Commit graph

3041 commits

Author SHA1 Message Date
Milos Gajdos
02e2231e60
Merge pull request #3576 from justadogistaken/optimize/disable-insecure-cipher-suites
optimize: disable insecure cipher suites
2022-01-26 15:53:28 +00:00
baojiangnan
4363fb1ef4 disable insecure cipher suites
This commit removes the following cipher suites that are known to be insecure:

TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

And this commit deletes the tlsVersions of tls1.0 and tls1.1. The tls1.2 is the minimal supported tls version for creating a safer tls configuration.

Signed-off-by: david.bao <baojn1998@163.com>
2022-01-25 17:18:44 +08:00
Milos Gajdos
8925814ba1
Merge pull request #3571 from crazy-max/update-ci-release 2022-01-21 21:04:00 +00:00
CrazyMax
ea65fe2ea4
update build workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-21 20:07:08 +01:00
João Pereira
5f1974ab8b
Merge pull request #3567 from justadogistaken/fix/image-cache-incomplete
fix image cache incompletely
2022-01-19 13:57:27 +00:00
Hayley Swimelar
91f33cb5c0
Merge pull request #3566 from paulcacheux/paulcacheux/improve-reference-regexps
Improve how reference regexps are built
2022-01-18 10:26:38 -08:00
Milos Gajdos
c53f110049
Merge pull request #3556 from huangnauh/main
feat: add option to disable combining the pending part
2022-01-18 08:58:57 +00:00
baojiangnan
706f2170bd fix image cache incompletely
Signed-off-by: baojiangnan <baojn1998@163.com>
2022-01-14 23:58:44 +08:00
Paul Cacheux
89622d99a1 Replace references to re with regexp.MustCompile
Signed-off-by: Paul Cacheux <paul.cacheux@datadoghq.com>
2022-01-13 22:06:06 +01:00
Paul Cacheux
1c89ce5fc1 Improve how reference regexps are built
Previous implementation was doing a lot of string -> regexp -> string
conversions

Signed-off-by: Paul Cacheux <paul.cacheux@datadoghq.com>
2022-01-13 16:53:00 +01:00
Milos Gajdos
bb1fb61445
Merge pull request #3315 from crazy-max/ghactions
Native cross-compilation, artifacts and multi-platform image
2022-01-12 11:00:24 +00:00
CrazyMax
936d7eda01
ci: upload conformance test results
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
6332e9631e
ci: fix conformance and e2e workflows
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
4941d83cc7
ci: build workflow to release artifacts and multi-platform image
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:15 +01:00
libo.huang
117757a5cb feat: add option to disable combining the pending part
Signed-off-by: Libo Huang <huanglibo2010@gmail.com>
2022-01-07 18:20:31 +08:00
Milos Gajdos
77f2180378
Merge pull request #3068 from adambkaplan/s3-dualstack
Add dualstack option to S3 storage driver
2022-01-05 10:50:19 +00:00
Adam Kaplan
e2caaf9cba Add dualstack option to S3 storage driver
Allow the storage driver to optionally use AWS SDK's dualstack mode.
This allows the registry to communicate with S3 in IPv6 environments.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
2022-01-04 17:19:05 -05:00
Adam Kaplan
81a2d171ee Update aws-sdk to 1.42.27
Upgrade the aws golang SDK to 1.42.27 to add the new options for
configuring S3 dualstack endpoints.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
2022-01-04 17:19:05 -05:00
CrazyMax
f13d1e02fe
dockerfile: native cross-compilation
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-02 17:01:15 +01:00
Steve Lasker
6a977a5a75
Merge pull request #3551 from SteveLasker/distribution-maintainers-email
Add cncf-distribution-maintainers@cncf.io to maintainers file
2021-12-21 12:11:23 -08:00
Milos Gajdos
5f328da5ab
Merge pull request #3549 from SteveLasker/security-email
Add CNCF Security email account
2021-12-20 17:37:38 +00:00
Steve Lasker
99c408aac6
Add cncf-distribution-maintainers@cncf.io to maintainers file
Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>
2021-12-20 09:18:17 -08:00
Steve Lasker
6f3cc81b47
Add CNCF Security email account
Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>
2021-12-20 09:01:30 -08:00
Milos Gajdos
020bcce59d
Merge pull request #3458 from AdamKorcz/fuzz1
Fuzzing: Add 3 fuzzers
2021-12-20 09:34:15 +00:00
Milos Gajdos
52e8a12674
Merge pull request #3548 from milosgajdos/fix-email-address
Update Milos' email address
2021-12-17 18:20:00 +00:00
Milos Gajdos
90d24a63d8
Fix email address for milos
Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-12-17 17:02:59 +00:00
AdamKorcz
d0ca0c3303 Fuzzing: Add 3 fuzzers
Signed-off-by: AdamKorcz <adam@adalogics.com>
2021-11-29 20:59:28 +00:00
João Pereira
cc4627fc6e
Merge pull request #2460 from robermorales/patch-1
Improve error message in case invalid env var found
2021-11-25 13:36:00 +00:00
Rober Morales-Chaparro
4f173262e4 patch-1 - adding more info to the error message
Signed-off-by: Rober Morales-Chaparro <rober.morales@rstor.io>
Signed-off-by: Rober Morales-Chaparro <rober.morales@ebury.com>
2021-11-24 15:55:22 +01:00
Rober Morales-Chaparro
579107cf2e Improve error message in case invalid env var found
If you set an env var with non-yaml content but accidentally collides with a possible configuration env var,...

The current error is

```configuration error: error parsing /etc/docker/registry/config.yml: yaml: unmarshal errors:
  line 1: cannot unmarshal !!str `tcp://1...` into configuration.Parameters```

With this change we can see at least which is the problematic env var.

Some orchestrators such as docker-compose set env vars on top on user env vars, so debugging can be tricky if you are not passing vars, and the error is pointing you to a problably valid config file.

Signed-off-by: Rober Morales-Chaparro <rober@rstor.io>
Signed-off-by: Rober Morales-Chaparro <rober.morales@ebury.com>
2021-11-24 15:55:22 +01:00
Milos Gajdos
41a0452eea
Merge pull request from GHSA-qq97-vm5h-rrhg
manifest: validate document type before unmarshal
2021-11-23 19:16:40 +00:00
Milos Gajdos
a29a3c99a6
Merge pull request #3534 from thaJeztah/bump_oci_specs 2021-11-18 08:35:04 +00:00
João Pereira
2ccf55b8c4
Merge pull request #3529 from wy65701436/fix-g404 2021-11-18 08:15:21 +00:00
Sebastiaan van Stijn
6fbba6a99b
go.mod: github.com/opencontainers/image-spec v1.0.2
- Bring mediaType out of reserved status
- specs-go: adding mediaType to the index and manifest structures

full diff: https://github.com/opencontainers/image-spec/compare/v1.0.1...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-11-17 22:25:16 +01:00
Wang Yan
f637481c67 fix go check issues
1, Fix GoSec G404: Use of weak random number generator (math/rand instead of crypto/rand)
2, Fix Static check: ST1019: package "github.com/sirupsen/logrus" is being imported more than once

Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-11-15 17:31:33 +08:00
Samuel Karp
b59a6f8279
manifest: validate document type before unmarshal
Signed-off-by: Samuel Karp <skarp@amazon.com>
2021-11-05 10:21:17 -07:00
Milos Gajdos
6248a88d03
Merge pull request #3515 from wyckster/patch-1
Fixed typo in error message
2021-11-01 14:28:38 +00:00
Chad Faragher
f619db7336 Fixed typo in error message
The wording of the error message had a typo (missing the word "not") that gave it the opposite meaning from the intended meaning.

Signed-off-by: Chad Faragher <wyckster@hotmail.com>
2021-10-28 14:50:04 -04:00
Wang Yan
b106d89db3
Merge pull request #3518 from wy65701436/go17
bump up golang v1.17
2021-10-28 11:15:35 +08:00
Wang Yan
3f4c558dac bump up golang v1.17
Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-10-27 15:51:30 +08:00
Milos Gajdos
1563384b69
Merge pull request #3480 from CollinShoop/optimize-s3-walk
Optimize storagedriver/s3 Walk (up to ~500x) + small bugfix
2021-09-26 10:24:39 +01:00
Milos Gajdos
a60a3f69eb
Merge pull request #3411 from dmage/cloudfront-update-frequency
updatefrequency should not be saved into duration
2021-09-21 15:01:21 +01:00
Oleg Bulatov
f5709b285a updatefrequency should not be saved into duration
When updatefrequency is set and is a string, its value should be saved
into updateFrequency, and it shouldn't override duration.

Signed-off-by: Oleg Bulatov <oleg@bulatov.me>
2021-09-21 11:12:34 +02:00
Milos Gajdos
677772e08d
Merge pull request #3138 from devigned/autorest-update
chore: update azure go-autorest dependencies
2021-08-26 09:13:26 +01:00
David Justice
3e68d47da6
chore: update azure go-autorest dependencies
Signed-off-by: David Justice <david@devigned.com>
2021-08-25 13:43:18 -04:00
Wang Yan
eda4e7152a
Merge pull request #3488 from aviral26/docs
docs: update release-tool link
2021-08-24 17:27:07 +08:00
Aviral Takkar
b07018ff3d
docs: update release-tool link
Signed-off-by: Aviral Takkar <aviral26@users.noreply.github.com>
2021-08-23 00:01:41 -07:00
Milos Gajdos
1cdeff259b
Merge pull request #3487 from justincormack/must
Change should to must in v2 spec
2021-08-20 14:00:19 +01:00
Justin Cormack
1660df4b60
Change should to must in v2 spec
We found some examples of manifests with URLs specififed that did
not provide a digest or size. This breaks the security model by allowing
the content to change, as it no longer provides a Merkle tree. This
was not intended, so explicitly disallow by tightening wording.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2021-08-20 12:14:42 +01:00
Milos Gajdos
ecdf4b7e43
Merge pull request #3474 from thaJeztah/update_go_116
Update to go 1.16, and run CI on 1.15.x and 1.16.x
2021-08-19 08:59:46 +01:00