Bring fork up-to-date - #4
Merged
Merged
Conversation
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.8.4. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.8.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.3 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.11...v7.5.16) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Fix flaky tests due to change in feature configuration.
Validate registry-provided bearer realms, restrict cross-origin credential forwarding, and add an explicit registry-to-auth-host compatibility option. Co-authored-by: Kaniska <kaniska244@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Propagate cross-origin auth host mappings explicitly through command, resolver, and registry request parameters instead of serializing them through the process environment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Treat an exact registry-to-auth-host mapping as authorization for the complete token exchange, including Docker identity and refresh tokens. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use the literal HTTP authentication scheme instead of constructing it at runtime. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Parse and validate token realms once before credential lookup and reuse that decision for the complete trusted authentication exchange. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Name the redirect-origin check after the requested registry credentials it protects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Gate realm restrictions, registry credential origin checks, and token redirect refusal behind --oci-auth-hardening while preserving legacy behavior by default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collect shadow diagnostics for blocked auth realms, registry redirects that prevent credential forwarding, and token redirects, and surface them in CLI results. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document the opt-in OCI authentication hardening and compatibility diagnostics release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Require a shared diagnostics collector, reuse test parameter helpers, and only report registry redirects that end in an authentication challenge and would change credential forwarding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Disable the static Podman bundle's single-owner storage mode before Feature builds so APT can use its unprivileged sandbox. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Create the rootless user override from the system storage config when the hosted runner has not materialized a user config file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This reverts commit 0c9f4ca.
This reverts commit 98e182e.
Pin the external static-build recipe to an immutable commit while keeping the existing rootless Podman Feature workloads unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#1271) * fix: set default base image in Dockerfiles and improve syntax handling * Retrigger test * Addressing review comments. * Retrigger tests * Fixing failing tests due to change in terraform feature to add hard dependency of github-cli feature. * Removing unrelated test fixes * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Abdurrahmaan Iqbal <abdurriq@github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use a generated, trusted localhost certificate in the refresh-token integration test without changing production CA handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Store the HTTP or HTTPS scheme on parsed OCI references so registry endpoints do not rely on implicit transport downgrades. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.21. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.16...v7.5.21) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.21 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.5.0. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.5.0) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.5.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.9.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.9.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Prevent cross-origin upload continuations from receiving or caching credentials belonging to the original registry while retaining known Docker Hub aliases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Propagate OCI authentication hardening through feature test launches and preserve credentials across trusted Docker Hub registry aliases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Harden OCI registry authentication
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the fork up to date with
devcontainers/cli, from v0.87.1 to v0.89.0.Upstream publishes no releases, so the notes below are taken from the tags themselves.
v0.89.0
Mostly a security pass over OCI registry authentication, plus dependency bumps.
v0.88.0
Version
Upstream is at
0.89.0. This fork takes0.89.1, so a build of ours is told apart from a build of theirs.