flux push artifact to OCI registry does not sanitize version build meta information (eg. foo:v1.0.0-rc1+build-12345)

[daniel-ciaglia]

Describe the bug

OCI registries do not support build metainformation in version tags following semVer2 (https://semver.org/#spec-item-10), see also distribution/distribution#1201

Helm does a bit of sanitizing on their own at push and pull

• Adopt Helm best practice for altering build affix in versions when pushing to OCI helm/helm#10166
• https://helm.sh/docs/topics/registries/#oci-feature-deprecation-and-behavior-changes-with-v380

I open this report as flux push artefact is currently not aware of this limitations and I have to work around this by cleaning the tag myself before passing to the command ;-)

Steps to reproduce

Example using zot as local OCI registry

flux push artifact oci://localhost:5000/foo:v1.0.0-rc1+1234 --path=terraform --source="$(git config --get remote.origin.url)" --revision="$(git tag --points-at HEAD)@sha1:$(git rev-parse HEAD)"
✗ 'oci://localhost:5000/foo:v1.0.0-rc1+1234' invalid URL: could not parse reference: localhost:5000/foo:v1.0.0-rc1+1234

❯ flux push artifact 'oci://localhost:5000/foo:v1.0.0-rc1_1234' --path=terraform --source="$(git config --get remote.origin.url)" --revision="$(git tag --points-at HEAD)@sha1:$(git rev-parse HEAD)"
► pushing artifact to localhost:5000/foo:v1.0.0-rc1_1234
✔ artifact successfully pushed to localhost:5000/foo@sha256:51c9d8dc94567363d9a334873ff152a6036c461ebad3b00e5bf3d72902706362

❯ flux push artifact oci://localhost:5000/foo:v1.0.0-rc1 --path=terraform --source="$(git config --get remote.origin.url)" --revision="$(git tag --points-at HEAD)@sha1:$(git rev-parse HEAD)"
► pushing artifact to localhost:5000/foo:v1.0.0-rc1
✔ artifact successfully pushed to localhost:5000/foo@sha256:cc2ffecd2413ca457b299b5140d06940996e53d0e473f01754ec1facfaffc3a4

Expected behavior

remove the offending + and use eg. _

Screenshots and recordings

No response

OS / Distro

MacOS 14

Flux version

v2.1.1

Flux check

N/A

Git provider

No response

Container Registry provider

zot

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct