Change module name to `github.com/oras-project/oras-go/v3`

[shizhMSFT]

The oras-go is go module / library with the following go module name defined in go.mod:

oras-go/go.mod

Line 1 in e8225cb

module oras.land/oras-go/v2

Therefore, go get relies on the availability of the website oras.land. Developers and users won't be able to build their applications which invokes oras-go if there is a bad change in oras.land, which is backed by oras-www.

As a solution, it is better to rename the module name under github.com for better stability and availability. Since this is a breaking change, the change should happen for the next generation of oras-go. That is, oras-go v3. The module name will be github.com/oras-project/oras-go/v3.

Slack disucssion: https://cloud-native.slack.com/archives/CJ1KHJM5Z/p1679463144003729

[shizhMSFT]

Pros and Cons of Vanity Domain vs GitHub Path for oras-go v3

✅ Vanity Domain: oras.land/oras-go/v3

Pros

• Consistency with existing imports
  • We already use oras.land/oras, oras.land/oras-go, and oras.land/oras-go/v2.
  • Continuing this pattern avoids confusion and keeps branding uniform.
• Future-proof & decoupled from GitHub
  • Import path remains stable even if repo moves or hosting changes.
  • Common practice in large projects:
    • k8s.io/kubernetes
    • helm.sh/helm/v3
• Cleaner, brand-aligned imports
  • Example:

    import "oras.land/oras-go/v3"

• Better control over go-import and go-source
  • Enables precise source links and documentation integration.

Cons

• Operational overhead
  • Must serve correct go-import and go-source meta tags over HTTPS.
  • Requires DNS, TLS, uptime monitoring, and fast response for ?go-get=1.
• Risk of downtime
  • Vanity domain outage breaks go get and proxy resolution.

---

✅ GitHub Path: github.com/oras-project/oras-go/v3

Pros

• Zero extra infrastructure
  • Works out-of-the-box with Go tooling and proxies.
• Lower operational risk
  • No vanity domain to maintain; GitHub is highly available.

Cons

• Breaks existing pattern
  • Inconsistent with oras.land/oras-go and oras.land/oras-go/v2.
• Coupled to GitHub
  • Org/repo rename or forge migration forces import path change in future major versions.
• Less brand-centric
  • Longer and less elegant than a vanity domain.