Repository.Referrers does not properly detect the absence of the referrers API for registry.k8s.io

[ktarplee]

To reproduce

$ oras discover registry.k8s.io/sig-storage/csi-resizer:v1.8.0
Error: GET "https://accounts.google.com/v3/signin/identifier REDACTED": failed to decode response: invalid character '<' looking for beginning of value

The issue does not seem to be with in the oras CLI tool but rather the detection logic within the Repository's Referrers method to determine when a registry supports the referrers API or not. In the above example, registry.k8s.io was erroneously determined to implement the referrers API. In reality the response was a 307 that was followed to a login page for a user that was HTML and page returned a 200 so oras-go thinks that it supports the referrers API. Then when the referrers API is used, it is obvious that the JSON parser is trying to parse HTML. Not good.

So we need better detection logic for the referrers API. Having the request (made in pingReferrers) respond with a 200 is necessary but not sufficient in most cases. We could check that the content type in the response is actually an OCI index. It looks like there are lots of places withing oras-go where the Content-Type of the response is not checked to be a set of acceptable values before parsing the body. This is generally considered bad practice.

[shizhMSFT]

We could check that the content type in the response is actually an OCI index.

Good catch as the distribution-spec specifies

Upon success, the response MUST be a JSON body with an image index containing a list of descriptors. The Content-Type header MUST be set to application/vnd.oci.image.index.v1+json.

[shizhMSFT]

@Wwwsylvia This Content-Type check is introduced by opencontainers/distribution-spec#452 after distribution-spec v1.1.0-rc3.

[Wwwsylvia]

Thanks @ktarplee for catching this. Since you already have the PR, let's assign this to you.