Support pulling all referrers from an image

[FeynmanZhou]

What is the version of your ORAS CLI

v1.1.0

What would you like to be added?

I have an image that contains some referrers like signature, SBOM, vulnerability scanning report, etc. As a user, I would like to pull all of those referrers from an image to local file system so that I can analyze them for some reasons.

oras discover ghcr.io/kyverno/test-verify-image:signed -o tree
ghcr.io/kyverno/test-verify-image@sha256:b31bfb4d0213f254d361e0079deaaebefa4f82ba7aa76ef82e90b4935ad5b105
├── application/vnd.cncf.notary.signature
│   └── sha256:7f870420d92765b42cec0f71ee8e25bf39b692f64d95d6f6607e9e6e54300265
├── vulnerability-scan
│   └── sha256:f89cb7a0748c63a674d157ca84d725ff3ac09cc2d4aee9d0ec4315e0fe92a5fd
│       └── application/vnd.cncf.notary.signature
│           └── sha256:ec45844601244aa08ac750f44def3fd48ddacb736d26b83dde9f5d8ac646c2f3
├── sbom/cyclone-dx
│   └── sha256:8cad9bd6de426683424a204697dd48b55abcd6bb6b4930ad9d8ade99ae165414
│       └── application/vnd.cncf.notary.signature
│           └── sha256:61f3e42f017b72f4277c78a7a42ff2ad8f872811324cd984830dfaeb4030c322
└── application/vnd.cyclonedx+json
    └── sha256:aa886b475b431a37baa0e803765a9212f0accece0b82a131ebafd43ea78fa1f8
        └── application/vnd.cncf.notary.signature
            ├── sha256:00c5f96577878d79b545d424884886c37e270fac5996f17330d77a01a96801eb
            └── sha256:f3dc4687f5654ea8c2bc8da4e831d22a067298e8651fb59d55565dee58e94e2d

I hope pulling all referrers could be achieved like this experience:

oras pull --referrers ghcr.io/kyverno/test-verify-image:signed

Why is this needed for ORAS?

To improve content download efficiency for users who want to pull multiple referrers with only one operation

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.

[qweeah]

@FeynmanZhou Thanks for this good idea. How about

1. Change the name to --include-referrers as we already have --include-subject
2. What the expected behavior of pulling referrers? Is it recursive?? say if we have A --subject--> B --subject--> C and we call oras pull on C, should A be pulled?