diff --git a/.github/workflows/cluster.yaml b/.github/workflows/cluster.yaml
index 52bc42034..fc9042242 100644
--- a/.github/workflows/cluster.yaml
+++ b/.github/workflows/cluster.yaml
@@ -50,6 +50,7 @@ jobs:
           cd $GITHUB_WORKSPACE
           make binary
           make bench
+          make $PWD/hack/tools/bin/oras
 
       - name: Setup minio service
         run: |
@@ -130,6 +131,7 @@ jobs:
             skopeo --debug copy --src-tls-verify=false docker://localhost:8080/golang:1.20 oci:golang:1.20
             echo "{\"name\":\"foo\",\"value\":\"bar\"}" > config.json
             echo "hello world" > artifact.txt
+            export PATH=$PATH:$PWD/hack/tools/bin
             oras push --plain-http localhost:8080/hello-artifact:v2 \
                 --config config.json:application/vnd.acme.rocket.config.v1+json \
                     artifact.txt:text/plain -d -v
diff --git a/Makefile b/Makefile
index c43f3c00e..018907e7e 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@ COSIGN := $(TOOLSDIR)/bin/cosign
 COSIGN_VERSION := 2.2.0
 HELM := $(TOOLSDIR)/bin/helm
 ORAS := $(TOOLSDIR)/bin/oras
-ORAS_VERSION := 1.0.0-rc.1
+ORAS_VERSION := 1.2.1
 REGCLIENT := $(TOOLSDIR)/bin/regctl
 REGCLIENT_VERSION := v0.5.7
 CRICTL := $(TOOLSDIR)/bin/crictl
diff --git a/test/blackbox/garbage_collect.bats b/test/blackbox/garbage_collect.bats
index ce40eb7a1..336a4ad7c 100644
--- a/test/blackbox/garbage_collect.bats
+++ b/test/blackbox/garbage_collect.bats
@@ -106,19 +106,19 @@ function teardown_file() {
     zot_port=`cat ${BATS_FILE_TMPDIR}/zot.port`
     # attach signature to image
     echo "{\"artifact\": \"\", \"signature\": \"pat hancock\"}" > signature.json
-    run oras attach --plain-http 127.0.0.1:${zot_port}/golang:1.20 --image-spec v1.1-image --artifact-type 'signature/example' ./signature.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/golang:1.20 --artifact-type 'signature/example' ./signature.json:application/json
     [ "$status" -eq 0 ]
     # attach sbom to image
     echo "{\"version\": \"0.0.0.0\", \"artifact\": \"'127.0.0.1:${zot_port}/golang:1.20'\", \"contents\": \"good\"}" > sbom.json
-    run oras attach --plain-http 127.0.0.1:${zot_port}/golang:1.20 --image-spec v1.1-image --artifact-type 'sbom/example' ./sbom.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/golang:1.20 --artifact-type 'sbom/example' ./sbom.json:application/json
     [ "$status" -eq 0 ]
 
     # attach signature to index image
-    run oras attach --plain-http 127.0.0.1:${zot_port}/busybox:latest --image-spec v1.1-image --artifact-type 'signature/example' ./signature.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/busybox:latest --artifact-type 'signature/example' ./signature.json:application/json
     [ "$status" -eq 0 ]
     # attach sbom to index image
     echo "{\"version\": \"0.0.0.0\", \"artifact\": \"'127.0.0.1:${zot_port}/golang:1.20'\", \"contents\": \"good\"}" > sbom.json
-    run oras attach --plain-http 127.0.0.1:${zot_port}/busybox:latest --image-spec v1.1-image --artifact-type 'sbom/example' ./sbom.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/busybox:latest --artifact-type 'sbom/example' ./sbom.json:application/json
     [ "$status" -eq 0 ]
 }
 
diff --git a/test/blackbox/pushpull.bats b/test/blackbox/pushpull.bats
index c1ea075a0..d43b4e05c 100644
--- a/test/blackbox/pushpull.bats
+++ b/test/blackbox/pushpull.bats
@@ -149,17 +149,17 @@ function teardown_file() {
     zot_port=`cat ${BATS_FILE_TMPDIR}/zot.port`
     # attach signature
     echo "{\"artifact\": \"\", \"signature\": \"pat hancock\"}" > ${BATS_FILE_TMPDIR}/signature.json
-    run oras attach --plain-http 127.0.0.1:${zot_port}/golang:1.20 --image-spec v1.1-image --artifact-type 'signature/example' ${BATS_FILE_TMPDIR}/signature.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/golang:1.20 --artifact-type 'signature/example' ${BATS_FILE_TMPDIR}/signature.json:application/json
     [ "$status" -eq 0 ]
     # attach sbom
     echo "{\"version\": \"0.0.0.0\", \"artifact\": \"'127.0.0.1:${zot_port}/golang:1.20'\", \"contents\": \"good\"}" > ${BATS_FILE_TMPDIR}/sbom.json
-    run oras attach --plain-http 127.0.0.1:${zot_port}/golang:1.20 --image-spec v1.1-image --artifact-type 'sbom/example' ${BATS_FILE_TMPDIR}/sbom.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:${zot_port}/golang:1.20 --artifact-type 'sbom/example' ${BATS_FILE_TMPDIR}/sbom.json:application/json
     [ "$status" -eq 0 ]
 }
 
 @test "discover oras artifacts" {
     zot_port=`cat ${BATS_FILE_TMPDIR}/zot.port`
-    run oras discover --plain-http -o json 127.0.0.1:${zot_port}/golang:1.20
+    run oras discover --plain-http --format json 127.0.0.1:${zot_port}/golang:1.20
     [ "$status" -eq 0 ]
     [ $(echo "$output" | jq -r ".manifests | length") -eq 2 ]
 }
diff --git a/test/blackbox/pushpull_running_dedupe.bats b/test/blackbox/pushpull_running_dedupe.bats
index f1fd6dac0..8b31feb86 100644
--- a/test/blackbox/pushpull_running_dedupe.bats
+++ b/test/blackbox/pushpull_running_dedupe.bats
@@ -244,7 +244,7 @@ function teardown_file() {
     # attach signature
     echo "{\"artifact\": \"\", \"signature\": \"pat hancock\"}" > ${BATS_FILE_TMPDIR}/signature.json
     start=`date +%s`
-    run oras attach --plain-http 127.0.0.1:8080/alpine:1 --image-spec v1.1-image --artifact-type 'signature/example' ${BATS_FILE_TMPDIR}/signature.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:8080/alpine:1 --artifact-type 'signature/example' ${BATS_FILE_TMPDIR}/signature.json:application/json
     [ "$status" -eq 0 ]
     end=`date +%s`
     runtime=$((end-start))
@@ -253,7 +253,7 @@ function teardown_file() {
     # attach sbom
     echo "{\"version\": \"0.0.0.0\", \"artifact\": \"'127.0.0.1:8080/alpine:1'\", \"contents\": \"good\"}" > ${BATS_FILE_TMPDIR}/sbom.json
     start=`date +%s`
-    run oras attach --plain-http 127.0.0.1:8080/alpine:1 --image-spec v1.1-image --artifact-type 'sbom/example' ${BATS_FILE_TMPDIR}/sbom.json:application/json
+    run oras attach --disable-path-validation --plain-http 127.0.0.1:8080/alpine:1 --artifact-type 'sbom/example' ${BATS_FILE_TMPDIR}/sbom.json:application/json
     [ "$status" -eq 0 ]
     end=`date +%s`
     runtime=$((end-start))
diff --git a/test/blackbox/referrers.bats b/test/blackbox/referrers.bats
index 3817abef9..89c8097f6 100644
--- a/test/blackbox/referrers.bats
+++ b/test/blackbox/referrers.bats
@@ -80,7 +80,7 @@ EOF
     [ "$status" -eq 0 ]
     [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
 
-    run oras attach --plain-http --image-spec v1.1-image --artifact-type image.artifact/type 127.0.0.1:${zot_port}/golang:1.20 ${IMAGE_MANIFEST_REFERRER}
+    run oras attach --disable-path-validation --plain-http --artifact-type image.artifact/type 127.0.0.1:${zot_port}/golang:1.20 ${IMAGE_MANIFEST_REFERRER}
     [ "$status" -eq 0 ]
 
     MANIFEST_DIGEST=$(skopeo inspect --tls-verify=false docker://localhost:${zot_port}/golang:1.20 | jq -r '.Digest')