diff --git a/go.mod b/go.mod index d4ffb165..d2ffcd1c 100644 --- a/go.mod +++ b/go.mod @@ -4,8 +4,8 @@ go 1.26 require ( github.com/NYTimes/gziphandler v1.1.1 - github.com/gofrs/uuid/v5 v5.5.0 - github.com/google/go-containerregistry v0.21.7 + github.com/gofrs/uuid/v5 v5.5.1 + github.com/google/go-containerregistry v0.21.8 github.com/gophercloud/gophercloud/v2 v2.13.0 github.com/gorilla/mux v1.8.1 github.com/mitchellh/mapstructure v1.5.0 @@ -14,7 +14,7 @@ require ( github.com/sapcc/go-api-declarations v1.24.0 github.com/sapcc/go-bits v0.0.0-20260730170321-f6f727520601 go.uber.org/automaxprocs v1.6.0 - go.xyrillian.de/gg v1.11.1 + go.xyrillian.de/gg v1.13.0 go.xyrillian.de/schwift/v2 v2.2.1 gopkg.in/yaml.v2 v2.4.0 k8s.io/apimachinery v0.33.13 @@ -25,7 +25,7 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.5.3+incompatible // indirect + github.com/docker/cli v29.6.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/emicklei/go-restful/v3 v3.11.0 // indirect github.com/fxamacker/cbor/v2 v2.7.0 // indirect diff --git a/go.sum b/go.sum index a94912c2..169c9a90 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs= -github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= +github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= @@ -28,8 +28,8 @@ github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+Gr github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= -github.com/gofrs/uuid/v5 v5.5.0 h1:FkPv6jYQRbZtH3bD8yC7106u+CedTCLF8+t7CLHSZNo= -github.com/gofrs/uuid/v5 v5.5.0/go.mod h1:bbAA98EoIlxyRHIVg6ektCSsZ5n8mSbwgEhvhMYlZgg= +github.com/gofrs/uuid/v5 v5.5.1 h1:z1Ce19/JwNidXpy3tOQc3241lnJLKdKyq/xlNvlD4Ng= +github.com/gofrs/uuid/v5 v5.5.1/go.mod h1:bbAA98EoIlxyRHIVg6ektCSsZ5n8mSbwgEhvhMYlZgg= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw= @@ -37,8 +37,8 @@ github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcb github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU= -github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE= +github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE= +github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo= github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= @@ -135,8 +135,8 @@ go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.xyrillian.de/gg v1.11.1 h1:7P3kDFkTmR7jx2riYi0GwX5uhgrsL37QSrN16xH/n8E= -go.xyrillian.de/gg v1.11.1/go.mod h1:DoO4fQSWIrBRlNlCjVyrYM0kAEBt/Jg2GkMH+cGRZ0k= +go.xyrillian.de/gg v1.13.0 h1:K1RlyRxe2+7oaXALZBtuJqqwSEPneTjH1gPD18WuSaU= +go.xyrillian.de/gg v1.13.0/go.mod h1:DoO4fQSWIrBRlNlCjVyrYM0kAEBt/Jg2GkMH+cGRZ0k= go.xyrillian.de/schwift/v2 v2.2.1 h1:uzw9Fe2ftiB4oUiEfxh2zTWxBRwFOAtVuyGZwAaAnNQ= go.xyrillian.de/schwift/v2 v2.2.1/go.mod h1:LeYCnGM3IAf22o5AkQTpzSoL38BZ2ytkQawfx8A63Wo= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= @@ -176,8 +176,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/vendor/github.com/docker/cli/AUTHORS b/vendor/github.com/docker/cli/AUTHORS index accbf6c5..c42a3f8f 100644 --- a/vendor/github.com/docker/cli/AUTHORS +++ b/vendor/github.com/docker/cli/AUTHORS @@ -43,6 +43,7 @@ Alexander Larsson Alexander Morozov Alexander Ryabov Alexandre González +Alexandre Levavasseur Alexandre Vallières-Lagacé Alexey Igrychev Alexis Couvreur @@ -161,6 +162,7 @@ Chen Chuanliang Chen Hanxiao Chen Mingjie Chen Qiu +Ching Wei Kang <164879897+WilliamK112@users.noreply.github.com> Chris Chinchilla Chris Couzens Chris Gavin @@ -366,7 +368,7 @@ Hugo Gabriel Eyherabide huqun Huu Nguyen Hyzhou Zhy -Iain MacDonald +Iain MacDonald Iain Samuel McLean Elder Ian Campbell Ian Philpot @@ -552,6 +554,7 @@ Ludovic Temgoua Abanda Luis Henrique Mulinari Luka Hartwig Lukas Heeren +Lukas Michael Lukasz Zajaczkowski Luo Jiyin Lydell Manganti @@ -562,6 +565,7 @@ Maciej Kalisz Madhav Puri Madhu Venugopal Madhur Batra +Mahesh Thakur Malte Janduda Manjunath A Kumatagi Mansi Nahar @@ -589,10 +593,12 @@ Mathieu Rollet Matt Gucci Matt Robenolt Matteo Orefice +Matteo Panzeri Matthew Heon Matthieu Hauglustaine Matthieu MOREL Mauro Porras P +Max Morozov Max Shytikov Max-Julian Pogner Maxime Petazzoni @@ -617,6 +623,7 @@ Michael West Michael Zampani Michal Minář Michał Czeraszkiewicz +Mickael Emirkanian Miguel Angel Alvarez Cabrerizo Mihai Borobocea Mihuleacc Sergiu @@ -638,6 +645,7 @@ Mohammad Banikazemi Mohammad Hossein Mohammed Aaqib Ansari Mohammed Aminu Futa +Mohammed Thaha Mohini Anne Dsouza Moorthy RS Morgan Bauer @@ -689,6 +697,7 @@ Olli Janatuinen Oscar Wieman Otto Kekäläinen Ovidio Mallo +Park Jaeon Pascal Borreli Patrick Böänziger Patrick Daigle <114765035+pdaig@users.noreply.github.com> @@ -715,6 +724,7 @@ Peter Jaffe Peter Kehl Peter Nagy Peter Salvatore +Peter Valdemar Mørch Peter Waller Phil Estes Philip Alexander Etling @@ -739,6 +749,7 @@ Ray Tsang Reficul Remy Suen Renaud Gaubert +René Hermenau Ricardo N Feliciano Rich Moyse Richard Chen Zheng <58443436+rchenzheng@users.noreply.github.com> @@ -789,6 +800,7 @@ Scott Collier Sean Christopherson Sean Rodman Sebastiaan van Stijn +Seiya Miyata Sergey Tryuber Serhat Gülçiçek Sevki Hasirci @@ -889,8 +901,10 @@ Umesh Yadav Vaclav Struhar Valentin Lorentz Vardan Pogosian +Varun Hotani Venkateswara Reddy Bukkasamudram Veres Lajos +Vibhu Anan Victor Vieux Victoria Bialas Viktor Stanchev diff --git a/vendor/github.com/gofrs/uuid/v5/README.md b/vendor/github.com/gofrs/uuid/v5/README.md index 581040d2..71119d9d 100644 --- a/vendor/github.com/gofrs/uuid/v5/README.md +++ b/vendor/github.com/gofrs/uuid/v5/README.md @@ -4,7 +4,6 @@ [![Build Status](https://github.com/gofrs/uuid/actions/workflows/go.yml/badge.svg)](https://github.com/gofrs/uuid/actions/workflows/go.yml) [![Go Reference](https://pkg.go.dev/badge/github.com/gofrs/uuid/v5.svg)](https://pkg.go.dev/github.com/gofrs/uuid/v5) [![Coverage Status](https://codecov.io/gh/gofrs/uuid/branch/master/graphs/badge.svg?branch=master)](https://codecov.io/gh/gofrs/uuid/) -[![Go Report Card](https://goreportcard.com/badge/github.com/gofrs/uuid)](https://goreportcard.com/report/github.com/gofrs/uuid) [![CodeQL](https://github.com/gofrs/uuid/actions/workflows/codeql.yml/badge.svg)](https://github.com/gofrs/uuid/actions/workflows/codeql.yml) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8929/badge)](https://www.bestpractices.dev/projects/8929) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gofrs/uuid/badge)](https://scorecard.dev/viewer/?uri=github.com/gofrs/uuid) diff --git a/vendor/github.com/google/go-containerregistry/pkg/authn/keychain.go b/vendor/github.com/google/go-containerregistry/pkg/authn/keychain.go index ade2c63c..a9b105e1 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/authn/keychain.go +++ b/vendor/github.com/google/go-containerregistry/pkg/authn/keychain.go @@ -102,11 +102,19 @@ func (dk *defaultKeychain) ResolveContext(_ context.Context, target Resource) (A if !foundDockerConfig && os.Getenv("DOCKER_CONFIG") != "" { foundDockerConfig = fileExists(filepath.Join(os.Getenv("DOCKER_CONFIG"), "config.json")) } + configDir := os.Getenv("XDG_CONFIG_HOME") + if configDir == "" && home != "" { + configDir = filepath.Join(home, ".config") + } + podmanAuth := filepath.Join(os.Getenv("XDG_RUNTIME_DIR"), "containers/auth.json") + if (os.Getenv("XDG_RUNTIME_DIR") == "" || !fileExists(podmanAuth)) && configDir != "" { + podmanAuth = filepath.Join(configDir, "containers/auth.json") + } // If either of those locations are found, load it using Docker's // config.Load, which may fail if the config can't be parsed. // // If neither was found, look for Podman's auth at - // $REGISTRY_AUTH_FILE or $XDG_RUNTIME_DIR/containers/auth.json + // $REGISTRY_AUTH_FILE or containers/auth.json under XDG runtime/config dirs // and attempt to load it as a Docker config. // // If neither are found, fallback to Anonymous. @@ -126,7 +134,7 @@ func (dk *defaultKeychain) ResolveContext(_ context.Context, target Resource) (A if err != nil { return nil, err } - } else if path := filepath.Clean(filepath.Join(os.Getenv("XDG_RUNTIME_DIR"), "containers/auth.json")); fileExists(path) { + } else if path := filepath.Clean(podmanAuth); fileExists(path) { f, err := os.Open(path) if err != nil { return nil, err diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/doc.go b/vendor/github.com/google/go-containerregistry/pkg/name/doc.go index b294794d..b67ad0ff 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/doc.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/doc.go @@ -17,9 +17,11 @@ // What's in a name? For image references, not nearly enough! // // Image references look a lot like URLs, but they differ in that they don't -// contain the scheme (http or https), they can end with a :tag or a @digest -// (the latter being validated), and they perform defaulting for missing -// components. +// contain the scheme (http or https), they can end with a :tag, an @digest +// (the latter being validated), or both. When a reference includes both a tag +// and a digest, it is treated as a digest reference: the digest is the +// identifier used for verification, while the tag is retained only in the +// original string form. // // Since image references don't contain the scheme, we do our best to infer // if we use http or https from the given hostname. We allow http fallback for diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go index 0a048677..539d0ff3 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go @@ -37,6 +37,7 @@ type Reference interface { } // ParseReference parses the string as a reference, either by tag or digest. +// References that include both a tag and digest parse as Digest references. func ParseReference(s string, opts ...Option) (Reference, error) { if t, err := NewTag(s, opts...); err == nil { return t, nil diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go index 09458e96..55281c86 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go @@ -22,7 +22,7 @@ import ( "fmt" "io" "maps" - "path/filepath" + "path" "strings" "time" @@ -37,6 +37,11 @@ import ( const whiteoutPrefix = ".wh." +// opaqueWhiteout marks a directory as opaque: all entries from lower layers under +// its parent directory are hidden. It shares the whiteoutPrefix, so it must be +// matched exactly and handled before the generic per-file whiteout logic. +const opaqueWhiteout = ".wh..wh..opq" + // Addendum contains layers and history to be appended // to a base image type Addendum struct { @@ -267,6 +272,9 @@ func extract(img v1.Image, w io.Writer) error { defer tarWriter.Close() fileMap := map[string]bool{} + // opaqueDirs holds directories opaqued by an upper layer; entries under them + // from lower (later-iterated) layers are hidden. + opaqueDirs := map[string]bool{} layers, err := img.Layers() if err != nil { @@ -277,14 +285,18 @@ func extract(img v1.Image, w io.Writer) error { // whiteout layers more efficient, since we can just keep track of the removed // files as we see .wh. layers and ignore those in previous layers. for i := len(layers) - 1; i >= 0; i-- { - if err := extractLayer(tarWriter, fileMap, layers[i]); err != nil { + if err := extractLayer(tarWriter, fileMap, opaqueDirs, layers[i]); err != nil { return err } } return nil } -func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer) error { +func extractLayer(tarWriter *tar.Writer, fileMap, opaqueDirs map[string]bool, layer v1.Layer) error { + // Opaque markers in this layer hide only lower layers, so stage them and + // promote to opaqueDirs after the whole layer is processed. + layerOpaque := map[string]bool{} + layerReader, err := layer.Uncompressed() if err != nil { return fmt.Errorf("reading layer contents: %w", err) @@ -303,7 +315,10 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer // Some tools prepend everything with "./", so if we don't Clean the // name, we may have duplicate entries, which angers tar-split. - header.Name = filepath.Clean(header.Name) + header.Name = path.Clean(header.Name) + if unsafeArchivePath(header.Name) { + return fmt.Errorf("unsafe tar path %q", header.Name) + } // Reject relative symlinks and hardlinks whose targets escape the // image rootfs. Relative targets are resolved against the symlink's @@ -313,11 +328,8 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer // Absolute targets are left as-is; see #2238 for ongoing discussion // on whether they should be pruned. if header.Typeflag == tar.TypeSymlink || header.Typeflag == tar.TypeLink { - if !filepath.IsAbs(header.Linkname) { - resolved := filepath.Clean(filepath.Join(filepath.Dir(header.Name), header.Linkname)) //nolint:gosec // G305: path is only used for validation, not file I/O - if strings.HasPrefix(resolved, "..") { - continue - } + if unsafeRelativeLink(header.Name, header.Linkname) { + continue } } @@ -326,8 +338,16 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer // prefers USTAR over PAX header.Format = tar.FormatPAX - basename := filepath.Base(header.Name) - dirname := filepath.Dir(header.Name) + basename := path.Base(header.Name) + dirname := path.Dir(header.Name) + + // An opaque marker hides all lower-layer entries under dirname. It shares + // the whiteout prefix, so handle it before the generic per-file logic. + if basename == opaqueWhiteout { + layerOpaque[dirname] = true + continue + } + tombstone := strings.HasPrefix(basename, whiteoutPrefix) if tombstone { basename = basename[len(whiteoutPrefix):] @@ -339,7 +359,7 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer if header.Typeflag == tar.TypeDir { name = header.Name } else { - name = filepath.Join(dirname, basename) + name = path.Join(dirname, basename) } if _, ok := fileMap[name]; ok && !tombstone { @@ -351,6 +371,11 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer continue } + // check for a parent directory opaqued by an upper layer + if inOpaqueDir(opaqueDirs, name) { + continue + } + // mark file as handled. non-directory implicitly tombstones // any entries with a matching (or child) name fileMap[name] = tombstone || (header.Typeflag != tar.TypeDir) @@ -366,6 +391,11 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer } } + // Opaque dirs found in this layer now hide entries in lower layers. + for d := range layerOpaque { + opaqueDirs[d] = true + } + // Drain any bytes the tar.Reader did not consume (trailing data after the // end-of-archive marker) so the underlying verifying reader reaches io.EOF // and the layer's digest is verified. Without this, a layer whose contents @@ -377,9 +407,23 @@ func extractLayer(tarWriter *tar.Writer, fileMap map[string]bool, layer v1.Layer return nil } +func inOpaqueDir(opaqueDirs map[string]bool, file string) bool { + for file != "" { + dirname := path.Dir(file) + if file == dirname { + break + } + if opaqueDirs[dirname] { + return true + } + file = dirname + } + return false +} + func inWhiteoutDir(fileMap map[string]bool, file string) bool { for file != "" { - dirname := filepath.Dir(file) + dirname := path.Dir(file) if file == dirname { break } @@ -391,6 +435,39 @@ func inWhiteoutDir(fileMap map[string]bool, file string) bool { return false } +func unsafeArchivePath(name string) bool { + clean := cleanArchivePath(name) + if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") { + return true + } + if strings.HasPrefix(name, "\\") { + return true + } + return hasWindowsDrivePrefix(clean) +} + +func unsafeRelativeLink(name, linkname string) bool { + clean := cleanArchivePath(linkname) + if path.IsAbs(clean) { + return false + } + if hasWindowsDrivePrefix(clean) { + return true + } + resolved := path.Clean(path.Join(path.Dir(name), clean)) //nolint:gosec // G305: path is only used for validation, not file I/O + return strings.HasPrefix(resolved, "..") +} + +func cleanArchivePath(name string) string { + return path.Clean(strings.ReplaceAll(name, "\\", "/")) +} + +func hasWindowsDrivePrefix(name string) bool { + return len(name) >= 2 && + (('A' <= name[0] && name[0] <= 'Z') || ('a' <= name[0] && name[0] <= 'z')) && + name[1] == ':' +} + // Time sets all timestamps in an image to the given timestamp. func Time(img v1.Image, t time.Time) (v1.Image, error) { newImage := empty.Image diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.go index c606e0b7..a7ac8ff5 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/rebase.go @@ -97,13 +97,21 @@ func Rebase(orig, oldBase, newBase v1.Image) (v1.Image, error) { return nil, fmt.Errorf("could not get new base layers for new base: %w", err) } // Add new base layers. - rebasedImage, err = Append(rebasedImage, createAddendums(0, 0, newConfig.History, newBaseLayers)...) + newBaseAdds, err := createAddendums(0, 0, newConfig.History, newBaseLayers) + if err != nil { + return nil, fmt.Errorf("failed to process new base image: %w", err) + } + rebasedImage, err = Append(rebasedImage, newBaseAdds...) if err != nil { return nil, fmt.Errorf("failed to append new base image: %w", err) } // Add original layers above the old base. - rebasedImage, err = Append(rebasedImage, createAddendums(len(oldConfig.History), len(oldBaseLayers)+1, origConfig.History, origLayers)...) + origAdds, err := createAddendums(len(oldConfig.History), len(oldBaseLayers)+1, origConfig.History, origLayers) + if err != nil { + return nil, fmt.Errorf("failed to process original image: %w", err) + } + rebasedImage, err = Append(rebasedImage, origAdds...) if err != nil { return nil, fmt.Errorf("failed to append original image: %w", err) } @@ -113,7 +121,7 @@ func Rebase(orig, oldBase, newBase v1.Image) (v1.Image, error) { // createAddendums makes a list of addendums from a history and layers starting from a specific history and layer // indexes. -func createAddendums(startHistory, startLayer int, history []v1.History, layers []v1.Layer) []Addendum { +func createAddendums(startHistory, startLayer int, history []v1.History, layers []v1.Layer) ([]Addendum, error) { var adds []Addendum // History should be a superset of layers; empty layers (e.g. ENV statements) only exist in history. // They cannot be iterated identically but must be walked independently, only advancing the iterator for layers @@ -123,6 +131,9 @@ func createAddendums(startHistory, startLayer int, history []v1.History, layers var layer v1.Layer emptyLayer := history[historyIndex].EmptyLayer if !emptyLayer { + if layerIndex >= len(layers) { + return nil, fmt.Errorf("malformed image: config history references at least %d non-empty layer(s), but only %d layer(s) are present", layerIndex+1, len(layers)) + } layer = layers[layerIndex] layerIndex++ } @@ -136,9 +147,9 @@ func createAddendums(startHistory, startLayer int, history []v1.History, layers // In the event history was malformed or non-existent, append the remaining layers. for i := layerIndex; i < len(layers); i++ { if i >= startLayer { - adds = append(adds, Addendum{Layer: layers[layerIndex]}) + adds = append(adds, Addendum{Layer: layers[i]}) } } - return adds + return adds, nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/limiter.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/limiter.go index 54ec3b28..153d7cf0 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/limiter.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/limiter.go @@ -48,6 +48,14 @@ type limitedReadCloser struct { once sync.Once } +func (l *limitedReadCloser) Read(p []byte) (int, error) { + n, err := l.ReadCloser.Read(p) + if err != nil { + l.once.Do(l.release) + } + return n, err +} + func (l *limitedReadCloser) Close() error { err := l.ReadCloser.Close() l.once.Do(l.release) diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/options.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/options.go index 3d8bb8dd..749db0b6 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/options.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/options.go @@ -46,6 +46,7 @@ type options struct { retryPredicate retry.Predicate retryStatusCodes []int limiter *pullLimiter + referrersTagFallback bool // Only these options can overwrite Reuse()d options. platform v1.Platform @@ -108,6 +109,8 @@ const ( // ECR returns an error if n > 1000: // https://github.com/google/go-containerregistry/issues/1091 defaultPageSize = 1000 + + defaultReferrersTagFallback = true ) // DefaultTransport is based on http.DefaultTransport with modifications @@ -129,14 +132,15 @@ var DefaultTransport http.RoundTripper = &http.Transport{ func makeOptions(opts ...Option) (*options, error) { o := &options{ - transport: DefaultTransport, - platform: defaultPlatform, - context: context.Background(), - jobs: defaultJobs, - pageSize: defaultPageSize, - retryPredicate: defaultRetryPredicate, - retryBackoff: defaultRetryBackoff, - retryStatusCodes: defaultRetryStatusCodes, + transport: DefaultTransport, + platform: defaultPlatform, + context: context.Background(), + jobs: defaultJobs, + pageSize: defaultPageSize, + retryPredicate: defaultRetryPredicate, + retryBackoff: defaultRetryBackoff, + retryStatusCodes: defaultRetryStatusCodes, + referrersTagFallback: defaultReferrersTagFallback, } for _, option := range opts { @@ -328,6 +332,24 @@ func WithRetryStatusCodes(codes ...int) Option { } } +// WithReferrersTagFallback toggles the referrers tag fallback scheme, see: +// https://github.com/opencontainers/distribution-spec/blob/main/spec.md#referrers-tag-schema +// +// When enabled, pushing a manifest with a subject to a registry that doesn't +// support the Referrers API maintains an image index of referrers under a +// fallback tag, and listing referrers reads from that tag. When disabled, +// the Referrers API is required: pushing a manifest with a subject and +// listing referrers both fail against a registry that doesn't support it, +// rather than falling back to the tag scheme. +// +// The default is true. +func WithReferrersTagFallback(enabled bool) Option { + return func(o *options) error { + o.referrersTagFallback = enabled + return nil + } +} + // WithFilter sets the filter querystring for HTTP operations. func WithFilter(key string, value string) Option { return func(o *options) error { diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go index 7da8017e..bcb0d735 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/puller.go @@ -218,5 +218,5 @@ func (p *Puller) referrers(ctx context.Context, d name.Digest, filter map[string if err != nil { return nil, err } - return f.fetchReferrers(ctx, filter, d) + return f.fetchReferrers(ctx, filter, d, p.o.referrersTagFallback) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/referrers.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/referrers.go index c23e1d83..5a111d7f 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/referrers.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/referrers.go @@ -18,6 +18,7 @@ import ( "bytes" "context" "errors" + "fmt" "net/http" "strings" @@ -46,7 +47,7 @@ func fallbackTag(d name.Digest) name.Tag { return d.Context().Tag(strings.Replace(d.DigestStr(), ":", "-", 1)) } -func (f *fetcher) fetchReferrers(ctx context.Context, filter map[string]string, d name.Digest) (v1.ImageIndex, error) { +func (f *fetcher) fetchReferrers(ctx context.Context, filter map[string]string, d name.Digest, tagFallback bool) (v1.ImageIndex, error) { // Check the Referrers API endpoint first. u := f.url("referrers", d.DigestStr()) req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil) @@ -72,6 +73,9 @@ func (f *fetcher) fetchReferrers(ctx context.Context, filter map[string]string, return nil, err } } else { + if !tagFallback { + return nil, fmt.Errorf("registry %s does not support the Referrers API and the referrers tag fallback is disabled", d.Context().RegistryStr()) + } // The registry doesn't support the Referrers API endpoint, so we'll use the fallback tag scheme. b, _, err = f.fetchManifest(ctx, fallbackTag(d), []types.MediaType{types.OCIImageIndex}) var terr *transport.Error diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go index cbc2b1d4..f576ccd3 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go @@ -221,6 +221,16 @@ func (bt *bearerTransport) RoundTrip(in *http.Request) (*http.Response, error) { // close out old response, since we will not return it. res.Body.Close() + // For cross-host challenges (the request was redirected to another host), + // never mutate bt's shared state: accumulating this host's scope into + // bt.scopes or refreshing bt's token from bt.realm would pollute future + // same-host requests with a scope/token that belongs to a request we + // only ever intended to send to the redirected host. Instead, attempt a + // fresh per-host token exchange scoped entirely to this one request. + if !matchesHost(bt.registry.RegistryStr(), in, bt.scheme) { + return bt.handleCrossHostChallenge(in, challenges) + } + newScopes := []string{} bt.mx.Lock() got := stringSet(bt.scopes) @@ -247,18 +257,7 @@ func (bt *bearerTransport) RoundTrip(in *http.Request) (*http.Response, error) { if err = bt.refresh(in.Context()); err != nil { return nil, err } - // Re-attach the freshly fetched token, but only when the request is - // still talking to the registry we authenticated against. matchesHost - // guards against forwarding the Authorization header across an - // http.Client-level redirect to a different host: a malicious or - // compromised registry can 302 the request to an attacker-controlled - // host, answer the follow-up with a Bearer challenge, and harvest the - // token if we re-attach it unconditionally. For a cross-host request - // fall back to sendRequest(), which omits the credential, rather than - // leaking it to a host we never logged in to. - if !matchesHost(bt.registry.RegistryStr(), in, bt.scheme) { - return sendRequest() - } + bt.mx.RLock() tok := bt.bearer.RegistryToken bt.mx.RUnlock() @@ -269,6 +268,65 @@ func (bt *bearerTransport) RoundTrip(in *http.Request) (*http.Response, error) { return res, err } +// handleCrossHostChallenge performs a per-host bearer token exchange when +// the request has been redirected to a host different from bt.registry. It +// parses the redirected host's own WWW-Authenticate Bearer challenge, fetches +// a token from that host's realm using anonymous auth (the original registry's +// credentials are never forwarded cross-host), and applies the token only to +// this request. +// +// If no usable Bearer challenge is present, or the token exchange fails, the +// request is retried without an Authorization header. +func (bt *bearerTransport) handleCrossHostChallenge(in *http.Request, challenges []authchallenge.Challenge) (*http.Response, error) { + for _, wac := range challenges { + if strings.ToLower(wac.Scheme) != "bearer" { + continue + } + if _, ok := wac.Parameters["realm"]; !ok { + continue + } + + redirectedReg, err := name.NewRegistry(in.URL.Host, name.WeakValidation) + if err != nil { + logs.Warn.Printf("cross-host redirect: invalid host %q: %v", in.URL.Host, err) + continue + } + + // Build a transport.Challenge from the redirected host's WWW-Authenticate + // parameters. fromChallenge validates the realm URL (SSRF guard). + pr := &Challenge{ + Scheme: wac.Scheme, + Parameters: wac.Parameters, + Insecure: in.URL.Scheme == "http", + } + scope := wac.Parameters["scope"] + // TODO: use a keychain to resolve credentials for the redirected host so + // that token endpoints requiring auth are also supported. For now, anonymous + // auth covers the common case where the redirected host's token endpoint is + // public. See https://github.com/google/go-containerregistry/issues/2359. + tmpBt, err := fromChallenge(redirectedReg, authn.Anonymous, bt.inner, pr, scope) + if err != nil { + logs.Warn.Printf("cross-host bearer challenge setup for %q failed: %v", in.URL.Host, err) + continue + } + + if err := tmpBt.refresh(in.Context()); err != nil { + logs.Warn.Printf("cross-host bearer exchange for %q failed: %v", in.URL.Host, err) + continue + } + + tmpBt.mx.RLock() + tok := tmpBt.bearer.RegistryToken + tmpBt.mx.RUnlock() + + in.Header.Set("Authorization", fmt.Sprintf("Bearer %s", tok)) + return bt.inner.RoundTrip(in) + } + + // No usable bearer challenge; retry without credentials. + return bt.inner.RoundTrip(in) +} + // It's unclear which authentication flow to use based purely on the protocol, // so we rely on heuristics and fallbacks to support as many registries as possible. // The basic token exchange is attempted first, falling back to the oauth flow. diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go index 4ff30a8c..84211482 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go @@ -61,6 +61,8 @@ type writer struct { backoff Backoff predicate retry.Predicate + referrersTagFallback bool + scopeLock sync.Mutex // Keep track of scopes that we have already requested. scopeSet map[string]struct{} @@ -106,15 +108,16 @@ func makeWriter(ctx context.Context, repo name.Repository, ls []v1.Layer, o *opt scopeSet[scope] = struct{}{} } return &writer{ - repo: repo, - client: &http.Client{Transport: tr}, - auth: auth, - transport: o.transport, - progress: o.progress, - backoff: o.retryBackoff, - predicate: o.retryPredicate, - scopes: scopes, - scopeSet: scopeSet, + repo: repo, + client: &http.Client{Transport: tr}, + auth: auth, + transport: o.transport, + progress: o.progress, + backoff: o.retryBackoff, + predicate: o.retryPredicate, + referrersTagFallback: o.referrersTagFallback, + scopes: scopes, + scopeSet: scopeSet, }, nil } @@ -527,6 +530,9 @@ func (w *writer) commitSubjectReferrers(ctx context.Context, sub name.Digest, ad // The registry supports Referrers API. The registry is responsible for updating the referrers list. return nil } + if !w.referrersTagFallback { + return fmt.Errorf("registry %s does not support the Referrers API and the referrers tag fallback is disabled", w.repo.RegistryStr()) + } // The registry doesn't support Referrers API, we need to update the manifest tagged with the fallback tag. // Make the request to GET the current manifest. diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/image.go b/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/image.go index 9b0350b1..76b61c68 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/image.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/image.go @@ -304,6 +304,9 @@ func (i *uncompressedImage) LayerByDiffID(h v1.Hash) (partial.UncompressedLayer, } for idx, diffID := range cfg.RootFS.DiffIDs { if diffID == h { + if idx >= len(i.imgDescriptor.Layers) { + return nil, fmt.Errorf("config has %d rootfs.diff_id(s) but tarball manifest only references %d layer(s); the config may not describe a runnable image", len(cfg.RootFS.DiffIDs), len(i.imgDescriptor.Layers)) + } // Technically the media type should be 'application/tar' but given that our // v1.Layer doesn't force consumers to care about whether the layer is compressed // we should be fine returning the DockerLayer media type diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/write.go b/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/write.go index 062268a5..4b1bfd0a 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/write.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/tarball/write.go @@ -28,6 +28,7 @@ import ( "github.com/google/go-containerregistry/pkg/name" v1 "github.com/google/go-containerregistry/pkg/v1" "github.com/google/go-containerregistry/pkg/v1/partial" + "github.com/google/go-containerregistry/pkg/v1/types" ) // WriteToFile writes in the compressed format to a tarball, on disk. @@ -184,7 +185,7 @@ func writeImagesToTar(imageToTags map[v1.Image][]string, m []byte, size int64, w // gunzip expects certain file extensions: // https://www.gnu.org/software/gzip/manual/html_node/Overview.html - layerFiles[i] = fmt.Sprintf("%s.tar.gz", hex) + layerFiles[i] = hex + layerExtension(l) if _, ok := seenLayerDigests[hex]; ok { continue @@ -244,7 +245,7 @@ func calculateManifest(imageToTags map[v1.Image][]string) (m Manifest, err error // gunzip expects certain file extensions: // https://www.gnu.org/software/gzip/manual/html_node/Overview.html - layerFiles[i] = fmt.Sprintf("%s.tar.gz", hex) + layerFiles[i] = hex + layerExtension(l) // Add to LayerSources if it's a foreign layer. desc, err := partial.BlobDescriptor(img, d) @@ -463,3 +464,16 @@ func calculateSingleFileInTarSize(in int64) (out int64) { out += 512 return out } + +func layerExtension(l v1.Layer) string { + mt, _ := l.MediaType() + switch mt { + case types.OCILayerZStd: + return ".tar.zst" + case types.OCIUncompressedLayer, types.OCIUncompressedRestrictedLayer, types.DockerUncompressedLayer: + return ".tar" + default: + // historically, only gzip compressed tar was supported, so this is the fallback + return ".tar.gz" + } +} diff --git a/vendor/modules.txt b/vendor/modules.txt index bd56db27..db6891af 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -10,7 +10,7 @@ github.com/cespare/xxhash/v2 # github.com/davecgh/go-spew v1.1.1 ## explicit github.com/davecgh/go-spew/spew -# github.com/docker/cli v29.5.3+incompatible +# github.com/docker/cli v29.6.2+incompatible ## explicit github.com/docker/cli/cli/config github.com/docker/cli/cli/config/configfile @@ -41,7 +41,7 @@ github.com/go-openapi/jsonreference/internal # github.com/go-openapi/swag v0.23.0 ## explicit; go 1.20 github.com/go-openapi/swag -# github.com/gofrs/uuid/v5 v5.5.0 +# github.com/gofrs/uuid/v5 v5.5.1 ## explicit; go 1.25 github.com/gofrs/uuid/v5 # github.com/gogo/protobuf v1.3.2 @@ -62,7 +62,7 @@ github.com/google/go-cmp/cmp/internal/diff github.com/google/go-cmp/cmp/internal/flags github.com/google/go-cmp/cmp/internal/function github.com/google/go-cmp/cmp/internal/value -# github.com/google/go-containerregistry v0.21.7 +# github.com/google/go-containerregistry v0.21.8 ## explicit; go 1.25.0 github.com/google/go-containerregistry/internal/and github.com/google/go-containerregistry/internal/compression @@ -206,7 +206,7 @@ github.com/x448/float16 go.uber.org/automaxprocs/internal/cgroups go.uber.org/automaxprocs/internal/runtime go.uber.org/automaxprocs/maxprocs -# go.xyrillian.de/gg v1.11.1 +# go.xyrillian.de/gg v1.13.0 ## explicit; go 1.26 go.xyrillian.de/gg/assert go.xyrillian.de/gg/internal/path