Annotations not loading

[lzap]

Hello, I have the following manifest:

$ oras manifest fetch ghcr.io/lzap/bootc-netboot-example:rhel-9.3.0-x86_64 | jq
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "artifactType": "application/vnd.unknown.artifact.v1",
  "config": {
    "mediaType": "application/vnd.oci.empty.v1+json",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "layers": [
    {
      "mediaType": "application/x-netboot-file+zstd",
      "digest": "sha256:d2c8ea44ac871211913cb4f04e92ca965f48c2b7c85d5f8b9944e917afff4da1",
      "size": 383834,
      "annotations": {
        "org.opencontainers.image.title": "shim.efi"
      }
    },
    {
      "mediaType": "application/x-netboot-file+zstd",
      "digest": "sha256:e6c3038739611511896689b5accdb5031d3c9765645547d93ccf305610db9f7d",
      "size": 543783,
      "annotations": {
        "org.opencontainers.image.title": "grubx64.efi"
      }
    },
    {
      "mediaType": "application/x-netboot-file+zstd",
      "digest": "sha256:6efd691e87ca0ae632ea71191ffceb10faffe29737f192f23bd93e66628f1727",
      "size": 13047961,
      "annotations": {
        "org.opencontainers.image.title": "vmlinuz"
      }
    },
    {
      "mediaType": "application/x-netboot-file+zstd",
      "digest": "sha256:b1dce82f733e65652dd8a8eb03734005a7efa9b5a93bcf24587ce89a1d48ca13",
      "size": 101590593,
      "annotations": {
        "org.opencontainers.image.title": "initrd.img"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.created": "2024-02-27T14:05:53Z",
    "org.pulpproject.netboot.altentrypoint": "grubx64.efi",
    "org.pulpproject.netboot.entrypoint": "shim.efi",
    "org.pulpproject.netboot.os.arch": "x86_64",
    "org.pulpproject.netboot.os.name": "rhel",
    "org.pulpproject.netboot.os.version": "9.3.0"
  }
}

I am trying to list all annotations for the manifest, but it does not work for some reason:

package main

import (
	"context"
	"fmt"

	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
	"oras.land/oras-go/v2/content"
	"oras.land/oras-go/v2/registry/remote"
	"oras.land/oras-go/v2/registry/remote/auth"
	"oras.land/oras-go/v2/registry/remote/retry"
)

func main() {
	ctx := context.Background()
	reg := "ghcr.io"
	repo, _ := remote.NewRepository(reg + "/lzap/bootc-netboot-example")

	repo.Client = &auth.Client{
		Client: retry.DefaultClient,
		Cache:  auth.NewCache(),
	}

	tag := "rhel-9.3.0-x86_64"

	desc, _ := repo.Resolve(ctx, tag)
	if desc.MediaType == ocispec.MediaTypeImageManifest {
		fmt.Printf("Found %s %s %s %s\n", tag, desc.ArtifactType, desc.MediaType, fmt.Sprintf("%v", desc.Annotations))

		ss, _ := content.Successors(ctx, repo, desc)
		for _, s := range ss {
			fmt.Printf("Successor %s %s %s %s\n", tag, s.ArtifactType, s.MediaType, fmt.Sprintf("%v", s.Annotations))
		}
	} else {
		fmt.Printf("Skip %s %s %s %s\n", tag, desc.ArtifactType, desc.MediaType, fmt.Sprintf("%v", desc.Annotations))
	}
}

The problem is that ORAS returns me plain descriptor instead of full descriptor. It does not contain any data just digest, size and media type. Therefore, I will not get annotations:

$ go run main.go 
Found rhel-9.3.0-x86_64  application/vnd.oci.image.manifest.v1+json map[]
Successor rhel-9.3.0-x86_64  application/vnd.oci.empty.v1+json map[]
Successor rhel-9.3.0-x86_64  application/x-netboot-file+zstd map[org.opencontainers.image.title:shim.efi]
Successor rhel-9.3.0-x86_64  application/x-netboot-file+zstd map[org.opencontainers.image.title:grubx64.efi]
Successor rhel-9.3.0-x86_64  application/x-netboot-file+zstd map[org.opencontainers.image.title:vmlinuz]
Successor rhel-9.3.0-x86_64  application/x-netboot-file+zstd map[org.opencontainers.image.title:initrd.img]

Here is the repo: https://github.com/lzap/bootc-netboot/pkgs/container/bootc-netboot-example/184075903?tag=rhel-9.3.0-x86_64

In the documentation, I read that tag name (not digest) must be passed in in order to get full descriptor. But this is exactly what I am passing in.

[Wwwsylvia]

Hi @lzap , Repository.Resolve is to get the plain descriptor of the tag and is not able to get the annotations.
In order to get the annotations of a manifest, you would need to fetch the manifest content (equivalent to oras manifest fetch) and manually parse it. Something like:

func main() {
	ctx := context.Background()
	reg := "ghcr.io"
	repo, _ := remote.NewRepository(reg + "/lzap/bootc-netboot-example")

	repo.Client = &auth.Client{
		Client: retry.DefaultClient,
		Cache:  auth.NewCache(),
	}

	tag := "rhel-9.3.0-x86_64"
	_, manifestBytes, err := oras.FetchBytes(ctx, repo, tag, oras.FetchBytesOptions{})
	if err != nil {
		panic(err)
	}
	var manifest struct {
		Annotations map[string]string `json:"annotations"`
	}
	if err := json.Unmarshal(manifestBytes, &manifest); err != nil {
		panic(err)
	}
	fmt.Println(manifest.Annotations)
}

Using oras.FetchBytes is a more convenient way of `pulling a manifest by its tag".

In the documentation, I read that tag name (not digest) must be passed in in order to get full descriptor. But this is exactly what I am passing in.

As of oci.ReadOnlyStore.Resolve, it is to get the descriptor listed in the index.json of an OCI Layout and is not for remote repository.