Skip to content

CORS-4520: GCP: Support Alternate Universe Domain #474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
patrickdillon wants to merge 3 commits into
base: main
Choose a base branch
from
Open

CORS-4520: GCP: Support Alternate Universe Domain #474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d37dc8
DNM: point to local fork for GCD support
patrickdillon Jul 21, 2026
39dd5cc
DNM: update docker-distribution vendor for GCS auth fix
patrickdillon Jul 26, 2026
9b8e365
Update vendored GCS driver: disable redirects for sovereign clouds
patrickdillon Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 19 additions & 19 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,9 @@ require (
)

require (
cel.dev/expr v0.24.0 // indirect
cloud.google.com/go v0.121.6 // indirect
cloud.google.com/go/auth v0.18.0 // indirect
cel.dev/expr v0.25.1 // indirect
cloud.google.com/go v0.123.0 // indirect
cloud.google.com/go/auth v0.20.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
cloud.google.com/go/iam v1.5.3 // indirect
Expand Down Expand Up @@ -77,8 +77,8 @@ require (
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.9 // indirect
github.com/googleapis/gax-go/v2 v2.16.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect
github.com/googleapis/gax-go/v2 v2.23.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
Expand Down Expand Up @@ -108,26 +108,26 @@ require (
github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 // indirect
github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.38.0 // indirect
go.opentelemetry.io/otel/metric v1.38.0 // indirect
go.opentelemetry.io/otel/trace v1.38.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/otel/trace v1.44.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/term v0.45.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/api v0.260.0 // indirect
google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
google.golang.org/grpc v1.78.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/api v0.289.0 // indirect
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
google.golang.org/grpc v1.82.0 // indirect

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod excerpt =="
nl -ba go.mod | sed -n '120,140p'

echo
echo "== grpc references =="
rg -n 'google\.golang\.org/grpc|GHSA-hrxh-6v49-42gf' go.mod go.sum . -g '!**/vendor/**' || true

echo
echo "== modules depending on grpc =="
go mod graph 2>/dev/null | rg 'google\.golang\.org/grpc' || true

Repository: openshift/image-registry

Length of output: 223

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod excerpt =="
sed -n '120,140p' go.mod

echo
echo "== grpc references in go.mod/go.sum =="
rg -n 'google\.golang\.org/grpc|GHSA-hrxh-6v49-42gf' go.mod go.sum || true

echo
echo "== nearby go.sum grpc entries =="
rg -n '^google\.golang\.org/grpc ' go.sum || true

Repository: openshift/image-registry

Length of output: 2130

🌐 Web query:

GHSA-hrxh-6v49-42gf google.golang.org/grpc v1.82.0 v1.82.1 advisory

💡 Result:

GHSA-hrxh-6v49-42gf is a security advisory for the google.golang.org/grpc (gRPC-Go) library, published on July 15, 2026 [1][2][3]. It addresses three distinct vulnerabilities affecting versions prior to v1.82.1, which were resolved in the v1.82.1 release [1][2][3]. The vulnerabilities are: 1. xDS RBAC Authorization Bypass (High Severity): The xDS RBAC policy translator previously ignored specific unsupported matcher fields—Metadata and RequestedServerName—treating them as no-ops instead of rejecting them [2][4]. This resulted in an authorization bypass where policies intended to restrict access based on these fields failed open [1][2]. 2. HTTP/2 Rapid Reset DoS Bypass (High Severity): Existing HTTP/2 mitigations for Rapid Reset attacks only accounted for frames that resulted in outbound control frames (such as SETTINGS ACKs or server-initiated RST_STREAMs) [5][4]. Attackers could bypass these threshold checks using client-initiated RST_STREAM frames that did not trigger outbound control frames, leading to high CPU consumption and Denial of Service [1][2][4]. 3. xDS RBAC Engine Server Panic (Medium Severity): Parsing crafted xDS RBAC policies that contained NOT rules around unsupported or unhandled fields (such as SourcedMetadata) caused the policy translator to return an empty matcher [1][6]. This led to a runtime panic and server crash when the RBAC engine attempted to authorize incoming requests [2][5][4]. Users are advised to upgrade to google.golang.org/grpc v1.82.1 or later to mitigate these issues [3][4]. Workarounds, if an immediate upgrade is not possible, include ensuring the xDS management server does not push policies containing the vulnerable fields/rules or fronting the gRPC server with a reverse proxy configured with strict rate limits [4].

Citations:

Upgrade google.golang.org/grpc in go.mod:130 to v1.82.1 or later.
google.golang.org/grpc v1.82.0 is affected by GHSA-hrxh-6v49-42gf.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 130, Update the google.golang.org/grpc dependency declaration
from v1.82.0 to v1.82.1 or a later non-vulnerable version, and refresh the
module checksum metadata as needed to keep dependency resolution consistent.

Sources: Learnings, Linters/SAST tools

google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand All @@ -142,7 +142,7 @@ require (
)

replace (
github.com/distribution/distribution/v3 => github.com/openshift/docker-distribution/v3 v3.0.0-20250730075113-f365bc3b1cc3
github.com/distribution/distribution/v3 => github.com/patrickdillon/docker-distribution/v3 v3.0.0-20260726213925-b77ce39762cd

// CVE-2025-30204
github.com/golang-jwt/jwt/v4 => github.com/golang-jwt/jwt/v4 v4.5.2
Expand Down
102 changes: 51 additions & 51 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion vendor/cel.dev/expr/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ go_library(
importpath = "cel.dev/expr",
visibility = ["//visibility:public"],
deps = [
"@org_golang_google_genproto_googleapis_rpc//status:go_default_library",
"@org_golang_google_protobuf//reflect/protoreflect",
"@org_golang_google_protobuf//runtime/protoimpl",
"@org_golang_google_protobuf//types/known/anypb",
Expand Down
22 changes: 2 additions & 20 deletions vendor/cel.dev/expr/MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,26 +11,9 @@ bazel_dep(
version = "0.39.1",
repo_name = "bazel_gazelle",
)
bazel_dep(
name = "googleapis",
version = "0.0.0-20241220-5e258e33.bcr.1",
repo_name = "com_google_googleapis",
)
bazel_dep(
name = "googleapis-cc",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-java",
version = "1.0.0",
)
bazel_dep(
name = "googleapis-go",
version = "1.0.0",
)
bazel_dep(
name = "protobuf",
version = "27.0",
version = "27.1",
repo_name = "com_google_protobuf",
)
bazel_dep(
Expand Down Expand Up @@ -63,12 +46,11 @@ python.toolchain(
)

go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.22.0")
go_sdk.download(version = "1.23.0")

go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//:go.mod")
use_repo(
go_deps,
"org_golang_google_genproto_googleapis_rpc",
"org_golang_google_protobuf",
)
Loading