feat(download): add opa_no_oci flag to build without containerd

[slonka]

xrel #6160

Why the changes in this PR are needed?

I think it's best explained in the issue - #6160

What are the changes in this PR?

This pr adds an opa_no_oci build flag to exclude containerd dependency.

Notes to assist PR review:

Look at the issue first - #6160.

Further comments:

Nothing.

[srenatus]

Skimmed it. Let's collect more input and see if an ideal solution -- removing containerd while keeping the functionality -- would be another option... 😃

[ashutosh-narkar]

As Stephan mentioned, removing the containerd dependency would be ideal. A cursory look at the OCI code makes me think we should be able to do that. @DerGut wdyt? That of course would be more involved but could be better from a maintenance pov.

The approach in this PR seems fine. I guess we could have additional such flags in the future to control functionality which does not sound ideal.

[slonka]

Hey @DerGut 👋 - would love your input on this by the end of this week. We have a release planed next week so would love to know if this could be merged by then or not.

[DerGut]

Hi @slonka and @ashutosh-narkar I'm having a look now. I try to give a response by tomorrow 👍

[DerGut]

It definitely seems possible to remove containerd as a dependency and only use functionality provided by oras.

We can use the remote.Repository type to pass it to the oras.Copy call.
Oras also provides some interfaces for authentication, there is the auth.Client that can be set on the repository.

I've played around with it a little bit but couldn't yet get all tests to pass. To integrate our authentication plugins with oras's auth interface, more in-depth understanding would be needed.

@slonka if you need to cut a release by the end of the week, I'd suggest to merge this PR first and iterate on removing containerd with a bit more time. I could see myself taking this on. @ashutosh-narkar what do you think?

[ashutosh-narkar]

Removing the containerd dep would be ideal and @DerGut if you have bandwidth to look into it that would be great! For now this change seems fine. @srenatus any other thoughts here?

[srenatus]

Let's call it out as temporary in the release notes (or omit it), though -- if the containerd dep was gone, there's no need anymore to disable the functionality; so we could revert this in the future.

[ashutosh-narkar]

@slonka can you please squash your commits and we can then get this in. Thanks!

[netlify]

✅ Deploy Preview for openpolicyagent ready!

Name	Link
🔨 Latest commit	b83341b
🔍 Latest deploy log	https://app.netlify.com/sites/openpolicyagent/deploys/64e7a423dbcad500072ef055
😎 Deploy Preview	https://deploy-preview-6159--openpolicyagent.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[slonka]

@ashutosh-narkar the tests seem to be flaky (different ones fail on the same changes) - can you re-run them?

[ashutosh-narkar]

@ashutosh-narkar the tests seem to be flaky (different ones fail on the same changes) - can you re-run them?

The test failures are not related to your changes. We're looking into it.

[slonka]

@ashutosh-narkar - last question: is it safe for us to use main branch or should we wait for this to be released?