What’s New in v0.4.0

ORAS .NET CLI v0.4.0 marks a major milestone in the project’s journey — all 21 commands are now fully implemented with real OCI registry operations. Previously, only 3 commands (login, logout, version) had working implementations. This release transforms the CLI from a prototype into a production-ready tool with complete parity to the Go ORAS CLI.

🎯 Full Command Implementation

All 18 previously-stub commands now have real implementations calling the official OrasProject.Oras v0.5.0 library:

Artifact Operations

  • push — Push files to a registry as an OCI artifact using Packer.PackManifestAsync and CopyAsync
  • pull — Pull artifact files from a registry (fetches manifest, downloads layers to disk)
  • attach — Attach files to an existing artifact as a referrer (signatures, SBOMs, attestations)
  • copy — Copy an artifact between registries using CopyAsync with progress tracking
  • discover — Discover referrers of a manifest (find attached signatures, SBOMs, etc.)
  • resolve — Resolve a tag to a digest (get the immutable SHA256 reference)
  • tag — Tag a manifest in the registry (add additional tags to existing artifacts)

Manifest Operations

  • manifest fetch — Fetch manifest content from a registry (supports all OCI media types)
  • manifest push — Push manifest content to a registry from a file or stdin
  • manifest delete — Delete a manifest from a registry by digest
  • manifest fetch-config — Fetch the config blob of a manifest

Blob Operations

  • blob fetch — Fetch raw blob content from a registry by digest
  • blob push — Push blob content to a registry from a file or stdin
  • blob delete — Delete a blob from a registry by digest

Repository Operations

  • repo ls — List repositories in a registry (catalog API)
  • repo tags — List all tags for a repository

Backup & Restore

  • backup — Backup artifacts to local OCI layout directory
  • restore — Restore artifacts from local OCI layout to a registry

🔐 3-Tier Authentication Waterfall

Introduced a robust RegistryService with intelligent credential resolution:

  1. Explicit credentials — Use credentials provided via --username/--password flags
  2. Stored credentials — Fall back to credentials from Docker config (~/.docker/config.json) via DockerConfigStore
  3. Anonymous access — Fall back to unauthenticated requests for public registries

This waterfall ensures maximum compatibility: explicitly passed credentials take priority, stored credentials are used when available, and public registries work seamlessly without authentication.

📊 Rich Output Models

Added 7 new AOT-compatible output models for structured JSON output:

  • PushResult — Digest, size, media type for pushed artifacts
  • PullResult — Digest, files downloaded, total size
  • AttachResult — Digest of the attached referrer artifact
  • TagResult — Target digest and new tag name
  • ListResult — Repository lists, tag lists with pagination support
  • DiscoverResult — Referrer manifests with artifact types
  • DeleteResult — Confirmation of deleted manifest/blob digest

All models use source-generated JSON serialization (JsonSerializerContext) for Native AOT compatibility and fast cold-start performance.

🧩 New Dependencies

  • Microsoft.Extensions.Caching.Memory v9.0.0 — Added for OCI registry authentication token caching, reducing redundant auth roundtrips during multi-operation workflows.

📈 Impact

Before v0.4.0:

  • ✅ 3 working commands: login, logout, version
  • ⚠️ 18 stub commands with no real functionality

After v0.4.0:

  • ✅ All 21 commands fully functional with real OCI registry operations
  • ✅ Complete Go ORAS CLI parity
  • ✅ Production-ready for artifact management workflows

Files Changed: 32 files modified, +2674 lines added, -1800 lines removed

Full Changelog

v0.3.0…v0.4.0

Upgrading

This is a non-breaking upgrade from v0.3.0. Replace the existing binary with the new v0.4.0 build—no configuration changes are required. All previously working commands (login, logout, version, TUI mode) remain fully compatible.

What’s New:

  • All 18 artifact/manifest/blob/repo commands now work with real registries
  • Use --output-format json on any command for structured output
  • Docker credential integration works automatically (no setup needed)