mirrors/distribution
0
0 Fork 0
mirror of https://github.com/distribution/distribution.git synced 2026-10-28 10:15:27 +08:00
Code Activity
6,046 Commits 26 Branches 66 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Milos Gajdos e4ee88b911 docs(notifications): describe the event target fields separately (#5051) 2026-10-27 17:43:33 -04:00
Milos Gajdos 5c6afb92ff build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.42.0 to 1.45.0 in the go_modules group across 1 directory (#5047) 2026-10-25 10:35:00 -04:00
Milos Gajdos b506aa7a75 fix(deps): bump vulnerable deps (#5046) 2026-10-25 10:20:13 -04:00
Milos Gajdos 89bd800143 fix(deps): bump vulnerable deps 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-10-24 13:37:49 -04:00
Milos Gajdos ee80aa6ad6 build: bump Go to 1.26.10 in Dockerfiles (#5043) 2026-10-24 13:31:11 -04:00
Milos Gajdos ddf4b31fc6 feat(proxy): add opt-in Range pass-through (#5044) 2026-10-24 13:28:28 -04:00
Milos Gajdos b9a4745811 build(deps): bump docker/bake-action from 7.4.0 to 7.5.0 in the docker-actions group (#5032) 2026-10-21 08:13:02 -07:00
Milos Gajdos cff0ff0c92 build(deps): bump the codeql-actions group across 1 directory with 4 updates (#5014) 2026-10-20 08:29:36 -07:00
Milos Gajdos 7e14f50c52 build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#5031) 2026-10-20 08:11:51 -07:00
Milos Gajdos cc325ae74c build(deps): bump codecov/codecov-action from 6.0.1 to 7.1.1 (#5005) 2026-10-19 09:18:04 -07:00
Milos Gajdos 952d81c67b registry/storage: do not write hash state when closing a cancelled upload (#5021) 2026-10-18 09:25:38 -07:00
Milos Gajdos 042c3a9a51 docs(storage-drivers/gcs): document credentials, maxconcurrency and useragent (#5018) 2026-10-16 16:46:07 -07:00
Milos Gajdos 7ffd469066 docs(storage-drivers/gcs): correct the documented chunksize default (#5017) 2026-10-16 13:17:47 -07:00
Milos Gajdos 315f44a925 docs: fix the YAML key name in the platforms validation section (#5015) 2026-10-15 23:14:12 -07:00
Milos Gajdos f7d69d28c2 driver/filesystem: fix uploads on Windows (#5012) 2026-10-14 13:00:17 -07:00
Milos Gajdos 84baa4692d registry/storage: avoid duplicate SHA-256 in canonical full-fallback validation (#4921) 2026-10-14 10:56:17 -07:00
Milos Gajdos 1c8ef77db2 build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5013) 2026-10-14 08:34:03 -07:00
Milos Gajdos d7da5da1ce build(deps): bump actions/labeler from 6.1.0 to 7.0.0 (#4985) 2026-10-11 20:25:41 -07:00
Milos Gajdos be78ef9417 Include filesystem rootdirectory in PathNotFound errors (#5007) 2026-10-11 17:18:39 -07:00
Milos Gajdos 036e830f80 fix(handlers): return 400 NAME_INVALID for over-long repository names (#4995) 2026-10-11 16:36:42 -07:00
Milos Gajdos bbf0a189dc build(deps): bump the codeql-actions group across 1 directory with 4 updates (#4994) 2026-10-07 21:36:25 -07:00
Milos Gajdos fd9609dd58 Fix inmemory driver find traversing too deep into directory nodes (#4996) 2026-10-07 07:48:39 -07:00
Milos Gajdos 8ceb7bbf72 build: reduce binary size via improved dead‑code elimination (#4997) 2026-10-04 18:05:48 -07:00
Milos Gajdos f01dfc400e docs: fix "offical" typo in Azure storage documentation (#4992) 2026-10-01 08:09:54 -07:00
Milos Gajdos 1d71a5c78e build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#4991) 2026-09-30 07:37:06 -07:00
Milos Gajdos e0904092e2 build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (#4990) 2026-09-29 07:25:03 -07:00
Milos Gajdos 905f26de4b build(deps): bump the codeql-actions group across 1 directory with 4 updates (#4984) 2026-09-28 06:46:07 -07:00
Milos Gajdos 923efdb825 Update containerd client link .../{master => main/core}/remotes/docker (#4902) 2026-09-26 08:50:04 -07:00
Milos Gajdos 3220848f15 chore(release): prepare for v3.1.2 release (#4981) 2026-09-24 04:43:29 -07:00
Milos Gajdos 973fbf7e75 build(deps): bump the docker-actions group across 1 directory with 3 updates (#4978) 2026-09-23 18:38:52 -07:00
Milos Gajdos 30301b116a build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#4982) 2026-09-23 18:38:23 -07:00
Milos Gajdos fd67fd4e32 chore(release): prepare for v3.1.2 release 
* Release notes added
* AUTHORS updated
* Version bump in the version package

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-23 07:52:57 -07:00
Milos Gajdos 960439b09f Merge commit from fork 
fix(client): verify manifest and blob content against requested digest (GHSA-685w-q87j-wqw3)
 2026-09-23 07:25:18 -07:00
Milos Gajdos ca9b887920 build(deps): bump the codeql-actions group with 4 updates (#4977) 2026-09-23 07:20:10 -07:00
Milos Gajdos 77aca8d1e7 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#4979) 2026-09-23 07:18:50 -07:00
Milos Gajdos 5e5d395b64 ci: dependabot: group CodeQL and Docker action updates (#4975) 2026-09-23 06:54:23 -07:00
Milos Gajdos bc5876a2f2 registry: remove logrus-logstash-hook dependency (#4970) 2026-09-22 10:14:10 -07:00
Milos Gajdos aa0900d7b9 chore(docs): fix build status badge (#4969) 2026-09-22 08:39:51 -07:00
Milos Gajdos a95d3993c9 chore(docs): fix build status badge 
Replaced the legacy badge URL with GitHub’s documented workflow-file endpoint

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-22 07:40:46 -07:00
Milos Gajdos 774a889daa build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 (#4915) 2026-09-22 07:32:52 -07:00
Milos Gajdos 8e7f698a2a chore(deps): bump oltp version (#4968) 2026-09-22 07:18:23 -07:00
Milos Gajdos d19a486756 chore(deps): bump oltp version 
This is one last dep update that fixes a medium sec vuln

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-22 07:07:39 -07:00
Milos Gajdos cffc083547 chore(ci): bump alpine image version (#4966) 2026-09-22 06:52:14 -07:00
Milos Gajdos 7fb99ce3e0 chore(ci): bump alpine image version 
long overdue that fixes some minor vulns in base layers

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-22 06:39:06 -07:00
Milos Gajdos 26be4bd519 fix(deps): update deps to fix security vulns (#4965) 2026-09-22 06:37:13 -07:00
Milos Gajdos 3ef63905b3 fix(deps): update deps to fix security vulns 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-22 06:23:35 -07:00
Milos Gajdos a45f0a0824 docs: explain Redis Sentinel configuration (#4964) 2026-09-22 06:11:57 -07:00
Milos Gajdos 4bf640e205 fix(deps): bump grpc dep to fix sec vuln (#4963) 2026-09-22 05:52:56 -07:00
Milos Gajdos 5d7daa1aa1 Fix lint 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-21 21:01:32 -07:00
Milos Gajdos eeb07fe996 fix(deps): bump grpc dep to fix sec vuln 
See: https://github.com/distribution/distribution/security/dependabot/44

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-21 20:54:22 -07:00
Milos Gajdos a90fb174ca fix(handlers): cancel context on Shutdown to stop upload purger goroutine (#4956) 2026-09-21 19:35:26 -07:00
Milos Gajdos 4203aaeaf7 chore(build): Bump Go version to latest 1.26 (#4961) 2026-09-21 18:04:31 +01:00
Milos Gajdos 17a0fd9660 chore(build): Bump go version to latest 1.26 
Deprecate support for 1.25 now that 1.27 is out

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-21 08:43:09 -07:00
Milos Gajdos 3575216ecf docs: fix 'allows to rewrite' grammar in rewrite storage middleware (#4955) 2026-09-21 16:08:47 +01:00
Milos Gajdos 34c2599fa3 fix(s3): use path.Dir instead of filepath.Dir in directoryDiff (#4950) 2026-09-21 16:05:54 +01:00
Milos Gajdos 0e5cebb99d fix(ci): fix broken minio image (#4960) 2026-09-21 15:47:41 +01:00
Milos Gajdos a131a2ac04 fix(ci): fix broken minio image 
Unfortunately minio removed their docker images from Docker Hub which we
rely on in our CI; luckily chainguard maintas both so we're gonna use
those from now on and pin them to specific hashes.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-09-20 19:53:35 -07:00
Milos Gajdos 5b354e6fda Fix 500s from malformed manifest digests and out-of-order final chunk PUTs (#4945) 2026-08-31 12:51:49 -07:00
Milos Gajdos 9eb0061a22 test: use ephemeral ports for registry listen tests (#4929) 2026-08-28 16:09:56 -07:00
Milos Gajdos 64902aa389 chore: update testify, logrus, and migrate to go.yaml.in/yaml/v2 (#4940) 2026-08-26 15:12:07 -07:00
Milos Gajdos f82aaf4bfc chore(deps): github.com/docker/go-metrics v0.1.0 (#4941) 2026-08-26 08:11:11 -07:00
Milos Gajdos 0d6b721dc3 docs: fix CloudFront Origin Path guidance for S3 driver (#4936) 2026-08-18 11:55:22 -07:00
Milos Gajdos 4f6036efc8 fix(tags): return empty array after final pagination marker (#4931) 2026-08-10 12:04:46 -07:00
Milos Gajdos 5337dd7eba fix(storage): don't drop catalog repos that prefix another name (#4904) 2026-07-29 08:19:00 -07:00
Milos Gajdos 4d578730b8 build(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#4880) 2026-07-18 20:13:18 -07:00
Milos Gajdos caf6e27f4a build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 (#4882) 2026-07-18 20:12:51 -07:00
Milos Gajdos fbede68cce build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 (#4881) 2026-07-18 14:01:47 -07:00
Milos Gajdos 47294f6dde build(deps): bump actions/labeler from 6.0.1 to 6.1.0 (#4866) 2026-07-18 14:01:03 -07:00
Milos Gajdos ebf607a7ca docs: document catalog.maxentries configuration (#4911) 2026-07-18 13:33:10 -07:00
Milos Gajdos 39d5bf7777 fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto (#4912) 2026-07-18 09:35:55 -07:00
Milos Gajdos 0ae90d59eb fix: check backend directly in blobStore.Put to avoid stale cache (#4868) 2026-07-18 09:33:09 -07:00
Milos Gajdos 1c159f24f2 fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto 
We also address deprecated package that was breaking lint

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-07-18 09:22:22 -07:00
Milos Gajdos 472c9d38c9 fix contentRangeRegexp to accept unknown total size (#4892) 2026-06-19 07:58:23 -07:00
Milos Gajdos 03210665f5 fix(s3): tags/list drops tags that are a lexical prefix of another tag (#4898) 2026-06-15 07:29:55 -07:00
Milos Gajdos d1dbbb196c fix(s3): tags/list drops tags that are a lexical prefix of another tag 
The S3 driver's Walk used a bare strings.HasPrefix to decide whether a
walkInfo was under the last ErrSkipDir directory. Without a trailing
"/" on the parent, a sibling whose name starts with the skipped
directory's name (e.g. "0.1.20" after "0.1.2") falsely matched and was
skipped, so its tag dir was never emitted to handleTag and the tag was
omitted from /v2/<name>/tags/list.

Replace the prefix check with isSubpath, which appends "/" to the
parent so only true descendants match. Add a unit test pinning the
sibling-with-lexical-prefix case.

The bug is S3-only because the filesystem and inmemory drivers list
directories recursively via WalkFallback and don't use this skip
mechanism. It surfaced in 3.1.0 when the tags handler switched from
tagService.All() (driver List with delimiter) to tagService.List()
(driver Walk) for pagination support.

Fixes #4891

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-06-14 17:22:48 -07:00
Milos Gajdos af1b4b4e9a azure: fix race condition in PutContent causing duplicate append writes (#4888) 2026-06-07 09:20:23 -07:00
Milos Gajdos 915084f4bc feat(s3): parse and strictly validate redirectendpoint on driver initialization (#4870) 2026-05-31 12:31:37 -07:00
Milos Gajdos 22c97cc513 fix: report error in DeleteManifest when Delete returns ErrDigestUnsupported (#4802) 2026-05-28 07:29:39 -07:00
Milos Gajdos 25b2d1dc7f fix(storage): Fix blob type migration in the azure driver (#4871) 2026-05-28 07:29:34 -07:00
Milos Gajdos 8b2870824b chore: smol go fix changes (#4876) 2026-05-24 17:12:01 -07:00
Milos Gajdos 0d5789588f chore: smol go fix changes 
This PR changes the code based on the `go fix` suggestions
to modernize the codebase and keep up with the latest Go features.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-05-24 15:56:02 -07:00
Milos Gajdos ade782b145 build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#4867) 2026-05-13 19:19:24 -07:00
Milos Gajdos 48901448e7 build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#4865) 2026-05-12 10:00:54 -07:00
Milos Gajdos 1d4476c1e3 build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 (#4859) 2026-05-12 10:00:44 -07:00
Milos Gajdos 9a8d98b679 chore(release): prepare for v3.1.1 release (#4864) 2026-05-01 08:28:51 -07:00
Milos Gajdos d3c0df9f61 chore(release): prepare for v3.1.1 release 
* Release notes added
* AUTHORS updated
* Version bump in the `version` package

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-05-01 07:46:25 -07:00
Milos Gajdos e09ff10155 Merge commit from fork 
fix: prevent tag deletion when `storage.delete.enabled` is false
 2026-05-01 07:27:34 -07:00
Milos Gajdos f3af4de047 fix(storage): bounds-check the file basename in PurgeUploads Walk callback (#4860) 2026-04-22 11:07:45 -07:00
Milos Gajdos 1b5e226b6f feat(s3): add express zone one support to S3 driver (#4858) 2026-04-20 07:47:28 -07:00
Milos Gajdos afd2bf0b23 fix(proxy): clamp oversized n query param instead of returning 400 (#4856) 2026-04-20 07:47:14 -07:00
Milos Gajdos 835c1c581f feat(s3): add express zone one support to S3 driver 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-04-18 17:36:52 -07:00
Milos Gajdos 0f3e627937 build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 (#4853) 2026-04-18 17:04:24 -07:00
Milos Gajdos c6f552e5db fix(proxy): clamp oversized n query param instead of returning 400 
PR #4353 made MaxTags (default 1000) a hard ceiling on the `n` query
parameter — anything larger and the handler returns 400
PAGINATION_NUMBER_INVALID before the request ever reaches storage or
the proxy tag service. That broke clients like Renovate which use
n=10000 against pull-through caches. #4846 fixed a related 500 in
proxy mode but not this 400, so users reported the regression still
persisted.

The OCI distribution-spec describes pagination differently: a server
MAY return fewer than `n` results "when the total number of tags
attached to the repository is less than <int> or a Link header is
provided" — otherwise it MUST include `<int>` results. In other
words, the right answer for "client asked for more than we'll serve"
is `maxtags` results plus a Link header, not a rejection.
PAGINATION_NUMBER_INVALID isn't among the 14 error codes the spec
defines, either.

Drop the oversized-n rejection and clamp to MaxTags instead; the
existing Link-header path already handles continuation correctly.
Malformed (non-integer) and negative `n` values keep returning 400,
since the spec defines `n` as a non-negative integer and those
requests are genuinely invalid.

Verified end-to-end against registry-1.docker.io in proxy mode:
n=10000 now returns the tag list (or a clamped page with Link)
instead of 400. Also restores pre-3.1.0 behavior for Renovate-style
clients without needing proxy-specific logic.

Spec reference:
https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-tags

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2026-04-18 16:53:53 -07:00
Milos Gajdos e39652ca1f build(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#4847) 2026-04-18 16:12:05 -07:00
Milos Gajdos 3d916b8c4f build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 (#4852) 2026-04-18 16:11:52 -07:00
Milos Gajdos 17e760a9f0 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#4854) 2026-04-18 16:10:57 -07:00
Milos Gajdos acabfb4b90 Update docker-compose structure in deploying.md (#4855) 2026-04-18 16:10:29 -07:00
Milos Gajdos ca7d4de0ee fix(proxy): fix tag list endpoint in proxy mode (#4846) 2026-04-16 14:17:56 -07:00
Milos Gajdos ece70d987f refactor: use slices.Backward to simplify the code (#4848) 2026-04-16 14:17:33 -07:00
Milos Gajdos 24a4d24a24 chore(build): Bump go version to latest (#4851) 2026-04-14 14:12:13 -07:00