build.yml
• Version embedding: -X oras.land/oras/internal/version.Version
• CGO disabled, -trimpath, local toolchain only

⁠Why a container alongside the host binary?

The cii-tooling project installs oras as a host release binary on the GitLab Runner (gitlab_runner_release_binaries) for build-time CI invocations. The rebased container image is for everything else:

• Disconnected ops: ad-hoc OCI artifact manipulation in the air gap, without separately mirroring a host binary
• Bulk-mirror evolution: the bulk-mirror-images.sh operator script can podman run --rm <this-image> copy ... so any host with podman can run it
• Consumer CI: any team that needs to push OCI artifacts (manifests, SBOMs, attestations) gets a signed, attested tool image

⁠Supply-chain attestations

Every image tag carries:

• cosign signature (key-only, no Rekor transparency log)
• CycloneDX SBOM attached as OCI attestation
• SLSA v0.2 provenance attached as OCI attestation

⁠Verify

cosign verify --key keys/internal-ci.pub \
  docker.io/timothyswan/oras:v1.3.2-rhhi

cosign verify-attestation --key keys/internal-ci.pub \
  --type cyclonedx \
  docker.io/timothyswan/oras:v1.3.2-rhhi

cosign verify-attestation --key keys/internal-ci.pub \
  --type slsaprovenance \
  docker.io/timothyswan/oras:v1.3.2-rhhi

⁠Run

# Print version
podman run --rm docker.io/timothyswan/oras:v1.3.2-rhhi version

# Copy an image + its cosign signatures + SBOM/attestation referrers
podman run --rm \
  -v "$HOME/.docker:/auth:ro,Z" \
  -e DOCKER_CONFIG=/auth \
  docker.io/timothyswan/oras:v1.3.2-rhhi \
  copy -r src.example/foo:1.0 dst.example/foo:1.0

# Push a non-image OCI artifact
podman run --rm \
  -v "$PWD:/work:Z" -w /work \
  -v "$HOME/.docker:/auth:ro,Z" -e DOCKER_CONFIG=/auth \
  docker.io/timothyswan/oras:v1.3.2-rhhi \
  push registry.example/foo:1.0 \
    --artifact-type application/vnd.example.foo+yaml \
    config.yaml

⁠See also

• oras.land⁠ — upstream docs
• oras-project/oras⁠ — source
• cii-tooling cosign rebase⁠ — companion supply-chain tool with the same pattern