ORAS

ORAS (OCI Registry As Storage) is an open-source, command-line–based tool designed to store, manage, and distribute OCI-compliant artifacts using container registries without requiring container images. It enables DevOps teams to push and pull artifacts such as Helm charts, configuration files, SBOMs, security signatures, and machine learning models by leveraging existing OCI registry infrastructure.

Features of ORAS:

• Push and pull non-container OCI artifacts to and from container registries.
• Supports multiple artifact types including Helm charts, SBOMs, and configuration files.
• Works with any OCI-compliant registry such as Harbor, Docker Registry, and cloud registries.
• CLI-based execution with no web interface dependency.
• Enables artifact versioning, traceability, and reuse in CI/CD pipelines.

To check the installed version of ORAS, run the following commands:

$ cd /opt
$ sudo tar -xzf oras_1.2.2_linux_amd64.tar.gz
$ sudo mv oras /usr/local/bin/oras
$ oras version
$ which oras

Disclaimer: ORAS is open-source software distributed under applicable licenses and is provided “as is.” Users are responsible for securing registry credentials, validating artifact types, and following OCI registry and software supply chain security best practices.