feat: replace Crane usage for Image pull and Push with ORAS

.editorconfig

@@ -16,3 +16,6 @@ indent_size = 4
 
 [*.md]
 trim_trailing_whitespace = false
+
+[src/internal/packager/images/testdata/**/*.json]
+insert_final_newline = false

.gitattributes

@@ -6,3 +6,4 @@
 *.zst binary
 *.tar binary
 *.part00* binary
+*/blobs/sha256/* binary

.github/workflows/test-package-create.yml

@@ -32,8 +32,10 @@ jobs:
         run: |
           set -e
 
+          # Any component tar files in a package will have the same permissions as the files included in them
+          # Therefore before building a package when example checksums need updating you must run chmod -R g-w in zarf/examples
           for f in hack/examples-checksums/*.txt
-          do 
+          do
             NAME=$(basename $f .txt)
             CHECKSUM=$(tar Oxf build/$NAME.tar.zst checksums.txt | grep -v sboms.tar)
             EXPECTED_CHECKSUM=$(cat $f | grep -v sboms.tar)

.pre-commit-config.yaml

@@ -11,7 +11,11 @@ repos:
       - id: detect-private-key
         exclude: "src/test/e2e/29_config_file_test.go"
       - id: end-of-file-fixer
-        exclude: site/src/content/docs/commands/.*
+        exclude: |
+            (?x)^(
+                src/internal/packager/images/testdata/.*|
+                site/src/content/docs/commands/.*
+            )$
       - id: fix-byte-order-marker
       - id: trailing-whitespace
         args: [--markdown-linebreak-ext=md]

Makefile

@@ -138,7 +138,7 @@ publish-init-package:
 build-examples: ## Build all of the example packages
 	@test -s $(ZARF_BIN) || $(MAKE)
 
-	@test -s ./build/zarf-package-dos-games-$(ARCH)-1.0.0.tar.zst || $(ZARF_BIN) package create examples/dos-games -o build -a $(ARCH) --confirm
+	@test -s ./build/zarf-package-dos-games-$(ARCH)-1.1.0.tar.zst || $(ZARF_BIN) package create examples/dos-games -o build -a $(ARCH) --confirm
 
 	@test -s ./build/zarf-package-manifests-$(ARCH)-0.0.1.tar.zst || $(ZARF_BIN) package create examples/manifests -o build -a $(ARCH) --confirm
 

go.mod

@@ -21,6 +21,7 @@ require (
 	github.com/derailed/k9s v0.40.5
 	github.com/distribution/distribution/v3 v3.0.0-rc.3
 	github.com/distribution/reference v0.6.0
+	github.com/docker/docker v27.5.1+incompatible
 	github.com/fairwindsops/pluto/v5 v5.21.3
 	github.com/fatih/color v1.18.0
 	github.com/fluxcd/gitkit v0.6.0
@@ -34,7 +35,6 @@ require (
 	github.com/gosuri/uitable v0.0.4
 	github.com/invopop/jsonschema v0.13.0
 	github.com/mholt/archiver/v3 v3.5.1
-	github.com/moby/moby v27.5.1+incompatible
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/phsym/console-slog v0.3.1
 	github.com/pkg/errors v0.9.1
@@ -289,7 +289,6 @@ require (
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/docker/cli v27.5.1+incompatible
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v27.5.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect

go.sum

@@ -698,8 +698,8 @@ github.com/docker/cli v27.5.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvM
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v27.5.0+incompatible h1:um++2NcQtGRTz5eEgO6aJimo6/JxrTXC941hd05JO6U=
-github.com/docker/docker v27.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.5.1+incompatible h1:4PYU5dnBYqRQi0294d1FBECqT9ECWeQAIfE8q4YnPY8=
+github.com/docker/docker v27.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -1367,8 +1367,6 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby v27.5.1+incompatible h1:/pN59F/t3U7Q4FPzV88nzqf7Fp0qqCSL2KzhZaiKcKw=
-github.com/moby/moby v27.5.1+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=

hack/examples-checksums/zarf-package-dos-games-amd64-1.1.0.txt

@@ -1,8 +1,8 @@
 0a44b759e219d9d6f3c7cbbf40c57ede71a1f9bf54da65767c4137be74727662 images/blobs/sha256/0a44b759e219d9d6f3c7cbbf40c57ede71a1f9bf54da65767c4137be74727662
+18f0797eab35a4597c1e9624aa4f15fd91f6254e5538c1e0d193b2a95dd4acc6 images/oci-layout
 4752b809555b8767401dfd39638f256c2373763a1f2cc421012301bb48481e6d images/blobs/sha256/4752b809555b8767401dfd39638f256c2373763a1f2cc421012301bb48481e6d
 49f63464352d7b53ceea3b60b9cc764c1a810b28217ee9f13ab7f974bb3ed968 components/baseline.tar
 4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 images/blobs/sha256/4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
-b66dbb27a73334db6ac9c030475837bd7f4472d835c72b2360534b203edce6cb images/oci-layout
-c7ee390ce7fc9b525429312617f5fbff5fe195544c1d95b44b72330bff15a615 images/index.json
+c6e80d396ac9585a0da48da58f8820c334308a5a2feb611d9c62a6cee2fcc1a5 images/index.json
 cc1421ef2ded4a559feaefe8dc266488d60675fcc995db7e51f0b0a6d893e010 images/blobs/sha256/cc1421ef2ded4a559feaefe8dc266488d60675fcc995db7e51f0b0a6d893e010
 e6886dc0b01f09d19480a3270fd9e7c4b261346cee9490b881b36edf21c7e722 images/blobs/sha256/e6886dc0b01f09d19480a3270fd9e7c4b261346cee9490b881b36edf21c7e722

hack/examples-checksums/zarf-package-manifests-amd64-0.0.1.txt

@@ -1,7 +1,7 @@
 0f23e58bd0b7c74311703e20c21c690a6847e62240ed456f8821f4c067d3659b images/blobs/sha256/0f23e58bd0b7c74311703e20c21c690a6847e62240ed456f8821f4c067d3659b
 12cba3a8e34081029e840e7ac5454c080835cbc5a7adc1620482e939283a3a49 images/blobs/sha256/12cba3a8e34081029e840e7ac5454c080835cbc5a7adc1620482e939283a3a49
+18f0797eab35a4597c1e9624aa4f15fd91f6254e5538c1e0d193b2a95dd4acc6 images/oci-layout
 27833a3ba0a545deda33bb01eaf95a14d05d43bf30bce9267d92d17f069fe897 images/blobs/sha256/27833a3ba0a545deda33bb01eaf95a14d05d43bf30bce9267d92d17f069fe897
-27e17b7ec145d38d0be7b5837639a1206f2f3902f7831a6060d0b897f144decd images/index.json
 295c7be079025306c4f1d65997fcf7adb411c88f139ad1d34b537164aa060369 images/blobs/sha256/295c7be079025306c4f1d65997fcf7adb411c88f139ad1d34b537164aa060369
 3a96ca29c7fb133e78765557b2bf29a257467f679c43e4153ad05bcde8a1ce3d images/blobs/sha256/3a96ca29c7fb133e78765557b2bf29a257467f679c43e4153ad05bcde8a1ce3d
 45ef08258efc940f6336384ae1f35224b5bdf89a3b7abbb5effcbb6c5d62cabe components/nginx-remote.tar
@@ -15,13 +15,13 @@
 9b61d3667e8d8d1d8f14ebb413c1ac3fe62373fd69af6aafb281b7a8733f50aa images/blobs/sha256/9b61d3667e8d8d1d8f14ebb413c1ac3fe62373fd69af6aafb281b7a8733f50aa
 ae8092b154d705e09bc77523083da3e93200a476ae3aa2b7a5e1747b1cbb8fef images/blobs/sha256/ae8092b154d705e09bc77523083da3e93200a476ae3aa2b7a5e1747b1cbb8fef
 b4cd0df67c961ba7f49c86c2e1e6e89d2fd1b8c40ad6fe59508db060dfac51fe images/blobs/sha256/b4cd0df67c961ba7f49c86c2e1e6e89d2fd1b8c40ad6fe59508db060dfac51fe
-b66dbb27a73334db6ac9c030475837bd7f4472d835c72b2360534b203edce6cb images/oci-layout
 b9c1296647242c2c9c7ffe8cc3a1b9ecde558e8748969ad6a64428ab5922769a images/blobs/sha256/b9c1296647242c2c9c7ffe8cc3a1b9ecde558e8748969ad6a64428ab5922769a
 c398742ba22c44f9bbc08dcbbdf0c978b20928fde49dceacded095bc09a46b84 images/blobs/sha256/c398742ba22c44f9bbc08dcbbdf0c978b20928fde49dceacded095bc09a46b84
 c926b61bad3b94ae7351bafd0c184c159ebf0643b085f7ef1d47ecdc7316833c images/blobs/sha256/c926b61bad3b94ae7351bafd0c184c159ebf0643b085f7ef1d47ecdc7316833c
 cadc8652ff5abccc918746eb742e7b9165a48428b2c8cc6a48eb6ce782ce5405 images/blobs/sha256/cadc8652ff5abccc918746eb742e7b9165a48428b2c8cc6a48eb6ce782ce5405
 d37d27b92cce4fb1383d5fbe32540382ea3d9662c7be3555f5a0f6a044099e1b images/blobs/sha256/d37d27b92cce4fb1383d5fbe32540382ea3d9662c7be3555f5a0f6a044099e1b
 d8173b5b3d825c1c19acf91cb66599f453187705ca9cdb4608d7be5482768cba images/blobs/sha256/d8173b5b3d825c1c19acf91cb66599f453187705ca9cdb4608d7be5482768cba
 d95fa8da986254bcd64c1251b695fe91875383dac1ed1780480fdf70f02cea3b images/blobs/sha256/d95fa8da986254bcd64c1251b695fe91875383dac1ed1780480fdf70f02cea3b
+e3fc14f021f48ae1d267da92634c53286ad04c225b76b2b4f8dfa0f31ed18654 images/index.json
 f55cf5db16c790710ce2cd7b3d4fa00db89bdeea9d516aa83a596e910de103b2 components/podinfo-kustomize.tar
 f59dcac0742ce66d707aed956c25cd0fc20d162ecaca308637197eac1cef13fc components/httpd-local.tar

hack/examples-checksums/zarf-package-variables-amd64.txt

@@ -1,11 +1,11 @@
+18f0797eab35a4597c1e9624aa4f15fd91f6254e5538c1e0d193b2a95dd4acc6 images/oci-layout
 1ff0f94a80076ab49af75159e23f062a30a75d333a8e9c021bf39669230afcfe images/blobs/sha256/1ff0f94a80076ab49af75159e23f062a30a75d333a8e9c021bf39669230afcfe
-291f5d3c8c1742164379dfd09b17eeec4f70bcb165773d65d450dec5ef94d907 images/index.json
 4b2a24be75c4766f2d20892ddb84841e3773d0e26249ee57eed530da19c07bb2 components/variables-with-nginx.tar
 557c9ede65655e5a70e4a32f1651638ea3bfb0802edd982810884602f700ba25 images/blobs/sha256/557c9ede65655e5a70e4a32f1651638ea3bfb0802edd982810884602f700ba25
 84181e80d10e844350789d3324e848cf728df4f3d0f6c978789dd489f493934a images/blobs/sha256/84181e80d10e844350789d3324e848cf728df4f3d0f6c978789dd489f493934a
+9bf5185c1fa2862aa0382ad146c6f782cc770bf0a4486830758a012b440c3add images/index.json
 a8a737eacb28af35791c2a444d8095ca3d493ba31eca78cd57a6fe3cced79154 components/variables-with-terraform.tar
 ac232364af842735579e922641ae2f67d5b8ea97df33a207c5ea05f60c63a92d images/blobs/sha256/ac232364af842735579e922641ae2f67d5b8ea97df33a207c5ea05f60c63a92d
-b66dbb27a73334db6ac9c030475837bd7f4472d835c72b2360534b203edce6cb images/oci-layout
 d4ceccbfc2696101c94fbf2149036e4ff815e4723e518721ff85105ce5aa8afc images/blobs/sha256/d4ceccbfc2696101c94fbf2149036e4ff815e4723e518721ff85105ce5aa8afc
 d776269cad101c9f8e33e2baa0a05993ed0786604d86ea525f62d5d7ae7b9540 images/blobs/sha256/d776269cad101c9f8e33e2baa0a05993ed0786604d86ea525f62d5d7ae7b9540
 e9427fcfa8642f8ddf5106f742a75eca0dbac676cf8145598623d04fa45dd74e images/blobs/sha256/e9427fcfa8642f8ddf5106f742a75eca0dbac676cf8145598623d04fa45dd74e

site/src/content/docs/commands/zarf_package.md

@@ -15,7 +15,7 @@ Zarf package commands for creating, deploying, and inspecting packages
 ```
   -h, --help                  help for package
   -k, --key string            Path to public key file for validating signed packages
-      --oci-concurrency int   Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int   Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
 ```
 
 ### Options inherited from parent commands

site/src/content/docs/commands/zarf_package_create.md

@@ -49,7 +49,7 @@ zarf package create [ DIRECTORY ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_deploy.md

@@ -44,7 +44,7 @@ zarf package deploy [ PACKAGE_SOURCE ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_inspect.md

@@ -38,7 +38,7 @@ zarf package inspect [ PACKAGE_SOURCE ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_inspect_definition.md

@@ -32,7 +32,7 @@ zarf package inspect definition [ PACKAGE_SOURCE ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_inspect_images.md

@@ -32,7 +32,7 @@ zarf package inspect images [ PACKAGE_SOURCE ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_inspect_sbom.md

@@ -33,7 +33,7 @@ zarf package inspect sbom [ PACKAGE ] [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_list.md

@@ -32,7 +32,7 @@ zarf package list [flags]
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_mirror-resources.md

@@ -72,7 +72,7 @@ $ zarf package mirror-resources <your-package.tar.zst> \
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")

site/src/content/docs/commands/zarf_package_publish.md

@@ -47,7 +47,7 @@ $ zarf package publish ./path/to/dir oci://my-registry.com/my-namespace
       --no-color                   Disable colors in output
       --no-log-file                Disable log file creation
       --no-progress                Disable fancy UI progress bars, spinners, logos, etc
-      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 3)
+      --oci-concurrency int        Number of concurrent layer operations to perform when interacting with a remote package. (default 6)
       --plain-http                 Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture.
       --tmpdir string              Specify the temporary directory to use for intermediate files
       --zarf-cache string          Specify the location of the Zarf cache directory (default "~/.zarf-cache")