alexvanin/distribution
1
0
Fork 0
forked from TrueCloudLab/distribution
Code Pull requests Activity
distribution/go.mod

86 lines
3.8 KiB
Modula-2
Raw Normal View History

go.mod: change imports to github.com/distribution/distribution/v3 Go 1.13 and up enforce import paths to be versioned if a project contains a go.mod and has released v2 or up. The current v2.x branches (and releases) do not yet have a go.mod, and therefore are still allowed to be imported with a non-versioned import path (go modules add a `+incompatible` annotation in that case). However, now that this project has a `go.mod` file, incompatible import paths will not be accepted by go modules, and attempting to use code from this repository will fail. This patch uses `v3` for the import-paths (not `v2`), because changing import paths itself is a breaking change, which means that the next release should increment the "major" version to comply with SemVer (as go modules dictate). Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-08-24 11:18:39 +00:00
module github.com/distribution/distribution/v3
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
go 1.18
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
require (
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
cloud.google.com/go/storage v1.30.1
Fuzzing: Move over two fuzzers from cncf-fuzzing Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-12 17:44:12 +00:00
github.com/AdaLogics/go-fuzz-headers v0.0.0-20221103172237-443f56ff4ba8
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
Update Azure SDK and support additional authentication schemes Microsoft has updated the golang Azure SDK significantly. Update the azure storage driver to use the new SDK. Add support for client secret and MSI authentication schemes in addition to shared key authentication. Implement rootDirectory support for the azure storage driver to mirror the S3 driver. Signed-off-by: Kirat Singh <kirat.singh@beacon.io> Co-authored-by: Cory Snider <corhere@gmail.com>
2020-02-21 03:58:17 +00:00
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d
go.mod: github.com/aws/aws-sdk-go v1.43.16 Signed-off-by: Trevor Wood <Trevor.G.Wood@gmail.com>
2022-03-11 01:27:01 +00:00
github.com/aws/aws-sdk-go v1.43.16
Bump Logstash hook for logrus to `v1.0.0`. Signed-off-by: olegburov <oleg.burov@outlook.com>
2020-09-01 00:26:57 +00:00
github.com/bshuster-repo/logrus-logstash-hook v1.0.0
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd
Use go-events package TBD: Queue not converted yet Signed-off-by: Elliot Pahl <elliot.pahl@gmail.com>
2018-03-14 00:08:11 +00:00
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
vendor: update docker/go-metrics v0.0.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-08 17:27:59 +00:00
github.com/docker/go-metrics v0.0.1
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1
Bump Redigo to `v1.8.2`. Signed-off-by: olegburov <oleg.burov@outlook.com>
2020-09-01 00:15:02 +00:00
github.com/gomodule/redigo v1.8.2
Bump Gorilla Handlers to `v1.5.1`. Signed-off-by: olegburov <oleg.burov@outlook.com>
2020-09-01 03:48:55 +00:00
github.com/gorilla/handlers v1.5.1
Bump Gorilla Mux to `v1.8.0`. Signed-off-by: olegburov <oleg.burov@outlook.com>
2020-08-27 18:09:06 +00:00
github.com/gorilla/mux v1.8.0
update golang-lru to v2 Signed-off-by: David van der Spek <vanderspek.david@gmail.com>
2023-08-17 11:09:21 +00:00
github.com/hashicorp/golang-lru/arc/v2 v2.0.5
Support ztsd compression as Content-Encoding Co-authored-by: Nicolas De Loof <nicolas.deloof@gmail.com> Co-authored-by: Sebastiaan van Stijn <github@gone.nl> Signed-off-by: Laura Brehm <laurabrehm@hey.com>
2023-05-04 11:17:34 +00:00
github.com/klauspost/compress v1.16.5
update the golang compiler version and the versions of several dependencies Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-20 05:39:19 +00:00
github.com/mitchellh/mapstructure v1.1.2
vendor: opencontainers/go-digest v1.0.0 full diff: https://github.com/opencontainers/go-digest/compare/v1.0.0-rc1...v1.0.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-08-24 16:45:46 +00:00
github.com/opencontainers/go-digest v1.0.0
go.mod: github.com/opencontainers/image-spec v1.0.2 - Bring mediaType out of reserved status - specs-go: adding mediaType to the index and manifest structures full diff: https://github.com/opencontainers/image-spec/compare/v1.0.1...v1.0.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-11-17 21:23:15 +00:00
github.com/opencontainers/image-spec v1.0.2
vendor: github.com/prometheus/client_golang v1.12.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-04 18:54:58 +00:00
github.com/prometheus/client_golang v1.12.1 // indirect; updated to latest
go.mod: update logrus to v1.8.1 Newer versions contain fixes for recent Go versions, and this removes the dependency on github.com/konsorten/go-windows-terminal-sequences Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-04-22 12:36:56 +00:00
github.com/sirupsen/logrus v1.8.1
go.mod: github.com/spf13/cobra v1.6.1 We were using v1.0.0 of Cobra as newer versions added spf13/viper as dependency, which came with many indirect dependencies. Cobra v1.6.0 and up no longer depend on viper, so we can now safely upgrade to the latest version. full diff: https://github.com/spf13/cobra/compare/v1.0.0...v1.6.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-02 18:48:45 +00:00
github.com/spf13/cobra v1.6.1
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
golang.org/x/crypto v0.7.0
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
golang.org/x/oauth2 v0.6.0
google.golang.org/api v0.114.0
Fuzzing: Move over two fuzzers from cncf-fuzzing Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-12 17:44:12 +00:00
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go.mod: gopkg.in/yaml.v2 v2.4.0 This updates the package to a version to include the security fixes in v2.2.3. Version 2.3.0 was known introduce a breaking change for some users, so using the latest (v2.4.0) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-04-22 12:31:11 +00:00
gopkg.in/yaml.v2 v2.4.0
migrate to go modules from vndr Signed-off-by: Tariq Ibrahim <tariq181290@gmail.com>
2019-06-05 22:40:29 +00:00
)
go.mod: add replace rule to prevent unwanted updateds of grpc and jwt-go This replace rule is to prevent unwanted updates of grpc and jwt-go. When updating spf13/cobra, we noticed that google.golang.org/grpc got updated. Doing a search to find which modules (note here that `go mod graph` only looks at dependencies from a `go modules` perspective, and not all the (current version) of our dependencies use go modules). And I found that the only _modules_ depending on it are `github.com/spf13/viper` and `github.com/grpc-ecosystem/grpc-gateway`: ```bash $ go mod graph | grep ' google.golang.org/grpc' github.com/spf13/viper@v1.4.0 google.golang.org/grpc@v1.21.0 github.com/grpc-ecosystem/grpc-gateway@v1.9.0 google.golang.org/grpc@v1.19.0 ``` Of those, `github.com/grpc-ecosystem/grpc-gateway` is a dependency of `github.com/spf13/viper`: ```bash $ go mod graph | grep ' github.com/grpc-ecosystem/grpc-gateway' github.com/spf13/viper@v1.4.0 github.com/grpc-ecosystem/grpc-gateway@v1.9.0 ``` So looking at that one, it's a dependency of cobra: ```bash $ go mod graph | grep ' github.com/spf13/viper@v1.4.0' github.com/spf13/cobra@v1.0.0 github.com/spf13/viper@v1.4.0 ``` Ironically, while both `github.com/spf13/viper` and `github.com/grpc-ecosystem/grpc-gateway`, depend on `google.golang.org/grpc` and (through their `go.mod`) are responsible for `go mod` to update the dependency version of grpc, none of them are used: ```bash cat vendor/modules.txt | grep github.com/spf13/viper cat vendor/modules.txt | grep github.com/grpc-ecosystem/grpc-gateway ``` Unfortunately, `go modules` looks at `go.mod` to determine the *minimum version* required; _even if the parts of the modules specifying it in the `go.mod` are unused_. This patch adds a `replace` rule in go.mod to prevent updating grpc based on other dependencies that _declare_ `google.golang.org/grpc` as a dependency, but are not used and, hence, should not influence the minumum version. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-04-23 16:34:53 +00:00
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
require (
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
cloud.google.com/go v0.110.0 // indirect
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
github.com/beorn7/perks v1.0.1 // indirect
github.com/bitly/go-simplejson v0.5.0 // indirect
github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b // indirect
github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 // indirect
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
github.com/cespare/xxhash/v2 v2.2.0 // indirect
Fuzzing: Move over two fuzzers from cncf-fuzzing Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-12 17:44:12 +00:00
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
github.com/felixge/httpsnoop v1.0.1 // indirect
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
vendor: github.com/prometheus/client_golang v1.12.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-04 18:54:58 +00:00
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
github.com/golang/protobuf v1.5.2 // indirect
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
github.com/google/uuid v1.3.0 // indirect
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
github.com/googleapis/gax-go/v2 v2.7.1 // indirect
go.mod: github.com/spf13/cobra v1.6.1 We were using v1.0.0 of Cobra as newer versions added spf13/viper as dependency, which came with many indirect dependencies. Cobra v1.6.0 and up no longer depend on viper, so we can now safely upgrade to the latest version. full diff: https://github.com/spf13/cobra/compare/v1.0.0...v1.6.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-02 18:48:45 +00:00
github.com/inconshreveable/mousetrap v1.0.1 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
github.com/jmespath/go-jmespath v0.4.0 // indirect
Fuzzing: Move over two fuzzers from cncf-fuzzing Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-12 17:44:12 +00:00
github.com/kr/pretty v0.2.1 // indirect
github.com/kr/text v0.2.0 // indirect
Update Azure SDK and support additional authentication schemes Microsoft has updated the golang Azure SDK significantly. Update the azure storage driver to use the new SDK. Add support for client secret and MSI authentication schemes in addition to shared key authentication. Implement rootDirectory support for the azure storage driver to mirror the S3 driver. Signed-off-by: Kirat Singh <kirat.singh@beacon.io> Co-authored-by: Cory Snider <corhere@gmail.com>
2020-02-21 03:58:17 +00:00
github.com/kylelemons/godebug v1.1.0 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f // indirect
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
vendor: github.com/prometheus/client_golang v1.12.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-04 18:54:58 +00:00
github.com/prometheus/client_model v0.2.0 // indirect
github.com/prometheus/common v0.32.1 // indirect
github.com/prometheus/procfs v0.7.3 // indirect
go.mod: github.com/spf13/cobra v1.6.1 We were using v1.0.0 of Cobra as newer versions added spf13/viper as dependency, which came with many indirect dependencies. Cobra v1.6.0 and up no longer depend on viper, so we can now safely upgrade to the latest version. full diff: https://github.com/spf13/cobra/compare/v1.0.0...v1.6.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-11-02 18:48:45 +00:00
github.com/spf13/pflag v1.0.5 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 // indirect
github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f // indirect
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
go.opencensus.io v0.24.0 // indirect
bump azure sdk v1.3.0 of azidentity introduces support to workload identity. Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-11 13:23:47 +00:00
golang.org/x/net v0.8.0 // indirect; updated for CVE-2022-27664, CVE-2022-41717
golang.org/x/sys v0.6.0 // indirect
golang.org/x/text v0.8.0 // indirect
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230320184635-7606e756e683 // indirect
google.golang.org/grpc v1.53.0 // indirect
google.golang.org/protobuf v1.29.1 // indirect
)
require (
cloud.google.com/go/compute v1.18.0 // indirect
cloud.google.com/go/compute/metadata v0.2.3 // indirect
cloud.google.com/go/iam v0.12.0 // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
update golang-lru to v2 Signed-off-by: David van der Spek <vanderspek.david@gmail.com>
2023-08-17 11:09:21 +00:00
github.com/hashicorp/golang-lru/v2 v2.0.5 // indirect
go.mod: update gcs driver dependencies Signed-off-by: Flavian Missi <fmissi@redhat.com>
2023-05-23 08:41:43 +00:00
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
update to go 1.18 (continue testing against 1.17) Go 1.16 reached end of life, so update to the current version of Go, but also run CI on the previous version (which is still supported). We should probably also decide wether or not we want the Dockerfiles to pin to a specific minor version; this makes the releases more deterministic. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 08:20:56 +00:00
)
Copy permalink