-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Verify manifest before accepting #12182
Verify manifest before accepting #12182
Conversation
if err != nil { | ||
if err != distribution.ErrBlobUnknown { | ||
errs = append(errs, err) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You probably want to continue here otherwise you will append the error below too, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same for the schema2 handler
70e9f00
to
cbdcf19
Compare
the yum flake beast went rampage |
Yum flake #8571. re-[test] |
Signed-off-by: Michal Minář <[email protected]>
Mostly copied from docker/distribution repo. Signed-off-by: Michal Minář <[email protected]>
cbdcf19
to
57f9cf6
Compare
Updated 1st commit to match the one in #11925. |
LGTM, tagging for merge after green tests. |
Evaluated for origin test up to 57f9cf6 |
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/12510/) (Base Commit: 07050d7) |
[merge] |
Evaluated for origin merge up to 57f9cf6 |
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/12510/) (Base Commit: 3c68360) (Image: devenv-rhel7_5573) |
Referenced blobs need to be checked for presence in a destination repository before accepting incoming manifest. Otherwise, user will be able to pull image without previous access to its blobs.
Resolves bz#1388018
Blocked on #11925