Prepare for v2.8.1 release

[milosgajdos]

The previous release caused a bit of a Go modules kerfuffle. Let's get this sorted in the patch release.

[codecov-commenter]

Codecov Report

Merging #3596 (3f1cba2) into release/2.8 (e4a447d) will not change coverage.
The diff coverage is n/a.

@@             Coverage Diff              @@
##           release/2.8    #3596   +/-   ##
============================================
  Coverage        58.72%   58.72%           
============================================
  Files              102      102           
  Lines             7104     7104           
============================================
  Hits              4172     4172           
  Misses            2286     2286           
  Partials           646      646           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e4a447d...3f1cba2. Read the comment docs.

[thaJeztah]

Should we include a mention something like "no changes in binary releases" ?

[milosgajdos]

Can do.

[milosgajdos]

6fa1a7d

[chrisdoherty4]

Is there any way, as part of this, we can update docs for 2.8.0+incompatible to make clear its borked? Perhaps an addendum to the 2.8.0 release notes or something?

[thaJeztah]

Is there any way, as part of this, we can update docs for 2.8.0 to make clear its borked? Perhaps an addendum to the 2.8.0 release notes or something?

An addendum could make sense (from a docs perspective) (but we should be clear it's only an issue for consumers of the Go code as dependency, and no issues with the binary itself)

As to making it easier to discover that from a go modules perspective; I know it's possible to "retract" a module (see https://go.dev/ref/mod#go-mod-file-retract), but doing so.. requires the module to be a "module" (having a go.mod, which the v2 branches do not have, and can't have).

I don't think it's possible either to add the retract to the go.mod in the main branch, because:

• the main branch is a different module (github.com/distribution/distribution vs github.com/docker/distribution) and v3 (which also makes it a different module)
• the main branch (the "new" module) has no release yet, so may not be looked at for that reason

Perhaps there's other ways to retract a module (through pkg.go.dev?) but I haven't looked into that.

[chrisdoherty4]

So if I understand the history here correctly, the project has evolved from docker/distribution to distribution/distribution where the latter begins at v3 but also supersedes the former that is v2, however v2 doesn't use modules?

I don't think its possible to retract a +incompatible because of its semantics so it might be a documentation effort only.

[chrisdoherty4]

You can file a request on pkg.go.dev to have the package removed but it doesn't mention removing a version of a package. Might be worth raising an issue anyway to see what they say.

[milosgajdos]

I'm ok with doc addendum.

I'm not sure how long it will take pkg.go.dev to follow up on our potential request and if we can actually remove a version. we can open an issue, but that shouldnt prevent us from progressing with this.

[wy65701436]

lgtm

[thaJeztah]

LGTM