Chore: need to bump oras-go to v2 to unblock k8s updates

[xavpaice]

Bug Description

(Edit: originally thought it was k8s packages driving the need, it's actually containers/image)

The version of oras-go in use (v1) is no longer in active maintenance and is incompatible with new k8s APIs. Need to update, or have oras-project/oras-go#551 fixed with an actual release rather than just a PR.

If we bump docker packages to the latest, oras-go no longer works and go vet complains.

The solution here is to use the current version of oras, v2.

Expected Behavior

we can update packages cleanly

Steps To Reproduce

Update github.com/containers/image/v5 from 5.25.0 to 5.27.0.
go mod tidy

make vet returns:

go vet -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo ./pkg/... ./cmd/... ./internal/...
# oras.land/oras-go/pkg/auth/docker
../../../../pkg/mod/oras.land/[email protected]/pkg/auth/docker/login.go:86:39: cannot use remote (variable of type *"github.com/docker/docker/registry".Service) as "github.com/docker/docker/registry".Service value in argument to c.loginWithTLS
make: *** [vet] Error 1

Additional Context

[arcolife]

@xavpaice when I upgraded to following:

	k8s.io/api v0.28.1
	k8s.io/apiextensions-apiserver v0.28.1
	k8s.io/apimachinery v0.28.1
	k8s.io/apiserver v0.28.1

..reproducing the steps brought me here:

go vet -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo ./pkg/... ./cmd/... ./internal/...
# sigs.k8s.io/kustomize/kyaml/openapi
../../../../go/pkg/mod/sigs.k8s.io/kustomize/[email protected]/openapi/openapi.go:683:33: cannot use doc (variable of type *"github.com/google/gnostic/openapiv2".Document) as *"github.com/google/gnostic-models/openapiv2".Document value in argument to swagger.FromGnostic
# k8s.io/kubectl/pkg/util/openapi
../../../../go/pkg/mod/k8s.io/[email protected]/pkg/util/openapi/openapi_getter.go:36:42: cannot use &CachedOpenAPIGetter{} (value of type *CachedOpenAPIGetter) as discovery.OpenAPISchemaInterface value in variable declaration: *CachedOpenAPIGetter does not implement discovery.OpenAPISchemaInterface (wrong type for method OpenAPISchema)
                have OpenAPISchema() (*"github.com/google/gnostic/openapiv2".Document, error)
                want OpenAPISchema() (*"github.com/google/gnostic-models/openapiv2".Document, error)
../../../../go/pkg/mod/k8s.io/[email protected]/pkg/util/openapi/openapi_getter.go:49:28: cannot use g.openAPIClient.OpenAPISchema() (value of type *"github.com/google/gnostic-models/openapiv2".Document) as *"github.com/google/gnostic/openapiv2".Document value in assignment
../../../../go/pkg/mod/k8s.io/[email protected]/pkg/util/openapi/openapi_getter.go:78:46: cannot use oapi (variable of type *"github.com/google/gnostic-models/openapiv2".Document) as *"github.com/google/gnostic/openapiv2".Document value in argument to NewOpenAPIData
../../../../go/pkg/mod/k8s.io/[email protected]/pkg/util/openapi/openapi.go:52:38: cannot use doc (variable of type *"github.com/google/gnostic/openapiv2".Document) as *"github.com/google/gnostic-models/openapiv2".Document value in argument to proto.NewOpenAPIData
make: *** [vet] Error 1

so then I proceeded to upgrade kubectl as well: k8s.io/kubectl v0.28.1 // indirect

and then make vet ran fine.

Didn't need to upgrade oras-go in the process. So unable to reproduce?

[xavpaice]

#1295 is likely blocked too - let's get that tested out

[xavpaice]

k8s.io has been updated, the errors in #1295 match this error (and many examples).

See https://github.com/helm/helm/pull/12310/files for an example of how Helm updated the dependency.

See https://github.com/oras-project/oras-go/releases/tag/v2.0.0 for some more info on what changed when they released v2.

[arcolife]

After adding/reverting a few migrations for OCI compliant pulls and the new v2 SDK (WIP #1339), I'm still getting the docker incompatibility issues because helm/helm#12310 has not yet been merged into helm (and regardless, that PR is not complete it seems as some parts of helm still use v1 in it).

# go mod graph | grep oras
helm.sh/helm/[email protected] oras.land/[email protected]

# go mod why oras.land/oras-go/v1

(main module does not need package oras.land/oras-go/v1)

# go mod why oras.land/oras-go/v2

github.com/replicatedhq/troubleshoot/pkg/oci
oras.land/oras-go/v2

Ignoring the current pull.go WIP migration errors, the build slides back into go/pkg/mod/oras.land/[email protected]/ related errors later:

# make build

# pkg/oci/pull.go:68:2: too many errors

make[1]: *** [collect] Error 1
# oras.land/oras-go/pkg/auth/docker
../../../../go/pkg/mod/oras.land/[email protected]/pkg/auth/docker/login.go:86:39: cannot use remote (variable of type *"github.com/docker/docker/registry".Service) as "github.com/docker/docker/registry".Service value in argument to c.loginWithTLS
# oras.land/oras-go/pkg/auth/docker
../../../../go/pkg/mod/oras.land/[email protected]/pkg/auth/docker/login.go:86:39: cannot use remote (variable of type *"github.com/docker/docker/registry".Service) as "github.com/docker/docker/registry".Service value in argument to c.loginWithTLS
make[1]: *** [preflight] Error 1
make[1]: *** [analyze] Error 1
make: *** [build] Error 2

Therefore, using the current helm version in troubleshoot as it is, makes v1 an indirect dependency, still leading to docker v24 incompatibility errors like this cannot use remote (variable of type. OTOH https://github.com/oras-project/oras-go/releases/tag/v1.2.3 does not contain the fix for this that went in 2 weeks ago in v1 oras-project/oras-go#527 (yet to be released, whereas v1.2.3 was released in march)

At this rate we'd have a mix of v1 and v2 if I bump this up. I'd suggest we discuss this a bit.

[xavpaice]

Thanks Archit.

Status:

• Blocked by chore(oci): migrate to ORAS Golang library v2 helm/helm#12310
• We discussed and agreed to leave the change (and the inability to update dependencies) until the Helm change is merged and released.

[arcolife]

still blocked

• internal link for last update on this work