Oras dependency collision with helm 3.9 in Dev Console

[dperaza4dustbit]

/kind bug

Which area this bug is related to?

/area registry

What versions of software are you using?

github.com/devfile/registry-support/registry-library v0.0.0-20220110165901-db88e581adf8

Operating System:
Linux

Go Pkg Version:
github.com/devfile/registry-support/registry-library v0.0.0-20220110165901-db88e581adf8

Bug Summary

While upgrading Dev Console dependency on helm from 3.7.1 to 3.9.0 we started seeing issue in Dev Console back end build from the devfile backend. The issue is that helm is pulling a different oras package oras.land/oras-go v1.1.0 wile devfiles is pulling oras.land/oras-go v0.4.0 in this library: https://github.com/devfile/registry-support/blob/main/registry-library/library/library.go#L33. I have found a workaround by moving forward both devfile and helm to oras.land/oras-go v1.1.0. However, there is a braking change in devfile to to moving to new major version.

To Reproduce:
change Dev Console go.mode helm dependency from 3.7.1 to 3.9.0, then do:
go mod tidy
go mode vendor
/build-backend.sh

You will se following error:

`dperaza@dperaza-mac console % ./build-backend.sh

github.com/devfile/registry-support/registry-library/library

vendor/github.com/devfile/registry-support/registry-library/library/library.go:255:15: undefined: "oras.land/oras-go/pkg/content".NewFileStore
vendor/github.com/devfile/registry-support/registry-library/library/library.go:259:14: undefined: oras.Pull`

Expected behavior

Both Helm and Devfile depend on compatible versions of oras from the version referenced in Dev Condole go.mod

Any logs, error output, screenshots etc? Provide the devfile that sees this bug, if applicable.

See above in reproduce section

Additional context

No

Any workaround?
No workaround found yet

Suggestion on how to fix the bug
make change in https://github.com/devfile/registry-support/blob/main/registry-library/library/library.go to switch NewFileStore call with NewFile call and swith Pull call with Copy call.

[dperaza4dustbit]

this is similar compatibility issue as #708