0
Fork 0
mirror of https://github.com/project-zot/zot.git synced 2024-12-16 21:56:37 -05:00
Commit graph

131 commits

Author SHA1 Message Date
peusebiu
1d01b644ea
feat(sync): sync can include self url in registry.URLs (#1562)
sync now ignores self referencing urls, this will help
in clustering mode where we can have the same config
for multiple zots

closes #1335

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2023-07-10 12:27:21 +03:00
peusebiu
17d1338af1
feat: integrate openID auth logic and user profile management (#1381)
This change introduces OpenID authn by using providers such as Github,
Gitlab, Google and Dex.
User sessions are now used for web clients to identify
and persist an authenticated users session, thus not requiring every request to
use credentials.
Another change is apikey feature, users can create/revoke their api keys and use them
to authenticate when using cli clients such as skopeo.

eg:
login:
/auth/login?provider=github
/auth/login?provider=gitlab
and so on

logout:
/auth/logout

redirectURL:
/auth/callback/github
/auth/callback/gitlab
and so on

If network policy doesn't allow inbound connections, this callback wont work!

for more info read documentation added in this commit.

Signed-off-by: Alex Stan <alexandrustan96@yahoo.ro>
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
Co-authored-by: Alex Stan <alexandrustan96@yahoo.ro>
2023-07-07 09:27:10 -07:00
LaurentiuNiculae
0a04b2a4ed
feat(cve): implemented trivy image scan for multiarch images (#1510)
Signed-off-by: Laurentiu Niculae <niculae.laurentiu1@gmail.com>
2023-07-06 11:36:26 +03:00
Andrei Aaron
c41bf02240
fix(ui): fix login screen when anonymous and auth are both enabled (#1528)
Update to the latest zui version

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-06-16 10:26:03 -07:00
Andrei Aaron
f9f9422d13
ci(disk usage): disk related fixes and improvements (#1524)
ci(workflow): show disk usage and free up disk space used by unneeded tooling
ci(tests): routes tests: do not copy large images if they are not used later
ci(trivy): update a test: download trivy.db to a temporary folder

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-06-15 15:07:28 -07:00
Lisca Ana-Roberta
622dde9193
fix: referrers now appears in swagger generated docs (#1488)
Signed-off-by: Lisca Ana-Roberta <ana.kagome@yahoo.com>
2023-06-12 10:32:11 -07:00
Ramkumar Chinchani
d9e5f33e7e
chore: fix security alerts (#1493)
https://github.com/project-zot/zot/security/code-scanning/4293

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-06-01 16:53:50 -07:00
Andrei Aaron
96d00cd0ef
fix(cve): Fix CVE scanning in images containing Jar files (#1475) 2023-06-01 00:37:46 +03:00
peusebiu
612a12e5a8
refactor(sync): use task scheduler (#1301)
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2023-05-31 10:26:23 -07:00
Andrei Aaron
9ca85e0937
feat(UI): upgrade to a UI which supports user preferences (#1460)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-05-18 09:44:28 -07:00
Andrei Aaron
bf4b2b9b45
fix(makefile): the EXTENSIONS variable was not replaces by BUILD_LABELS in 2 places (#1444)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-05-12 20:59:08 +03:00
Lisca Ana-Roberta
e262fbea64
feat: verifying and enabling necessary extensions for ui (#1369)
Signed-off-by: Ana-Roberta Lisca <ana.kagome@yahoo.com>
2023-05-12 09:43:14 -07:00
Ramkumar Chinchani
9534e0b88b
chore: fix dependabot alerts (#1409)
Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-05-11 16:39:21 -07:00
Andrei Aaron
0f8fb2b5af
fix(ui): update to latest available zui (#1433)
Includes:
- fix: change login page logic
- fix: fixed layer history not updating for multiarch images

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-05-09 08:30:55 -07:00
Andreea Lupu
40bf76add5
chore(go.mod): upgrade trivy and cosign (#1387)
Signed-off-by: Andreea-Lupu <andreealupu1470@yahoo.com>
2023-04-27 09:35:10 -07:00
Andrei Aaron
1a092bd019
feat(ui): UX update for UI (#1391)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-04-27 08:12:15 -07:00
Ramkumar Chinchani
635d07ae04
chore: update golang (to 1.20.x) and golangci-linter (#1388)
Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-04-27 00:09:46 -07:00
LaurentiuNiculae
9cc990d7ca
feat(repodb): add user related information to repodb (#1317)
Initial code was contributed by Bogdan BIVOLARU <104334+bogdanbiv@users.noreply.github.com>
Moved implementation from a separate db to repodb by Andrei Aaron <aaaron@luxoft.com>

Not done yet:
- run/test dynamodb implementation, only boltdb was tested
- add additional coverage for existing functionality
- add web-based APIs to toggle the stars/bookmarks on/off

Initially graphql mutation was discussed for the missing API but
we decided REST endpoints would be better suited for configuration



feat(userdb): complete functionality for userdb integration

- dynamodb rollback changes to user starred repos in case increasing the total star count fails
- dynamodb increment/decrement repostars in repometa when user stars/unstars a repo
- dynamodb check anonymous user permissions are working as intendend
- common test handle anonymous users
- RepoMeta2RepoSummary set IsStarred and IsBookmarked



feat(userdb): rest api calls for toggling stars/bookmarks on/off



test(userdb): blackbox tests



test(userdb): move preferences tests in a different file with specific build tags



feat(repodb): add is-starred and is-bookmarked fields to repo-meta

- removed duplicated logic for determining if a repo is starred/bookmarked

Signed-off-by: Laurentiu Niculae <niculae.laurentiu1@gmail.com>
Co-authored-by: Andrei Aaron <aaaron@luxoft.com>
2023-04-24 11:13:15 -07:00
Andrei Aaron
e63faa8898
fix(csp): upgrade UI and fix zap failure (#1372)
The zap scanner started to check the csp header, which is causing a warning.

We also need to ignore the rule, as both settings are read by the scanner.

Per https://w3c.github.io/webappsec-csp/#example-7bb4ce67 we can have multiple
Content-Security-Policy headers, and the most restrictive policies apply.
This rule doesn't seem to be applied by zap.

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-04-13 13:48:09 -07:00
Ramkumar Chinchani
9638899e6e
test: additional blackbox tests for client push/pull (#1371)
Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-04-13 13:47:38 -07:00
peusebiu
f35ff53146
feat(storage): rebuild storage(s3/local) dedupe index when switching dedupe status (#1062)
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2023-04-07 09:49:24 -07:00
Lisca Ana-Roberta
b679cd2e98
feat(ui): if zui tag is not found for download, it now builds locally from the commit (#1318)
Signed-off-by: Ana-Roberta Lisca <ana.kagome@yahoo.com>
2023-03-30 13:15:48 +03:00
Andrei Aaron
fb85c8678c
feat(ui): update zui to a version which leverages the referrers on ImageSummary (#1293)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-03-22 10:16:35 -07:00
Andrei Aaron
c91d4a0308
feat(ui): upgrade to zui supporting cve search for a specific image (#1290)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-03-21 10:25:59 -07:00
Andrei Aaron
4939ca3300
ci(go.mod): verify go.mod and go.sum don't have uncommitted changes after go mod tidy (#1287)
This is to avoid situations such as https://github.com/project-zot/zot/pull/1150
where an indirect dependency became direct without a corresponding go.mod change

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-03-21 10:25:13 -07:00
LaurentiuNiculae
5d1f91a79f
feat(repodb): update referrers api to use repodb (#1230)
Signed-off-by: Laurentiu Niculae <niculae.laurentiu1@gmail.com>
2023-03-10 10:37:29 -08:00
peusebiu
f04e66a5e2
feat(mgmt): added mgmt extension which returns current zot configuration (#1198)
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2023-03-09 10:43:26 -08:00
Andrei Aaron
fd5a2af10b
feat(ui): zui can now show multiple manifests per image (#1254)
Update to a zui version with multiarch image support
Also fix some issues with the filtering on the global search page

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-03-09 09:00:01 -08:00
Andrei Aaron
c9b594d03d
feat(ui): update to the latest zui version which supports new multiarch image APIs (#1246)
Note patch does not mean full support for showing multiarch images in ZUI,
a single architecture is shown, but it fixes the ZUI views which were broken
since #1147

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-03-06 09:42:05 -08:00
Ramkumar Chinchani
5a2fb4108d
chore(go.mod): fix dependabot alerts (#1228)
Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-02-28 17:38:49 +02:00
Andrei Aaron
5968e7199f
test(ui): add owasp zap scanner in ci/cd (#1224)
(cherry picked from commit 6d03ce5f2d)

Additional changes on top of: 6d03ce5f2d
- Build and use zot from the same branch
do not use a container image as scan target, use the binary
- Fix typo in rules filename
- Add the full rule list to the rules config file
- Ignore some of the specific rules and add reasons
- Add security-related headers to fix some of the issues identified by the scan
- Update UI it includes the latest fixes for zap scan issues

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
Co-authored-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-02-27 11:25:47 -08:00
Andrei Aaron
ed4954ab0d
build(ui): the ui is now included in the zot binary by default (#1202)
Update the default value of the EXTENSIONS variable in the makefile.
Also cleanup binary-ui and other make targets assuming the UI was not included by default.
Enable the ui by default in the zot container image
Swith back to using the distroless images, as c3 only has amd64 images.
Fix updating security events in github (permission issue)
Add an integration test for the UI extension
Rename ui extension files to use _ instead of -
feat(ui): upgrade to zui v2.0.0-rc3

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-02-23 22:28:08 +02:00
Andrei Aaron
0cddb2be3e
feat(ui): use a Makefile variable to download a pre-existing zui build (#1196)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-02-13 22:55:05 +02:00
Andreea Lupu
ee95ab0ffc
fix: call notation-go libs instead of using notation binary (#1104)
fix: add loading notation path

Signed-off-by: Andreea-Lupu <andreealupu1470@yahoo.com>
Co-authored-by: Roxana Nemulescu <roxana.nemulescu@gmail.com>
2023-02-13 10:43:52 -08:00
Andrei Aaron
c0aaca8ed1
feat(ui): package zui within zot binary (#1161)
(cherry picked from commit d557da0baba819b7cd7e6b5941528776e125ac6d)

build(ui): fix stacker builds


(cherry picked from commit ba25daf02b4a9bc7ee1cb6f84b7a6b096ca7d61f)

build(ui): various fixes

- Fix metrics endpoint
- Fix unit tests unit tests
- Make the ui build optional in the makefile
before the linter lint runs in the golangci-lint workflow
- Do not attempt to include UI routes if search is enabled
- Fix authorization for search endpoint



fix: use zot tag in ui make target


(cherry picked from commit 2a6882fa23f06b2d68c6c299773a6ff50bf90e78)

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
Signed-off-by: Catalin Hofnar <catalin.hofnar@gmail.com>
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
Co-authored-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-02-10 14:52:54 -08:00
Andrei Aaron
c1de15c87b
ci: Revert "test: show the execution times of the tests (#1163)" (#1186)
Exit code was not corrctly handled because of the pipes/tee,
so the job would not fail if tests were failing. Reverting this for now.

This reverts commit 74013a71af.

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-02-09 14:28:01 +02:00
Andrei Aaron
74013a71af
test: show the execution times of the tests (#1163)
Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
2023-02-07 20:25:08 +02:00
Ramkumar Chinchani
ca1d4beb2a
ci: also allow manual workflow triggers (#1109)
* ci: also allow manual workflow triggers

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

* ci: add a github actions checker

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2023-01-13 00:49:42 -08:00
peusebiu
7103953777
fix(sync): fix sync on demand with docker library (#1065)
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2022-12-16 09:33:46 -08:00
peusebiu
c82748ab39
Upgrade oras cli (#1021)
* chore: upgrade oras cli

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>

* fix(oci references): referrers API should not return 404 if repo exists

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2022-11-28 10:43:53 -08:00
Catalin-George Hofnar
31b9481713
feat(cache): dynamodb implementation (#953)
Signed-off-by: Catalin Hofnar <catalin.hofnar@gmail.com>
2022-11-22 10:29:57 -08:00
peusebiu
6ee3d802e7
test(sync): added blackbox tests for sync (#1008)
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2022-11-22 10:10:32 -08:00
peusebiu
168d21da1e
fix(storage): deleting manifests with identical digests (#951)
Suppose we push two identical manifests (sharing same digest) but with
different tags, then deleting by digest should throw an error otherwise
we end up deleting all image tags (with gc) or dangling references
(without gc)

This behaviour is controlled via Authorization, added a new policy
action named detectManifestsCollision which enables this behaviour

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>

Co-authored-by: Ramkumar Chinchani <rchincha@cisco.com>
2022-11-18 09:35:28 -08:00
Ramkumar Chinchani
97e7f7f756
build: move build artifacts into build/ (#986)
Unclutter the root dir by moving all docker/stacker build artifacts into
build/ folder.

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2022-11-10 12:09:39 -08:00
Ramkumar Chinchani
c0f93caacb
feat(artifact): add OCI references support (#936)
Thanks @jdolitsky et al for kicking off these changes at:
https://github.com/oci-playground/zot/commits/main

Thanks @sudo-bmitch for reviewing the patch

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>
2022-11-08 00:38:16 -08:00
Nicol
c72b4fb643
test: Add cosign and notations bats tests (#929)
Signed-off-by: Nicol Draghici <idraghic@cisco.com>
2022-11-01 09:16:14 -07:00
Nicol
d93c68af33
test: Build images with annotations (#872)
Signed-off-by: Nicol Draghici <idraghic@cisco.com>
2022-10-18 20:47:41 -07:00
Catalin Hofnar
f3b1913fbd
build: add commit hash to Config at build for proper discovery readme (#854)
* build: add commit hash to Config at build for proper discovery readme link

* fix: use tag instead of commit hash, add to release build

Signed-off-by: Catalin Hofnar <catalin.hofnar@gmail.com>
2022-10-11 09:01:59 -07:00
Andrei Aaron
98854337ff
build(tags): remove redundant build tag ui_base (#857)
It was not used for UI, it had become a CLI dependency
with the same functionality as search

Signed-off-by: Andrei Aaron <andaaron@cisco.com>
2022-10-10 15:05:55 +03:00
Nicol
33a431ef43
Update go version to 1.19 (#829)
* ci: Update go version to 1.19

Signed-off-by: Nicol Draghici <idraghic@cisco.com>

* ci: Fix lint issues

Signed-off-by: Nicol Draghici <idraghic@cisco.com>

* ci: Added needprivileges to lint, made needprivileges pass lint

Signed-off-by: Catalin Hofnar <catalin.hofnar@gmail.com>
Signed-off-by: Nicol Draghici <idraghic@cisco.com>

Signed-off-by: Nicol Draghici <idraghic@cisco.com>
Signed-off-by: Catalin Hofnar <catalin.hofnar@gmail.com>
Co-authored-by: Catalin Hofnar <catalin.hofnar@gmail.com>
2022-10-05 13:21:14 +03:00