Description

oras attach silently drops config annotations set via --annotation $config:key=val when the --config flag is not also provided.

This is because runAttach never sets packOpts.ConfigAnnotations, so oras-go generates the default config without applying the requested annotations.

In contrast, oras push unconditionally sets:

packOpts := oras.PackManifestOptions{
    ConfigAnnotations: opts.Annotations[option.AnnotationConfig],
    ...
}

so config annotations are applied to the auto-generated config even when no --config flag is given.

Steps to reproduce

oras attach --artifact-type doc/example \
  --annotation '$config:org.example.key=value' \
  localhost:5000/hello:v1 hi.txt

Fetch the resulting manifest — the config descriptor will have no annotations, even though --annotation $config:... was specified.

Expected behavior

Config annotations should be applied to the default config descriptor, consistent with oras push behavior.

Fix

In runAttach (cmd/oras/root/attach.go), set ConfigAnnotations on packOpts unconditionally:

packOpts := oras.PackManifestOptions{
    Subject:             &subject,
    ConfigAnnotations:   opts.Annotations[option.AnnotationConfig],
    ManifestAnnotations: opts.Annotations[option.AnnotationManifest],
    Layers:              descs,
}