oras push generate manifest unwanted file

[ReDemoNBR]

What happened in your environment?

When you push an artifact with an annotation containing a manifest title, it automatically generates a file with the manifest title name, even without --export-manifest <file>

For example:
annotation.json

{
  "$manifest": {
    "org.opencontainers.image.title": "My pretty title"
  }
}

Then when you push the artifact:

$ oras push --annotation-file annotation.json hi.txt:plain/text

It creates a file with the name My pretty title in the current directory with the manifest content. Even if you specify to export the manifest with a specific name using --export-manifest <file>, it will generate the My pretty title file with the manifest, along with the requested exported file. Ex:

$ oras push --annotation-file annotation.json --export-manifest foo.json hi.txt:plain/text

This will generate foo.json and My pretty title in the current directory

What did you expect to happen?

Expected command should not automatically export the manifest file with the $manifest["org.opencontainers.image.title"] without explicitly requesting to do so.

How can we reproduce it?

Generate an annotation file with $manifest and org.opencontainers.image.title specified, using annotation.json as example

{
  "$manifest": {
    "org.opencontainers.image.title": "hello world"
  }
}

Push any artifact using this annotation

$ oras push --annotation-file annotation.json hi.txt:plain/text

This should create a file in the current directory named hello world

What is the version of your ORAS CLI?

Version:        1.0.0
Go version:     go1.20.5
Git commit:     b58e7b910ca556973d111e9bd734a71baef03db2
Git tree state: clean

Using oras distributed in ArchLinux AUR: https://aur.archlinux.org/packages/oras

What is your OS environment?

Arch Linux amd64

Are you willing to submit PRs to fix it?

• Yes, I am willing to fix it.

[qweeah]

@ReDemoNBR Good catch

https://pkg.go.dev/oras.land/oras-go/v2@v2.2.0#Pack Generates the file @Wwwsylvia Should we fix this in CLI or add support in oras-go to avoid generating the file?