Push to github container registry missing `config` annotations

[C-Loftus]

Very well might be doing something wrong / misinterpreting the API, but when I push an OCI artifact to github container registry using this for the config descriptor

ConfigDescriptor: &ocispec.Descriptor{
			MediaType: "application/vnd.custom.config.v1+json",
			Annotations: map[string]string{
				"git-commit-hash": gitHash,
			},
		},

the media type shows up properly, but not the annotations. I expected to see an annotation for "git-commit-hash": gitHash.

"config": {
    "digest": "",
    "mediaType": "application/vnd.custom.config.v1+json",
    "size": 0
  }

The full PackManifest call is as follows. These are mainly dummy values for testing.

	desc, err := oras.PackManifest(ctx, repo, oras.PackManifestVersion1_1, "application/octet-stream", oras.PackManifestOptions{
		Layers: layers,
		ManifestAnnotations: map[string]string{
			"org.opencontainers.image.source": gitRemote,
		},
		ConfigDescriptor: &ocispec.Descriptor{
			MediaType: "application/vnd.custom.config.v1+json",
			Annotations: map[string]string{
				"sal.git-commit-hash": gitHash,
			},
		},
	})

I am using the following dependency and pushing to the standard github container registry (no special enterprise / self hosted registry)

oras.land/oras-go/v2 v2.6.1

From researching the docs it seemed like maybe Github container registry just wants all annotations in the block like this? These ManifestAnnotations definitely show up fine without issue

		ManifestAnnotations: map[string]string{
			"org.opencontainers.image.source": gitRemote,
		},

[TerryHowe]

The contract (implicit) is that when you supply your own ConfigDescriptor, you must have already pushed the config blob and filled in Digest/Size yourself. The library only pushes an empty config blob when ConfigDescriptor == nil (the else branch, pack.go:325-335). Every test in pack_test.go constructs the descriptor with content.NewDescriptorFromBytes(...) (pack_test.go:597), which is exactly the missing step.

So oras-go produces a manifest whose config has digest: "", size: 0. The annotations are written into the manifest JSON locally (they're copied by configDesc = *opts.ConfigDescriptor), but GHCR sees a config descriptor with an empty digest — an invalid/degenerate blob reference — and normalizes it, dropping the annotations. That's why the reporter sees the media type survive but the annotations vanish.

Also, per-descriptor annotations on the config are frequently stripped or ignored by registries; they aren't the OCI-blessed place to attach metadata.

[TerryHowe]

I added #1237 to error for oras-go v3, but putting that change on v2 would be a breaking change, so that won't happen.

I'm going to close this out, but feel free to reopen if I missed something.

[C-Loftus]

Sounds good thank you for that context and the additional check 👍