openshift/openshift-apiserver relies on a few packages that prevent it from using distribution/v3@v3.0.0, namely:

• It imports github.com/distribution/distribution/v3/registry/client/auth to use the auth.CredentialStore interface type. This package is removed now, but the interface will be copied into library-go when adding support for v3.0.0 there. So once that is available, we can simply use a different import path for the same interface.
• It imports registryclient from library-go, which can simply be upgraded to registryclient/v2 once the change is merged in library-go. That package uses distribution/v3@v3.0.0 out of the box and has the same interface as the package being used right now in openshift-apiserver. 

  ./pkg/image/apiserver/importer/staticcredentials.go:19: "github.com/openshift/library-go/pkg/image/registryclient" 

   

• It imports schema1 from distribution/v3, which has been deprecated. This would be handled by removing  support for image manifest schema 1 support altogether. (https://access.redhat.com/solutions/4346011)