Commit graph

3051 commits

Author SHA1 Message Date
CrazyMax
fabf9cd4e9
ci: use proper git ref for versioning
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-02-08 12:53:38 +01:00
João Pereira
65bcba49a0
Merge pull request #3575 from thaJeztah/update_autorest
go.mod: github.com/Azure/go-autorest/autorest v0.11.24
2022-02-07 11:45:46 +00:00
Milos Gajdos
b60926597a
Merge pull request #3580 from milosgajdos/update-linter
Update golangci-lint version and fix reports
2022-01-28 17:56:47 +00:00
Hayley Swimelar
c6945a972a
Merge pull request #3579 from milosgajdos/fix-fuzzer
Fix: Avoid a false type assertion in the inmemory driver
2022-01-28 09:10:58 -08:00
Sebastiaan van Stijn
4f1c1e4268
go.mod: github.com/Azure/go-autorest/autorest v0.11.24
Update the indirect dependency to remove the transitional github.com/form3tech-oss/jwt-go
dependency from the dependency graph.

Updates:

- github.com/Azure/go-autorest/autorest v0.11.24: https://github.com/Azure/go-autorest/compare/autorest/v0.11.20...autorest/v0.11.24
- github.com/Azure/go-autorest/autorest/adal v0.9.18: https://github.com/Azure/go-autorest/compare/autorest/adal/v0.9.15...autorest/adal/v0.9.18
- github.com/golang-jwt/jwt v4.2.0: https://github.com/golang-jwt/jwt/compare/v4.0.0...v4.2.0
- golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3: 32db794688...e495a2d5b3

Before this:

    go mod graph | grep 'jwt'
    github.com/Azure/go-autorest/autorest/adal@v0.9.15 github.com/golang-jwt/jwt/v4@v4.0.0
    github.com/Azure/go-autorest/autorest/adal@v0.9.13 github.com/form3tech-oss/jwt-go@v3.2.2+incompatible

After this:

    go mod graph | grep 'jwt'
    github.com/Azure/go-autorest/autorest@v0.11.24 github.com/golang-jwt/jwt/v4@v4.2.0
    github.com/Azure/go-autorest/autorest/adal@v0.9.18 github.com/golang-jwt/jwt/v4@v4.0.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-01-28 18:02:58 +01:00
Milos Gajdos
ebd3f44146
Update golangci-lint version and fix reports
This commit updates golangci-lint to v1.44.0.
It also removes deprecated golint in favour of revive linter.
Finally, it addresses an issue reported by linter.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2022-01-28 11:21:00 +00:00
Milos Gajdos
676691ce6d
Fix: Avoid a false type assertion in the inmemory driver
This issue was discovered by the following fuzzer:
https://github.com/cncf/cncf-fuzzing/blob/main/projects/distribution/inmemory_fuzzer.go#L24

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2022-01-28 11:00:37 +00:00
João Pereira
be4c921514
Merge pull request #3228 from thaJeztah/bump_cobra
go.mod: spf13/cobra v1.0.0
2022-01-27 12:44:32 +00:00
Sebastiaan van Stijn
79ead619be
go.mod: spf13/cobra v1.0.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-01-26 16:59:40 +01:00
Sebastiaan van Stijn
f9c1b86feb
go.mod: add replace rule to prevent unwanted updateds of grpc and jwt-go
This replace rule is to prevent unwanted updates of grpc and jwt-go. When updating
spf13/cobra, we noticed that google.golang.org/grpc got updated.

Doing a search to find which modules (note here that `go mod graph` only looks
at dependencies from a `go modules` perspective, and not all the (current version)
of our dependencies use go modules).

And I found that the only _modules_ depending on it are `github.com/spf13/viper`
and `github.com/grpc-ecosystem/grpc-gateway`:

```bash
$ go mod graph | grep ' google.golang.org/grpc'
github.com/spf13/viper@v1.4.0 google.golang.org/grpc@v1.21.0
github.com/grpc-ecosystem/grpc-gateway@v1.9.0 google.golang.org/grpc@v1.19.0
```

Of those, `github.com/grpc-ecosystem/grpc-gateway` is a dependency of
`github.com/spf13/viper`:

```bash
$ go mod graph | grep ' github.com/grpc-ecosystem/grpc-gateway'
github.com/spf13/viper@v1.4.0 github.com/grpc-ecosystem/grpc-gateway@v1.9.0
```

So looking at that one, it's a dependency of cobra:

```bash
$ go mod graph | grep ' github.com/spf13/viper@v1.4.0'
github.com/spf13/cobra@v1.0.0 github.com/spf13/viper@v1.4.0
```

Ironically, while both `github.com/spf13/viper` and `github.com/grpc-ecosystem/grpc-gateway`,
depend on `google.golang.org/grpc` and (through their `go.mod`) are responsible
for `go mod` to update the dependency version of grpc, none of them are used:

```bash
cat vendor/modules.txt | grep github.com/spf13/viper
cat vendor/modules.txt | grep github.com/grpc-ecosystem/grpc-gateway
```

Unfortunately, `go modules` looks at `go.mod` to determine the *minimum version*
required; _even if the parts of the modules specifying it in the `go.mod` are unused_.

This patch adds a `replace` rule in go.mod to prevent updating grpc based on
other dependencies that _declare_ `google.golang.org/grpc` as a dependency,
but are not used and, hence, should not influence the minumum version.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-01-26 16:59:38 +01:00
Milos Gajdos
02e2231e60
Merge pull request #3576 from justadogistaken/optimize/disable-insecure-cipher-suites
optimize: disable insecure cipher suites
2022-01-26 15:53:28 +00:00
baojiangnan
4363fb1ef4 disable insecure cipher suites
This commit removes the following cipher suites that are known to be insecure:

TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

And this commit deletes the tlsVersions of tls1.0 and tls1.1. The tls1.2 is the minimal supported tls version for creating a safer tls configuration.

Signed-off-by: david.bao <baojn1998@163.com>
2022-01-25 17:18:44 +08:00
Milos Gajdos
8925814ba1
Merge pull request #3571 from crazy-max/update-ci-release 2022-01-21 21:04:00 +00:00
CrazyMax
ea65fe2ea4
update build workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-21 20:07:08 +01:00
João Pereira
5f1974ab8b
Merge pull request #3567 from justadogistaken/fix/image-cache-incomplete
fix image cache incompletely
2022-01-19 13:57:27 +00:00
Hayley Swimelar
91f33cb5c0
Merge pull request #3566 from paulcacheux/paulcacheux/improve-reference-regexps
Improve how reference regexps are built
2022-01-18 10:26:38 -08:00
Milos Gajdos
c53f110049
Merge pull request #3556 from huangnauh/main
feat: add option to disable combining the pending part
2022-01-18 08:58:57 +00:00
baojiangnan
706f2170bd fix image cache incompletely
Signed-off-by: baojiangnan <baojn1998@163.com>
2022-01-14 23:58:44 +08:00
Paul Cacheux
89622d99a1 Replace references to re with regexp.MustCompile
Signed-off-by: Paul Cacheux <paul.cacheux@datadoghq.com>
2022-01-13 22:06:06 +01:00
Paul Cacheux
1c89ce5fc1 Improve how reference regexps are built
Previous implementation was doing a lot of string -> regexp -> string
conversions

Signed-off-by: Paul Cacheux <paul.cacheux@datadoghq.com>
2022-01-13 16:53:00 +01:00
Milos Gajdos
bb1fb61445
Merge pull request #3315 from crazy-max/ghactions
Native cross-compilation, artifacts and multi-platform image
2022-01-12 11:00:24 +00:00
CrazyMax
936d7eda01
ci: upload conformance test results
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
6332e9631e
ci: fix conformance and e2e workflows
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:16 +01:00
CrazyMax
4941d83cc7
ci: build workflow to release artifacts and multi-platform image
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-11 16:41:15 +01:00
libo.huang
117757a5cb feat: add option to disable combining the pending part
Signed-off-by: Libo Huang <huanglibo2010@gmail.com>
2022-01-07 18:20:31 +08:00
Milos Gajdos
77f2180378
Merge pull request #3068 from adambkaplan/s3-dualstack
Add dualstack option to S3 storage driver
2022-01-05 10:50:19 +00:00
Adam Kaplan
e2caaf9cba Add dualstack option to S3 storage driver
Allow the storage driver to optionally use AWS SDK's dualstack mode.
This allows the registry to communicate with S3 in IPv6 environments.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
2022-01-04 17:19:05 -05:00
Adam Kaplan
81a2d171ee Update aws-sdk to 1.42.27
Upgrade the aws golang SDK to 1.42.27 to add the new options for
configuring S3 dualstack endpoints.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
2022-01-04 17:19:05 -05:00
CrazyMax
f13d1e02fe
dockerfile: native cross-compilation
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-02 17:01:15 +01:00
Steve Lasker
6a977a5a75
Merge pull request #3551 from SteveLasker/distribution-maintainers-email
Add cncf-distribution-maintainers@cncf.io to maintainers file
2021-12-21 12:11:23 -08:00
Milos Gajdos
5f328da5ab
Merge pull request #3549 from SteveLasker/security-email
Add CNCF Security email account
2021-12-20 17:37:38 +00:00
Steve Lasker
99c408aac6
Add cncf-distribution-maintainers@cncf.io to maintainers file
Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>
2021-12-20 09:18:17 -08:00
Steve Lasker
6f3cc81b47
Add CNCF Security email account
Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>
2021-12-20 09:01:30 -08:00
Milos Gajdos
020bcce59d
Merge pull request #3458 from AdamKorcz/fuzz1
Fuzzing: Add 3 fuzzers
2021-12-20 09:34:15 +00:00
Milos Gajdos
52e8a12674
Merge pull request #3548 from milosgajdos/fix-email-address
Update Milos' email address
2021-12-17 18:20:00 +00:00
Milos Gajdos
90d24a63d8
Fix email address for milos
Signed-off-by: Milos Gajdos <milosgajdos83@gmail.com>
2021-12-17 17:02:59 +00:00
AdamKorcz
d0ca0c3303 Fuzzing: Add 3 fuzzers
Signed-off-by: AdamKorcz <adam@adalogics.com>
2021-11-29 20:59:28 +00:00
João Pereira
cc4627fc6e
Merge pull request #2460 from robermorales/patch-1
Improve error message in case invalid env var found
2021-11-25 13:36:00 +00:00
Rober Morales-Chaparro
4f173262e4 patch-1 - adding more info to the error message
Signed-off-by: Rober Morales-Chaparro <rober.morales@rstor.io>
Signed-off-by: Rober Morales-Chaparro <rober.morales@ebury.com>
2021-11-24 15:55:22 +01:00
Rober Morales-Chaparro
579107cf2e Improve error message in case invalid env var found
If you set an env var with non-yaml content but accidentally collides with a possible configuration env var,...

The current error is

```configuration error: error parsing /etc/docker/registry/config.yml: yaml: unmarshal errors:
  line 1: cannot unmarshal !!str `tcp://1...` into configuration.Parameters```

With this change we can see at least which is the problematic env var.

Some orchestrators such as docker-compose set env vars on top on user env vars, so debugging can be tricky if you are not passing vars, and the error is pointing you to a problably valid config file.

Signed-off-by: Rober Morales-Chaparro <rober@rstor.io>
Signed-off-by: Rober Morales-Chaparro <rober.morales@ebury.com>
2021-11-24 15:55:22 +01:00
Milos Gajdos
41a0452eea
Merge pull request from GHSA-qq97-vm5h-rrhg
manifest: validate document type before unmarshal
2021-11-23 19:16:40 +00:00
Milos Gajdos
a29a3c99a6
Merge pull request #3534 from thaJeztah/bump_oci_specs 2021-11-18 08:35:04 +00:00
João Pereira
2ccf55b8c4
Merge pull request #3529 from wy65701436/fix-g404 2021-11-18 08:15:21 +00:00
Sebastiaan van Stijn
6fbba6a99b
go.mod: github.com/opencontainers/image-spec v1.0.2
- Bring mediaType out of reserved status
- specs-go: adding mediaType to the index and manifest structures

full diff: https://github.com/opencontainers/image-spec/compare/v1.0.1...v1.0.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-11-17 22:25:16 +01:00
Wang Yan
f637481c67 fix go check issues
1, Fix GoSec G404: Use of weak random number generator (math/rand instead of crypto/rand)
2, Fix Static check: ST1019: package "github.com/sirupsen/logrus" is being imported more than once

Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-11-15 17:31:33 +08:00
Samuel Karp
b59a6f8279
manifest: validate document type before unmarshal
Signed-off-by: Samuel Karp <skarp@amazon.com>
2021-11-05 10:21:17 -07:00
Milos Gajdos
6248a88d03
Merge pull request #3515 from wyckster/patch-1
Fixed typo in error message
2021-11-01 14:28:38 +00:00
Chad Faragher
f619db7336 Fixed typo in error message
The wording of the error message had a typo (missing the word "not") that gave it the opposite meaning from the intended meaning.

Signed-off-by: Chad Faragher <wyckster@hotmail.com>
2021-10-28 14:50:04 -04:00
Wang Yan
b106d89db3
Merge pull request #3518 from wy65701436/go17
bump up golang v1.17
2021-10-28 11:15:35 +08:00
Wang Yan
3f4c558dac bump up golang v1.17
Signed-off-by: Wang Yan <wangyan@vmware.com>
2021-10-27 15:51:30 +08:00