feat: improve the error message if non-distributable(foreign) layer is not supported

[qweeah]

Some artifacts(e.g., Windows base images) contain layers whose distribution is restricted by license. When these images are pushed to a registry, restricted artifacts are not included.

For now, oras.Copy and oras.Fetch will fail if the target artifact contains an non-distributable(foreign) layer since the layer blob doesn't exist in the remote registry. We should

1. By default skip blob copying if a layer is non-distributable
2. Provide option to enforce copying a non-distributable layer and follows the foreign link for fetching

[toddysm]

Windows is removing the support for foreign layers and this will not be an issue going forward
Let's just improve the error message that foreign layers are not supported when somebody tries to copy image with foreign layers. I will test the experience and propose the error message improvement.

The scope of implementation for the v2.0.0-rc.6 milestone should be improvement of the error message only.

[sajayantony]

+1 on showing an error the manifest has a foreign layer and not supported - https://techcommunity.microsoft.com/t5/containers/announcing-windows-container-base-image-redistribution-rights/ba-p/3645201

There was a discussion on OCI to not fully remove URLs since RedHat might be using this -
opencontainers/image-spec#965

[qweeah]

I will test the experience and propose the error message improvement.

@toddysm Since this is implemented in oras-go and it's a SDK, you need to write golang code to test it. To save your time, you may use oras CLI to reproduce the error via below command:

oras copy docker.io/library/hello-world@sha256:314cc0309465c7be2936df274b258c843f5a49eb21f63b719d60b51564070b8f <your-reg/repo:some-tag>

To install oras CLI, follow https://oras.land/cli/.

[toddysm]

OK, the current error is

$ oras copy docker.io/library/hello-world@sha256:314cc0309465c7be2936df274b258c843f5a49eb21f63b719d60b51564070b8f tsmacrusw3testprempub.azurecr.io/windows: test

Error: sha256:5ead999142ecce15e02523c49706a633fa708374d94bb65a254e3a3c117d609b: not found

We should change the error to:

Image hello-world@sha256:314cc0309465c7be2936df274b258c843f5a49eb21f63b719d60b51564070b8f references layer sha256:5ead999142ecce15e02523c49706a633fa708374d94bb65a254e3a3c117d609b that is not present in the current registry. Images with foreign layers are not supported by the ORAS `copy` command.

[imjasonh]

There was a discussion on OCI to not fully remove URLs since RedHat might be using this - opencontainers/image-spec#965

FWIW, Red Hat chimed in and said they're not using them.

The only push-back I've heard about removing non-distributable layers from the OCI spec just yet has been from Microsoft.