52d68216c0
This bumps go-jose to the latest available version: v4.0.3. This slightly breaks the backwards compatibility with the existing registry deployments but brings more security with it. We now require the users to specify the list of token signing algorithms in the configuration. We do strive to maintain the b/w compat by providing a list of supported algorithms, though, this isn't something we recommend due to security issues, see: * https://github.com/go-jose/go-jose/issues/64 * https://github.com/go-jose/go-jose/pull/69 As part of this change we now return to the original flow of the token signature validation: 1. X2C (tls) headers 2. JWKS 3. KeyID Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
102 lines
4.8 KiB
Modula-2
102 lines
4.8 KiB
Modula-2
module github.com/distribution/distribution/v3
|
|
|
|
go 1.21
|
|
|
|
require (
|
|
cloud.google.com/go/storage v1.30.1
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20221103172237-443f56ff4ba8
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0
|
|
github.com/aws/aws-sdk-go v1.48.10
|
|
github.com/bshuster-repo/logrus-logstash-hook v1.0.0
|
|
github.com/coreos/go-systemd/v22 v22.5.0
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
|
|
github.com/docker/go-metrics v0.0.1
|
|
github.com/go-jose/go-jose/v4 v4.0.2
|
|
github.com/google/uuid v1.3.1
|
|
github.com/gorilla/handlers v1.5.2
|
|
github.com/gorilla/mux v1.8.1
|
|
github.com/hashicorp/golang-lru/arc/v2 v2.0.5
|
|
github.com/klauspost/compress v1.17.4
|
|
github.com/mitchellh/mapstructure v1.5.0
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/opencontainers/image-spec v1.0.2
|
|
github.com/redis/go-redis/extra/redisotel/v9 v9.0.5
|
|
github.com/redis/go-redis/v9 v9.1.0
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/spf13/cobra v1.8.0
|
|
github.com/stretchr/testify v1.8.4
|
|
go.opentelemetry.io/contrib/exporters/autoexport v0.46.1
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1
|
|
go.opentelemetry.io/otel v1.21.0
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0
|
|
go.opentelemetry.io/otel/sdk v1.21.0
|
|
go.opentelemetry.io/otel/trace v1.21.0
|
|
golang.org/x/crypto v0.21.0
|
|
golang.org/x/net v0.23.0
|
|
golang.org/x/oauth2 v0.11.0
|
|
google.golang.org/api v0.126.0
|
|
gopkg.in/yaml.v2 v2.4.0
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go v0.110.7 // indirect
|
|
cloud.google.com/go/compute v1.23.0 // indirect
|
|
cloud.google.com/go/compute/metadata v0.2.3 // indirect
|
|
cloud.google.com/go/iam v1.1.1 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-logr/logr v1.3.0 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
|
github.com/golang/protobuf v1.5.3 // indirect
|
|
github.com/google/s2a-go v0.1.4 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.11.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.5 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
|
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_golang v1.17.0 // indirect; updated to latest
|
|
github.com/prometheus/client_model v0.5.0 // indirect
|
|
github.com/prometheus/common v0.44.0 // indirect
|
|
github.com/prometheus/procfs v0.11.1 // indirect
|
|
github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/prometheus v0.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v0.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.21.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
|
|
golang.org/x/sync v0.3.0
|
|
golang.org/x/sys v0.18.0 // indirect
|
|
golang.org/x/text v0.14.0 // indirect
|
|
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
|
|
google.golang.org/appengine v1.6.7 // indirect
|
|
google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
|
|
google.golang.org/grpc v1.59.0 // indirect
|
|
google.golang.org/protobuf v1.33.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|