forked from TrueCloudLab/distribution
52d68216c0
This bumps go-jose to the latest available version: v4.0.3. This slightly breaks the backwards compatibility with the existing registry deployments but brings more security with it. We now require the users to specify the list of token signing algorithms in the configuration. We do strive to maintain the b/w compat by providing a list of supported algorithms, though, this isn't something we recommend due to security issues, see: * https://github.com/go-jose/go-jose/issues/64 * https://github.com/go-jose/go-jose/pull/69 As part of this change we now return to the original flow of the token signature validation: 1. X2C (tls) headers 2. JWKS 3. KeyID Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com> |
||
|---|---|---|
| .. | ||
| accesscontroller.go | ||
| accesscontroller_test.go | ||
| fuzz_test.go | ||
| stringset.go | ||
| token.go | ||
| token_test.go | ||
| types.go | ||
| types_test.go | ||
| util.go | ||