internal/mod/modregistry: new package

Note: experimental feature.

This provides a CUE-centric interface for fetching and putting modules
to an OCI registry.

The module-uploading API splits the checking and the uploading from
one another so that the caller is free to implement more checks without
needing to duplicate the checking work, while still giving good confidence
that the basic checks have taken place.

This adds three new dependencies to go.mod; one (ociregistry) is
maintained by ourselves; the others are generally considered foundational
to the OCI ecosystem, are small (<1000 lines), stable (they're maintained
by the core OCI maintainers), and have minimal dependencies themselves:

	github.com/opencontainers/image-spec
	github.com/opencontainers/go-digest

image-spec provides the core definition of the OCI manifest struct type.
go-digest is depended on by that to provide the hashing defined by
the spec.

For #2330.

Signed-off-by: Roger Peppe <[email protected]>
Change-Id: I787085894f7191e24630bcf49775c713e593819e
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/557457
Reviewed-by: Daniel Martí <[email protected]>
Reviewed-by: Paul Jolly <[email protected]>
TryBot-Result: CUEcueckoo <[email protected]>
Unity-Result: CUE porcuepine <[email protected]>

go.mod

@@ -3,6 +3,7 @@ module cuelang.org/go
 go 1.20
 
 require (
+	cuelabs.dev/go/oci/ociregistry v0.0.0-20230802165206-d5c26bbb71e9
 	github.com/cockroachdb/apd/v3 v3.2.1
 	github.com/emicklei/proto v1.10.0
 	github.com/go-quicktest/qt v1.101.0
@@ -11,6 +12,8 @@ require (
 	github.com/google/uuid v1.2.0
 	github.com/kr/pretty v0.3.1
 	github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/opencontainers/image-spec v1.1.0-rc4
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0
 	github.com/rogpeppe/go-internal v1.11.1-0.20230926105539-32ae33786ecc
 	github.com/spf13/cobra v1.7.0

go.sum

@@ -1,3 +1,5 @@
+cuelabs.dev/go/oci/ociregistry v0.0.0-20230802165206-d5c26bbb71e9 h1:csvQm6RHCrV0KcjWiI5ZXCbmbqO9xsfVO6+lEm8Mfxc=
+cuelabs.dev/go/oci/ociregistry v0.0.0-20230802165206-d5c26bbb71e9/go.mod h1:TwQm/ek5h72Rl2KOtWOW3EsC+7mKJ05cbGojNxvRwAo=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -24,6 +26,10 @@ github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQ
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de h1:D5x39vF5KCwKQaw+OC9ZPiLVHXz3UFw2+psEX+gYcto=
 github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de/go.mod h1:kJun4WP5gFuHZgRjZUWWuH1DTxCtxbHDOIJsudS8jzY=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0-rc4 h1:oOxKUJWnFC4YGHCCMNql1x4YaDfYBTS5Y4x/Cgeo1E0=
+github.com/opencontainers/image-spec v1.1.0-rc4/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0 h1:sadMIsgmHpEOGbUs6VtHBXRR1OHevnj7hLx9ZcdNGW4=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0/go.mod h1:jgxiZysxFPM+iWKwQwPR+y+Jvo54ARd4EisXxKYpB5c=