Closed guettli closed 9 months ago
@guettli The following statement is not true.
It took some time for us to discover that oras does http by default.
Instead, oras-go
always does HTTPS request by default as the following code snippet:
The oras-go
library does HTTP request only if PlainHTTP
option is set to true
.
Additionally, it is worth noting that the HTTP/HTTPS protocol is not determined by the port but the protocol scheme. For instance,
https://myregistry.example.com:80/
goes HTTPS although the port is 80
.http://myregistry.example.com:443/
goes HTTP although the port is 443
.I'm also curious on how you discover that oras does HTTP by default. Could you share some code snippet of your project so that we can investigate to improve the overall experience of oras-go
?
@shizhMSFT sorry for the confusion. Yes, you are right. Oras uses https by default. I struggled to connect to the ghcr.io, and I thought that this would solve the issue. But this was a mistake in my test setup. I close it.
OCI-Registries can deny all authenticated requests done via http, since it is unencrypted.
It took some time for us to discover that oras does http by default.