Oras dependency collision with helm in Dev Console

[dperaza4dustbit]

/kind bug

Which area this bug is related to?

/area registry

What versions of software are you using?

github.com/devfile/registry-support/registry-library v0.0.0-20211026200306-cab748834109

Operating System:
Linux

Go Pkg Version:
github.com/devfile/registry-support/registry-library v0.0.0-20211026200306-cab748834109

Bug Summary

While upgrading Dev Console dependency on helm from 3.6.2 to 3.7.1 we started seeing issue in Dev Console back end build from the devfile backend. The issue is that helm is pulling a different oras package oras.land/oras-go v0.4.0 wile devfiles is pulling github.com/deislabs/oras v0.8.1 in this library: https://github.com/devfile/registry-support/blob/main/registry-library/library/library.go#L33. They both have different containerd dependency and hence the collision in containerd function signature. I have not found a workaround using replace directive, will continue working with Dev Console team to see if we have a temporary workaround, but the best solution moving forward is that both helm project and devfile project move forward on Dev Console with the same version or at least backward compatible versions of oras.land/oras-go. Notice that there is already a 1.0.0 version there: https://github.com/oras-project/oras-go/releases/tag/v1.0.0. HELM 3.7.1 is currently at 0.4.0

To Reproduce:
change Dev Console go.mode helm dependency from 3.6.2 to 3.7.1, then do:
go mod tidy
go mode vendor
/build-backend.sh

You will se following error:

dperaza@dperaza-mac console % ./build-backend.sh vendor/github.com/deislabs/oras/pkg/oras/push.go:55:31: not enough arguments in call to remotes.PushContent have (context.Context, remotes.Pusher, v1.Descriptor, "github.com/containerd/containerd/content".Store, nil, func(images.Handler) images.Handler) want (context.Context, remotes.Pusher, v1.Descriptor, "github.com/containerd/containerd/content".Store, *semaphore.Weighted, platforms.MatchComparer, func(images.Handler) images.Handler)

Expected behavior

Both Helm and Devfile depend on compatible versions of oras from the version referenced in Dev Condole go.mod

Any logs, error output, screenshots etc? Provide the devfile that sees this bug, if applicable.

See above in reproduce section

Additional context

No

Any workaround?
No workaround found yet

Suggestion on how to fix the bug
Change this file to use oras.land/oras-go: https://github.com/devfile/registry-support/blob/main/registry-library/library/library.go#L33
Change go.mod to use oras.land/oras-go v0.4.0: https://github.com/devfile/registry-support/blob/main/registry-library/go.mod#L7

[kim-tsao]

Assigning to @johnmcollier since he's already working on it. I'll also do some ad-hoc testing