Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vendor: github.com/docker/distribution v2.8.2 #45516

Merged
merged 1 commit into from
May 11, 2023

Conversation

thaJeztah
Copy link
Member

@thaJeztah thaJeztah commented May 10, 2023

CI

  • Dockerfile: fix filenames of artifacts

Bugfixes

  • Fix panic in inmemory driver
  • Add code to handle pagination of parts. Fixes max layer size of 10GB bug
  • Parse http forbidden as denied
  • Revert "registry/client: set Accept: identity header when getting layers

Runtime

  • Update to go1.19.9
  • Dockerfile: update xx to v1.2.1 (#3907)

Security

full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

Copy link
Member

@AkihiroSuda AkihiroSuda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you expect this to be merged right now, or shall we wait for v2.8.2 GA?

@thaJeztah
Copy link
Member Author

Wasn't sure TBH 😂 the plan was to have done the v2.8.2 release Yesterday, but GitHub's outages prevented that from happening. This one already contains the fix for the CVE (which doesn't affect us, but might still cause scanners to trigger).

@thaJeztah
Copy link
Member Author

Ok; looks like release is happening today; I'll add a quick commit to bump it to latest in the branch, and move this to draft until it's released

@thaJeztah thaJeztah marked this pull request as draft May 11, 2023 09:38
@thaJeztah thaJeztah force-pushed the vendor_distribution_v2.8.2-beta.2 branch from 3a28d73 to 13f840e Compare May 11, 2023 09:44
CI

- Dockerfile: fix filenames of artifacts

Bugfixes

-  Fix panic in inmemory driver
-  Add code to handle pagination of parts. Fixes max layer size of 10GB bug
-  Parse http forbidden as denied
-  Revert "registry/client: set Accept: identity header when getting layers

Runtime

- Update to go1.19.9
- Dockerfile: update xx to v1.2.1 ([moby#3907](distribution/distribution#3907))

Security

- Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16
- Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d)

full diff: distribution/distribution@v2.8.1...v2.8.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

bump to release/2.8

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah force-pushed the vendor_distribution_v2.8.2-beta.2 branch from 13f840e to 7821d2d Compare May 11, 2023 11:02
@thaJeztah thaJeztah marked this pull request as ready for review May 11, 2023 11:03
@thaJeztah thaJeztah added this to the 25.0.0 milestone May 11, 2023
@thaJeztah thaJeztah merged commit d922f94 into moby:master May 11, 2023
95 checks passed
@thaJeztah thaJeztah deleted the vendor_distribution_v2.8.2-beta.2 branch May 11, 2023 12:59
@thaJeztah thaJeztah changed the title vendor: github.com/docker/distribution v2.8.2-beta.2 vendor: github.com/docker/distribution v2.8.2 May 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants