oras-project / oras-go

ORAS Go library
https://oras.land
Apache License 2.0
172 stars 94 forks source link

Update example_test.go: added :443 #654

Closed guettli closed 9 months ago

guettli commented 9 months ago

OCI-Registries can deny all authenticated requests done via http, since it is unencrypted.

It took some time for us to discover that oras does http by default.

shizhMSFT commented 9 months ago

@guettli The following statement is not true.

It took some time for us to discover that oras does http by default.

Instead, oras-go always does HTTPS request by default as the following code snippet:

https://github.com/oras-project/oras-go/blob/15ee0be60ddc4a54b285044ad693fd35a9899549/registry/remote/url.go#L28-L33

The oras-go library does HTTP request only if PlainHTTP option is set to true.

Additionally, it is worth noting that the HTTP/HTTPS protocol is not determined by the port but the protocol scheme. For instance,

I'm also curious on how you discover that oras does HTTP by default. Could you share some code snippet of your project so that we can investigate to improve the overall experience of oras-go?

guettli commented 9 months ago

@shizhMSFT sorry for the confusion. Yes, you are right. Oras uses https by default. I struggled to connect to the ghcr.io, and I thought that this would solve the issue. But this was a mistake in my test setup. I close it.