Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package regclient for openSUSE:Factory checked in at 2026-04-18 21:35:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/regclient (Old) and /work/SRC/openSUSE:Factory/.regclient.new.11940 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "regclient" Sat Apr 18 21:35:38 2026 rev:14 rq:1347876 version:0.11.3 Changes: -------- --- /work/SRC/openSUSE:Factory/regclient/regclient.changes 2026-02-25 21:21:46.917856716 +0100 +++ /work/SRC/openSUSE:Factory/.regclient.new.11940/regclient.changes 2026-04-18 21:35:52.964359888 +0200 @@ -1,0 +2,8 @@ +Sat Apr 18 05:34:43 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.11.3: + * Features: + - Add support for pushing digest with tags. (PR 1062) + - Handle OCI-Tag headers with comma separators. (PR 1070) + +------------------------------------------------------------------- Old: ---- regclient-0.11.2.obscpio New: ---- regclient-0.11.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ regclient.spec ++++++ --- /var/tmp/diff_new_pack.b4iUmA/_old 2026-04-18 21:35:53.792393635 +0200 +++ /var/tmp/diff_new_pack.b4iUmA/_new 2026-04-18 21:35:53.796393798 +0200 @@ -17,7 +17,7 @@ Name: regclient -Version: 0.11.2 +Version: 0.11.3 Release: 0 Summary: OCI Registry Client in Go and tooling using those libraries License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.b4iUmA/_old 2026-04-18 21:35:53.836395428 +0200 +++ /var/tmp/diff_new_pack.b4iUmA/_new 2026-04-18 21:35:53.840395591 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/regclient/regclient</param> <param name="scm">git</param> <param name="package-meta">yes</param> - <param name="revision">v0.11.2</param> + <param name="revision">v0.11.3</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.b4iUmA/_old 2026-04-18 21:35:53.884397385 +0200 +++ /var/tmp/diff_new_pack.b4iUmA/_new 2026-04-18 21:35:53.896397873 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/regclient/regclient</param> - <param name="changesrevision">584b70d53427faad17a860e215ce2cd0cb76059f</param></service></servicedata> + <param name="changesrevision">1736a5711c8d6f71b40a279673c0023077709049</param></service></servicedata> (No newline at EOF) ++++++ regclient-0.11.2.obscpio -> regclient-0.11.3.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/HEAD new/regclient-0.11.3/.git/HEAD --- old/regclient-0.11.2/.git/HEAD 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/HEAD 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -584b70d53427faad17a860e215ce2cd0cb76059f +1736a5711c8d6f71b40a279673c0023077709049 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/ORIG_HEAD new/regclient-0.11.3/.git/ORIG_HEAD --- old/regclient-0.11.2/.git/ORIG_HEAD 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/ORIG_HEAD 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -584b70d53427faad17a860e215ce2cd0cb76059f +1736a5711c8d6f71b40a279673c0023077709049 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/applypatch-msg.sample new/regclient-0.11.3/.git/hooks/applypatch-msg.sample --- old/regclient-0.11.2/.git/hooks/applypatch-msg.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/applypatch-msg.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to check the commit log message taken by # applypatch from an e-mail message. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/commit-msg.sample new/regclient-0.11.3/.git/hooks/commit-msg.sample --- old/regclient-0.11.2/.git/hooks/commit-msg.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/commit-msg.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to check the commit log message. # Called by "git commit" with one argument, the name of the file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/fsmonitor-watchman.sample new/regclient-0.11.3/.git/hooks/fsmonitor-watchman.sample --- old/regclient-0.11.2/.git/hooks/fsmonitor-watchman.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/fsmonitor-watchman.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/x98jdz78m80ld103an9hvy0nqbp2capk-perl-5.40.0/bin/perl +#!/nix/store/x17gg3w7lcwiqscqmif25688sivchwsn-perl-5.40.0/bin/perl use strict; use warnings; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/post-update.sample new/regclient-0.11.3/.git/hooks/post-update.sample --- old/regclient-0.11.2/.git/hooks/post-update.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/post-update.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to prepare a packed repository for use over # dumb transports. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-applypatch.sample new/regclient-0.11.3/.git/hooks/pre-applypatch.sample --- old/regclient-0.11.2/.git/hooks/pre-applypatch.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-applypatch.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to verify what is about to be committed # by applypatch from an e-mail message. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-commit.sample new/regclient-0.11.3/.git/hooks/pre-commit.sample --- old/regclient-0.11.2/.git/hooks/pre-commit.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-commit.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to verify what is about to be committed. # Called by "git commit" with no arguments. The hook should diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-merge-commit.sample new/regclient-0.11.3/.git/hooks/pre-merge-commit.sample --- old/regclient-0.11.2/.git/hooks/pre-merge-commit.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-merge-commit.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to verify what is about to be committed. # Called by "git merge" with no arguments. The hook should diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-push.sample new/regclient-0.11.3/.git/hooks/pre-push.sample --- old/regclient-0.11.2/.git/hooks/pre-push.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-push.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # An example hook script to verify what is about to be pushed. Called by "git # push" after it has checked the remote status, but before anything has been diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-rebase.sample new/regclient-0.11.3/.git/hooks/pre-rebase.sample --- old/regclient-0.11.2/.git/hooks/pre-rebase.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-rebase.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # Copyright (c) 2006, 2008 Junio C Hamano # @@ -65,7 +65,7 @@ fi else not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` - /nix/store/x98jdz78m80ld103an9hvy0nqbp2capk-perl-5.40.0/bin/perl -e ' + /nix/store/x17gg3w7lcwiqscqmif25688sivchwsn-perl-5.40.0/bin/perl -e ' my $topic = $ARGV[0]; my $msg = "* $topic has commits already merged to public branch:\n"; my (%not_in_next) = map { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/pre-receive.sample new/regclient-0.11.3/.git/hooks/pre-receive.sample --- old/regclient-0.11.2/.git/hooks/pre-receive.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/pre-receive.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to make use of push options. # The example simply echoes all push options that start with 'echoback=' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/prepare-commit-msg.sample new/regclient-0.11.3/.git/hooks/prepare-commit-msg.sample --- old/regclient-0.11.2/.git/hooks/prepare-commit-msg.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/prepare-commit-msg.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to prepare the commit log message. # Called by "git commit" with the name of the file that has the @@ -24,11 +24,11 @@ COMMIT_SOURCE=$2 SHA1=$3 -/nix/store/x98jdz78m80ld103an9hvy0nqbp2capk-perl-5.40.0/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" +/nix/store/x17gg3w7lcwiqscqmif25688sivchwsn-perl-5.40.0/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" # case "$COMMIT_SOURCE,$SHA1" in # ,|template,) -# /nix/store/x98jdz78m80ld103an9hvy0nqbp2capk-perl-5.40.0/bin/perl -i.bak -pe ' +# /nix/store/x17gg3w7lcwiqscqmif25688sivchwsn-perl-5.40.0/bin/perl -i.bak -pe ' # print "\n" . `git diff --cached --name-status -r` # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; # *) ;; @@ -38,5 +38,5 @@ # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" # if test -z "$COMMIT_SOURCE" # then -# /nix/store/x98jdz78m80ld103an9hvy0nqbp2capk-perl-5.40.0/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" +# /nix/store/x17gg3w7lcwiqscqmif25688sivchwsn-perl-5.40.0/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" # fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/push-to-checkout.sample new/regclient-0.11.3/.git/hooks/push-to-checkout.sample --- old/regclient-0.11.2/.git/hooks/push-to-checkout.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/push-to-checkout.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # An example hook script to update a checked-out tree on a git push. # diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/sendemail-validate.sample new/regclient-0.11.3/.git/hooks/sendemail-validate.sample --- old/regclient-0.11.2/.git/hooks/sendemail-validate.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/sendemail-validate.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # An example hook script to validate a patch (and/or patch series) before # sending it via email. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/hooks/update.sample new/regclient-0.11.3/.git/hooks/update.sample --- old/regclient-0.11.2/.git/hooks/update.sample 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/hooks/update.sample 2026-04-13 15:53:47.000000000 +0200 @@ -1,4 +1,4 @@ -#!/nix/store/fwr62xmh06l8y8zfgc5m18pfap9b8az0-bash-5.3p3/bin/bash +#!/nix/store/wv8bpzriikv65xnd1vciqpq7rnr8h2q2-bash-5.3p3/bin/bash # # An example hook script to block unannotated tags from entering. # Called by "git receive-pack" with arguments: refname sha1-old sha1-new Binary files old/regclient-0.11.2/.git/index and new/regclient-0.11.3/.git/index differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/logs/HEAD new/regclient-0.11.3/.git/logs/HEAD --- old/regclient-0.11.2/.git/logs/HEAD 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/logs/HEAD 2026-04-13 15:53:47.000000000 +0200 @@ -1,2 +1,2 @@ -0000000000000000000000000000000000000000 8bcf15db1052236ed08febdc218cc2b4cc41b667 kastl <[email protected]> 1772013963 +0100 clone: from https://github.com/regclient/regclient -8bcf15db1052236ed08febdc218cc2b4cc41b667 584b70d53427faad17a860e215ce2cd0cb76059f kastl <[email protected]> 1772013963 +0100 checkout: moving from main to v0.11.2 +0000000000000000000000000000000000000000 395d84b6c97ada5174f4aa91770cbd14fe1acb60 kastl <[email protected]> 1776490482 +0200 clone: from https://github.com/regclient/regclient +395d84b6c97ada5174f4aa91770cbd14fe1acb60 1736a5711c8d6f71b40a279673c0023077709049 kastl <[email protected]> 1776490482 +0200 checkout: moving from main to v0.11.3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/logs/refs/heads/main new/regclient-0.11.3/.git/logs/refs/heads/main --- old/regclient-0.11.2/.git/logs/refs/heads/main 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/logs/refs/heads/main 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -0000000000000000000000000000000000000000 8bcf15db1052236ed08febdc218cc2b4cc41b667 kastl <[email protected]> 1772013963 +0100 clone: from https://github.com/regclient/regclient +0000000000000000000000000000000000000000 395d84b6c97ada5174f4aa91770cbd14fe1acb60 kastl <[email protected]> 1776490482 +0200 clone: from https://github.com/regclient/regclient diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/logs/refs/remotes/origin/HEAD new/regclient-0.11.3/.git/logs/refs/remotes/origin/HEAD --- old/regclient-0.11.2/.git/logs/refs/remotes/origin/HEAD 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/logs/refs/remotes/origin/HEAD 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -0000000000000000000000000000000000000000 8bcf15db1052236ed08febdc218cc2b4cc41b667 kastl <[email protected]> 1772013963 +0100 clone: from https://github.com/regclient/regclient +0000000000000000000000000000000000000000 395d84b6c97ada5174f4aa91770cbd14fe1acb60 kastl <[email protected]> 1776490482 +0200 clone: from https://github.com/regclient/regclient Binary files old/regclient-0.11.2/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.idx and new/regclient-0.11.3/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.idx differ Binary files old/regclient-0.11.2/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.pack and new/regclient-0.11.3/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.pack differ Binary files old/regclient-0.11.2/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.rev and new/regclient-0.11.3/.git/objects/pack/pack-324493255ac6f07212c00fa49f68ef0e4b3d3b41.rev differ Binary files old/regclient-0.11.2/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.idx and new/regclient-0.11.3/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.idx differ Binary files old/regclient-0.11.2/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.pack and new/regclient-0.11.3/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.pack differ Binary files old/regclient-0.11.2/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.rev and new/regclient-0.11.3/.git/objects/pack/pack-c833f5f4a5cddba420ca4ef16b447f76ca7d395a.rev differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/packed-refs new/regclient-0.11.3/.git/packed-refs --- old/regclient-0.11.2/.git/packed-refs 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/packed-refs 2026-04-13 15:53:47.000000000 +0200 @@ -1,8 +1,8 @@ # pack-refs with: peeled fully-peeled sorted -8bcf15db1052236ed08febdc218cc2b4cc41b667 refs/remotes/origin/main +395d84b6c97ada5174f4aa91770cbd14fe1acb60 refs/remotes/origin/main daa734a0b4dc9c19231cfe691a241f0ce2a7b2f4 refs/remotes/origin/releases/0.0 c3de9bb7b04ad3cd96bb73bc0c72986b83572d12 refs/remotes/origin/releases/0.10 -584b70d53427faad17a860e215ce2cd0cb76059f refs/remotes/origin/releases/0.11 +1736a5711c8d6f71b40a279673c0023077709049 refs/remotes/origin/releases/0.11 4c6dd972a3c609f7c0997bb6e464aee431f8c971 refs/remotes/origin/releases/0.2 6a1a13c410f734f5e18a6032936bc6764814eae7 refs/remotes/origin/releases/0.3 847254c7ac7d6f027dcdfb196a9aa4c11eb61ed9 refs/remotes/origin/releases/0.4 @@ -31,6 +31,8 @@ ^bf3bcfc47173b49ee8000d1d3a1ac15036e83cf0 eb70ddf21826288906aac271913dbfda075fc836 refs/tags/v0.11.2 ^584b70d53427faad17a860e215ce2cd0cb76059f +9d59e2873b9a110b5e33755ec137e5ec9674cf87 refs/tags/v0.11.3 +^1736a5711c8d6f71b40a279673c0023077709049 f5e39881d000960a706d1840f2a43eac7b3fd9de refs/tags/v0.2.0 ^5906ef88ec6ec3f6709d286756d27b77982fa55b 25bacba961cde26845ce0bf5a90edbb8a2bdb2e4 refs/tags/v0.2.1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.git/refs/heads/main new/regclient-0.11.3/.git/refs/heads/main --- old/regclient-0.11.2/.git/refs/heads/main 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.git/refs/heads/main 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -8bcf15db1052236ed08febdc218cc2b4cc41b667 +395d84b6c97ada5174f4aa91770cbd14fe1acb60 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.github/workflows/ci-registry.yml new/regclient-0.11.3/.github/workflows/ci-registry.yml --- old/regclient-0.11.2/.github/workflows/ci-registry.yml 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.github/workflows/ci-registry.yml 2026-04-13 15:53:47.000000000 +0200 @@ -26,7 +26,7 @@ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Set up Go ${{ env.RELEASE_GO_VER }}" - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "${{ env.RELEASE_GO_VER }}" check-latest: true diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.github/workflows/docker.yml new/regclient-0.11.3/.github/workflows/docker.yml --- old/regclient-0.11.2/.github/workflows/docker.yml 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.github/workflows/docker.yml 2026-04-13 15:53:47.000000000 +0200 @@ -87,25 +87,25 @@ echo "repo_url=${REPO_URL}" >>$GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Login to DockerHub if: github.repository_owner == 'regclient' - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to GHCR if: github.repository_owner == 'regclient' - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ghcr.io username: ${{ secrets.GHCR_USERNAME }} password: ${{ secrets.GHCR_TOKEN }} - name: Build - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 id: build with: context: . @@ -122,20 +122,20 @@ - name: Install cosign if: github.event_name != 'pull_request' && github.repository_owner == 'regclient' - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 + uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 with: - cosign-release: "v3.0.5" + cosign-release: "v3.0.6" - name: Install syft if: github.event_name != 'pull_request' && github.repository_owner == 'regclient' - uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2 + uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 id: syft with: - syft-version: "v1.42.1" + syft-version: "v1.42.4" # Dogfooding, use regctl to modify regclient images to improve reproducibility - name: Install regctl - uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main + uses: regclient/actions/regctl-installer@f07124ffba4b0cbf96b2a666d481ed9d44b5e7e4 # main if: github.event_name != 'pull_request' && github.repository_owner == 'regclient' with: release: main diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.github/workflows/go.yml new/regclient-0.11.3/.github/workflows/go.yml --- old/regclient-0.11.2/.github/workflows/go.yml 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.github/workflows/go.yml 2026-04-13 15:53:47.000000000 +0200 @@ -35,7 +35,7 @@ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Set up Go ${{ matrix.gover }}" - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "${{ matrix.gover }}" check-latest: true @@ -60,10 +60,10 @@ - name: Install syft if: startsWith( github.ref, 'refs/tags/v' ) || github.ref == 'refs/heads/main' - uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2 + uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 id: syft with: - syft-version: "v1.42.1" + syft-version: "v1.42.4" - name: Build artifacts if: startsWith( github.ref, 'refs/tags/v' ) || github.ref == 'refs/heads/main' @@ -71,9 +71,9 @@ - name: Install cosign if: ( startsWith( github.ref, 'refs/tags/v' ) || github.ref == 'refs/heads/main' ) && matrix.gover == env.RELEASE_GO_VER - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 + uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 with: - cosign-release: "v3.0.5" + cosign-release: "v3.0.6" - name: Package artifacts if: ( startsWith( github.ref, 'refs/tags/v' ) || github.ref == 'refs/heads/main' ) && matrix.gover == env.RELEASE_GO_VER @@ -129,7 +129,7 @@ - name: Create release if: steps.release_details.outputs.valid == 'true' && matrix.gover == env.RELEASE_GO_VER id: release_create - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -169,7 +169,7 @@ - name: Save artifacts if: github.ref == 'refs/heads/main' && matrix.gover == env.RELEASE_GO_VER - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: binaries path: ./artifacts/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.github/workflows/vulnscans.yml new/regclient-0.11.3/.github/workflows/vulnscans.yml --- old/regclient-0.11.2/.github/workflows/vulnscans.yml 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.github/workflows/vulnscans.yml 2026-04-13 15:53:47.000000000 +0200 @@ -20,7 +20,7 @@ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Set up Go" - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "${{ env.RELEASE_GO_VER }}" check-latest: true diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.osv-scanner.toml new/regclient-0.11.3/.osv-scanner.toml --- old/regclient-0.11.2/.osv-scanner.toml 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.osv-scanner.toml 2026-04-13 15:53:47.000000000 +0200 @@ -1 +1 @@ -GoVersionOverride = "1.26.0" +GoVersionOverride = "1.26.2" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/.version-bump.lock new/regclient-0.11.3/.version-bump.lock --- old/regclient-0.11.2/.version-bump.lock 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/.version-bump.lock 2026-04-13 15:53:47.000000000 +0200 @@ -1,53 +1,53 @@ {"name":"docker-arg-alpine-digest","key":"docker.io/library/alpine:3.23.3","version":"sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659"} {"name":"docker-arg-alpine-tag","key":"docker.io/library/alpine","version":"3.23.3"} -{"name":"docker-arg-ecr","key":"https://github.com/awslabs/amazon-ecr-credential-helper.git","version":"v0.11.0"} +{"name":"docker-arg-ecr","key":"https://github.com/awslabs/amazon-ecr-credential-helper.git","version":"v0.12.0"} {"name":"docker-arg-gcr","key":"https://github.com/GoogleCloudPlatform/docker-credential-gcr.git","version":"v2.1.32"} -{"name":"docker-arg-go-digest","key":"docker.io/library/golang:1.26.0-alpine","version":"sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5"} -{"name":"docker-arg-go-tag","key":"docker.io/library/golang","version":"1.26.0"} +{"name":"docker-arg-go-digest","key":"docker.io/library/golang:1.26.2-alpine","version":"sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166"} +{"name":"docker-arg-go-tag","key":"docker.io/library/golang","version":"1.26.2"} {"name":"docker-arg-lunajson","key":"https://github.com/grafi-tt/lunajson.git:master","version":"e3a9666eb1275741e887e29926b144f8daee3bef"} {"name":"docker-arg-semver","key":"https://github.com/kikito/semver.lua.git:master","version":"a4b708ba243208d46e575da870af969dca46a94d"} {"name":"gha-alpine-digest","key":"docker.io/library/alpine:3.23.3","version":"sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659"} {"name":"gha-alpine-tag-base","key":"docker.io/library/alpine","version":"3"} {"name":"gha-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.23.3"} -{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v3.0.5"} +{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v3.0.6"} {"name":"gha-golang-matrix","key":"golang-matrix","version":"[\"1.25\", \"1.26\"]"} {"name":"gha-golang-release","key":"golang-latest","version":"1.26"} -{"name":"gha-syft-version","key":"docker.io/anchore/syft","version":"v1.42.1"} +{"name":"gha-syft-version","key":"docker.io/anchore/syft","version":"v1.42.4"} {"name":"gha-uses-commit","key":"https://github.com/actions/checkout.git:v6.0.2","version":"de0fac2e4500dabe0009e67214ff5f5447ce83dd"} -{"name":"gha-uses-commit","key":"https://github.com/actions/setup-go.git:v6.2.0","version":"7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5"} +{"name":"gha-uses-commit","key":"https://github.com/actions/setup-go.git:v6.4.0","version":"4a3601121dd01d1626a1e23e37211e3254c1c06c"} {"name":"gha-uses-commit","key":"https://github.com/actions/stale.git:v10.2.0","version":"b5d41d4e1d5dceea10e7104786b73624c18a190f"} -{"name":"gha-uses-commit","key":"https://github.com/actions/upload-artifact.git:v6.0.0","version":"b7c566a772e6b6bfb58ed0dc250532a479d7789f"} -{"name":"gha-uses-commit","key":"https://github.com/anchore/sbom-action.git:v0.22.2","version":"28d71544de8eaf1b958d335707167c5f783590ad"} -{"name":"gha-uses-commit","key":"https://github.com/docker/build-push-action.git:v6.19.2","version":"10e90e3645eae34f1e60eeb005ba3a3d33f178e8"} -{"name":"gha-uses-commit","key":"https://github.com/docker/login-action.git:v3.7.0","version":"c94ce9fb468520275223c153574b00df6fe4bcc9"} -{"name":"gha-uses-commit","key":"https://github.com/docker/setup-buildx-action.git:v3.12.0","version":"8d2750c68a42422c14e847fe6c8ac0403b4cbd6f"} -{"name":"gha-uses-commit","key":"https://github.com/regclient/actions.git:main","version":"da9319db8e44e8b062b3a147e1dfb2f574d41a03"} -{"name":"gha-uses-commit","key":"https://github.com/sigstore/cosign-installer.git:v4.0.0","version":"faadad0cce49287aee09b3a48701e75088a2c6ad"} -{"name":"gha-uses-commit","key":"https://github.com/softprops/action-gh-release.git:v2.5.0","version":"a06a81a03ee405af7f2048a818ed3f03bbf83c7b"} +{"name":"gha-uses-commit","key":"https://github.com/actions/upload-artifact.git:v7.0.1","version":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"} +{"name":"gha-uses-commit","key":"https://github.com/anchore/sbom-action.git:v0.24.0","version":"e22c389904149dbc22b58101806040fa8d37a610"} +{"name":"gha-uses-commit","key":"https://github.com/docker/build-push-action.git:v7.1.0","version":"bcafcacb16a39f128d818304e6c9c0c18556b85f"} +{"name":"gha-uses-commit","key":"https://github.com/docker/login-action.git:v4.1.0","version":"4907a6ddec9925e35a0a9e82d7399ccc52663121"} +{"name":"gha-uses-commit","key":"https://github.com/docker/setup-buildx-action.git:v4.0.0","version":"4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"} +{"name":"gha-uses-commit","key":"https://github.com/regclient/actions.git:main","version":"f07124ffba4b0cbf96b2a666d481ed9d44b5e7e4"} +{"name":"gha-uses-commit","key":"https://github.com/sigstore/cosign-installer.git:v4.1.1","version":"cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003"} +{"name":"gha-uses-commit","key":"https://github.com/softprops/action-gh-release.git:v3.0.0","version":"b4309332981a82ec1c5618f44dd2e27cc8bfbfda"} {"name":"gha-uses-semver","key":"https://github.com/actions/checkout.git","version":"v6.0.2"} -{"name":"gha-uses-semver","key":"https://github.com/actions/setup-go.git","version":"v6.2.0"} +{"name":"gha-uses-semver","key":"https://github.com/actions/setup-go.git","version":"v6.4.0"} {"name":"gha-uses-semver","key":"https://github.com/actions/stale.git","version":"v10.2.0"} -{"name":"gha-uses-semver","key":"https://github.com/actions/upload-artifact.git","version":"v6.0.0"} -{"name":"gha-uses-semver","key":"https://github.com/anchore/sbom-action.git","version":"v0.22.2"} -{"name":"gha-uses-semver","key":"https://github.com/docker/build-push-action.git","version":"v6.19.2"} -{"name":"gha-uses-semver","key":"https://github.com/docker/login-action.git","version":"v3.7.0"} -{"name":"gha-uses-semver","key":"https://github.com/docker/setup-buildx-action.git","version":"v3.12.0"} -{"name":"gha-uses-semver","key":"https://github.com/sigstore/cosign-installer.git","version":"v4.0.0"} -{"name":"gha-uses-semver","key":"https://github.com/softprops/action-gh-release.git","version":"v2.5.0"} +{"name":"gha-uses-semver","key":"https://github.com/actions/upload-artifact.git","version":"v7.0.1"} +{"name":"gha-uses-semver","key":"https://github.com/anchore/sbom-action.git","version":"v0.24.0"} +{"name":"gha-uses-semver","key":"https://github.com/docker/build-push-action.git","version":"v7.1.0"} +{"name":"gha-uses-semver","key":"https://github.com/docker/login-action.git","version":"v4.1.0"} +{"name":"gha-uses-semver","key":"https://github.com/docker/setup-buildx-action.git","version":"v4.0.0"} +{"name":"gha-uses-semver","key":"https://github.com/sigstore/cosign-installer.git","version":"v4.1.1"} +{"name":"gha-uses-semver","key":"https://github.com/softprops/action-gh-release.git","version":"v3.0.0"} {"name":"go-mod-golang-release","key":"golang-oldest","version":"1.25.0"} -{"name":"makefile-ci-distribution","key":"docker.io/library/registry","version":"3.0.0"} -{"name":"makefile-ci-zot","key":"ghcr.io/project-zot/zot-linux-amd64","version":"v2.1.14"} +{"name":"makefile-ci-distribution","key":"docker.io/library/registry","version":"3.1.0"} +{"name":"makefile-ci-zot","key":"ghcr.io/project-zot/zot-linux-amd64","version":"v2.1.15"} {"name":"makefile-go-vulncheck","key":"https://go.googlesource.com/vuln.git","version":"v1.1.4"} {"name":"makefile-gofumpt","key":"https://github.com/mvdan/gofumpt.git","version":"v0.9.2"} {"name":"makefile-gomajor","key":"https://github.com/icholy/gomajor.git","version":"v0.15.0"} -{"name":"makefile-gosec","key":"https://github.com/securego/gosec.git","version":"v2.23.0"} -{"name":"makefile-markdown-lint","key":"docker.io/davidanson/markdownlint-cli2","version":"v0.21.0"} -{"name":"makefile-osv-scanner","key":"https://github.com/google/osv-scanner.git","version":"v2.3.3"} +{"name":"makefile-gosec","key":"https://github.com/securego/gosec.git","version":"v2.25.0"} +{"name":"makefile-markdown-lint","key":"docker.io/davidanson/markdownlint-cli2","version":"v0.22.0"} +{"name":"makefile-osv-scanner","key":"https://github.com/google/osv-scanner.git","version":"v2.3.5"} {"name":"makefile-staticcheck","key":"https://github.com/dominikh/go-tools.git","version":"v0.7.0"} -{"name":"makefile-syft-container-digest","key":"anchore/syft:v1.42.1","version":"sha256:392b65f29a410d2c1294d347bb3ad6f37608345ab6e7b43d2df03ea18bd6f5b0"} -{"name":"makefile-syft-container-tag","key":"anchore/syft","version":"v1.42.1"} -{"name":"makefile-syft-version","key":"docker.io/anchore/syft","version":"v1.42.1"} -{"name":"osv-golang-release","key":"docker.io/library/golang","version":"1.26.0"} +{"name":"makefile-syft-container-digest","key":"anchore/syft:v1.42.4","version":"sha256:e9f29bec38cc856bfd3a7966d2f99711b5b244a531bf121da9de3b47789eecfa"} +{"name":"makefile-syft-container-tag","key":"anchore/syft","version":"v1.42.4"} +{"name":"makefile-syft-version","key":"docker.io/anchore/syft","version":"v1.42.4"} +{"name":"osv-golang-release","key":"docker.io/library/golang","version":"1.26.2"} {"name":"shell-alpine-digest","key":"docker.io/library/alpine:3.23.3","version":"sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659"} {"name":"shell-alpine-tag-base","key":"docker.io/library/alpine","version":"3"} {"name":"shell-alpine-tag-comment","key":"docker.io/library/alpine","version":"3.23.3"} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/Makefile new/regclient-0.11.3/Makefile --- old/regclient-0.11.2/Makefile 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/Makefile 2026-04-13 15:53:47.000000000 +0200 @@ -35,16 +35,16 @@ -u "$(shell id -u):$(shell id -g)" \ $(VER_BUMP_CONTAINER) endif -MARKDOWN_LINT_VER?=v0.21.0 +MARKDOWN_LINT_VER?=v0.22.0 GOFUMPT_VER?=v0.9.2 GOMAJOR_VER?=v0.15.0 -GOSEC_VER?=v2.23.0 +GOSEC_VER?=v2.25.0 GO_VULNCHECK_VER?=v1.1.4 -OSV_SCANNER_VER?=v2.3.3 +OSV_SCANNER_VER?=v2.3.5 SYFT?=$(shell command -v syft 2>/dev/null) SYFT_CMD_VER:=$(shell [ -x "$(SYFT)" ] && echo "v$$($(SYFT) version | awk '/^Version: / {print $$2}')" || echo "0") -SYFT_VERSION?=v1.42.1 -SYFT_CONTAINER?=anchore/syft:v1.42.1@sha256:392b65f29a410d2c1294d347bb3ad6f37608345ab6e7b43d2df03ea18bd6f5b0 +SYFT_VERSION?=v1.42.4 +SYFT_CONTAINER?=anchore/syft:v1.42.4@sha256:e9f29bec38cc856bfd3a7966d2f99711b5b244a531bf121da9de3b47789eecfa ifneq "$(SYFT_CMD_VER)" "$(SYFT_VERSION)" SYFT=docker run --rm \ -v "$(shell pwd)/:$(shell pwd)/" -w "$(shell pwd)" \ @@ -52,8 +52,8 @@ $(SYFT_CONTAINER) endif STATICCHECK_VER?=v0.7.0 -CI_DISTRIBUTION_VER?=3.0.0 -CI_ZOT_VER?=v2.1.14 +CI_DISTRIBUTION_VER?=3.1.0 +CI_ZOT_VER?=v2.1.15 .PHONY: .FORCE .FORCE: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regbot new/regclient-0.11.3/build/Dockerfile.regbot --- old/regclient-0.11.2/build/Dockerfile.regbot 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regbot 2026-04-13 15:53:47.000000000 +0200 @@ -1,7 +1,7 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG LUNAJSON_COMMIT=e3a9666eb1275741e887e29926b144f8daee3bef ARG SEMVER_COMMIT=a4b708ba243208d46e575da870af969dca46a94d diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regbot.buildkit new/regclient-0.11.3/build/Dockerfile.regbot.buildkit --- old/regclient-0.11.2/build/Dockerfile.regbot.buildkit 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regbot.buildkit 2026-04-13 15:53:47.000000000 +0200 @@ -2,8 +2,8 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG LUNAJSON_COMMIT=e3a9666eb1275741e887e29926b144f8daee3bef ARG SEMVER_COMMIT=a4b708ba243208d46e575da870af969dca46a94d diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regctl new/regclient-0.11.3/build/Dockerfile.regctl --- old/regclient-0.11.2/build/Dockerfile.regctl 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regctl 2026-04-13 15:53:47.000000000 +0200 @@ -1,7 +1,7 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG VCS_VERSION=(devel) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regctl.buildkit new/regclient-0.11.3/build/Dockerfile.regctl.buildkit --- old/regclient-0.11.2/build/Dockerfile.regctl.buildkit 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regctl.buildkit 2026-04-13 15:53:47.000000000 +0200 @@ -2,8 +2,8 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG VCS_VERSION=(devel) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regsync new/regclient-0.11.3/build/Dockerfile.regsync --- old/regclient-0.11.2/build/Dockerfile.regsync 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regsync 2026-04-13 15:53:47.000000000 +0200 @@ -1,7 +1,7 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG VCS_VERSION=(devel) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/build/Dockerfile.regsync.buildkit new/regclient-0.11.3/build/Dockerfile.regsync.buildkit --- old/regclient-0.11.2/build/Dockerfile.regsync.buildkit 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/build/Dockerfile.regsync.buildkit 2026-04-13 15:53:47.000000000 +0200 @@ -2,8 +2,8 @@ ARG REGISTRY=docker.io ARG ALPINE_VER=3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 -ARG GO_VER=1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 -ARG ECR_HELPER_VER=v0.11.0 +ARG GO_VER=1.26.2-alpine@sha256:c2a1f7b2095d046ae14b286b18413a05bb82c9bca9b25fe7ff5efef0f0826166 +ARG ECR_HELPER_VER=v0.12.0 ARG GCR_HELPER_VER=v2.1.32 ARG VCS_VERSION=(devel) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/cmd/regbot/main.go new/regclient-0.11.3/cmd/regbot/main.go --- old/regclient-0.11.2/cmd/regbot/main.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/cmd/regbot/main.go 2026-04-13 15:53:47.000000000 +0200 @@ -12,7 +12,7 @@ func main() { ctx, cancel := context.WithCancel(context.Background()) - + defer cancel() rootTopCmd, rootOpts := NewRootCmd() sig := make(chan os.Signal, 1) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/cmd/regctl/main.go new/regclient-0.11.3/cmd/regctl/main.go --- old/regclient-0.11.2/cmd/regctl/main.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/cmd/regctl/main.go 2026-04-13 15:53:47.000000000 +0200 @@ -13,6 +13,7 @@ func main() { ctx, cancel := context.WithCancel(context.Background()) + defer cancel() cmd, opts := NewRootCmd() sig := make(chan os.Signal, 1) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/cmd/regsync/main.go new/regclient-0.11.3/cmd/regsync/main.go --- old/regclient-0.11.2/cmd/regsync/main.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/cmd/regsync/main.go 2026-04-13 15:53:47.000000000 +0200 @@ -12,6 +12,7 @@ func main() { ctx, cancel := context.WithCancel(context.Background()) + defer cancel() rootTopCmd, rootOpts := NewRootCmd() sig := make(chan os.Signal, 1) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/go.mod new/regclient-0.11.3/go.mod --- old/regclient-0.11.2/go.mod 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/go.mod 2026-04-13 15:53:47.000000000 +0200 @@ -5,16 +5,16 @@ require ( github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 github.com/goccy/go-yaml v1.19.2 - github.com/klauspost/compress v1.18.4 + github.com/klauspost/compress v1.18.5 github.com/olareg/olareg v0.1.2 github.com/opencontainers/go-digest v1.0.0 github.com/robfig/cron/v3 v3.0.1 github.com/sirupsen/logrus v1.9.4 github.com/spf13/cobra v1.10.2 github.com/ulikunitz/xz v0.5.15 - github.com/yuin/gopher-lua v1.1.1 - golang.org/x/sys v0.41.0 - golang.org/x/term v0.40.0 + github.com/yuin/gopher-lua v1.1.2 + golang.org/x/sys v0.43.0 + golang.org/x/term v0.42.0 ) require ( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/go.sum new/regclient-0.11.3/go.sum --- old/regclient-0.11.2/go.sum 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/go.sum 2026-04-13 15:53:47.000000000 +0200 @@ -7,8 +7,8 @@ github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c= -github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= +github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= +github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/olareg/olareg v0.1.2 h1:75G8X6E9FUlzL/CSjgFcYfMgNzlc7CxULpUUNsZBIvI= github.com/olareg/olareg v0.1.2/go.mod h1:TWs+N6pO1S4bdB6eerzUm/ITRQ6kw91mVf9ZYeGtw+Y= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -29,13 +29,13 @@ github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY= github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= -github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= -github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw= +github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA= +github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= -golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= +golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= +golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= +golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/internal/auth/auth.go new/regclient-0.11.3/internal/auth/auth.go --- old/regclient-0.11.2/internal/auth/auth.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/internal/auth/auth.go 2026-04-13 15:53:47.000000000 +0200 @@ -677,6 +677,7 @@ // tryGet requests a new token with a GET request func (b *bearerHandler) tryGet(cred Cred) error { + //#nosec G704 inputs follow specification req, err := http.NewRequest("GET", b.tokenURL.String(), nil) if err != nil { return err @@ -701,7 +702,7 @@ req.Header.Add("User-Agent", b.clientID) req.URL.RawQuery = reqParams.Encode() - //#nosec G704 inputs are user controlled or follow specification + //#nosec G704 inputs follow specification resp, err := b.client.Do(req) if err != nil { return err @@ -733,6 +734,7 @@ form.Set("password", cred.Password) } + //#nosec G704 inputs are user controlled or follow specification req, err := http.NewRequest("POST", b.tokenURL.String(), strings.NewReader(form.Encode())) if err != nil { return err @@ -870,7 +872,7 @@ // send a login request to hub bodyBytes, err := json.Marshal(jwtHubPost{ User: cred.User, - Pass: cred.Password, + Pass: cred.Password, //#nosec G117 field name follows spec }) if err != nil { return err diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/internal/copyfs/copy.go new/regclient-0.11.3/internal/copyfs/copy.go --- old/regclient-0.11.2/internal/copyfs/copy.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/internal/copyfs/copy.go 2026-04-13 15:53:47.000000000 +0200 @@ -32,13 +32,14 @@ if err != nil { return err } + //#nosec G122 copy is only used for internal (test) code. return os.Symlink(link, destCur) default: return fmt.Errorf("unsupported file to copy: %s, type = %d", srcCur, fi.Mode().Type()) } } // copy file - //#nosec G304 copy is only used for internal (test) code. + //#nosec G122 G304 copy is only used for internal (test) code. fhSrc, err := os.Open(srcCur) if err != nil { return err diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/pkg/archive/tar.go new/regclient-0.11.3/pkg/archive/tar.go --- old/regclient-0.11.2/pkg/archive/tar.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/pkg/archive/tar.go 2026-04-13 15:53:47.000000000 +0200 @@ -84,7 +84,7 @@ // open file and copy contents into tar writer if header.Typeflag == tar.TypeReg && header.Size > 0 { - //#nosec G304 filename is limited to provided path directory + //#nosec G122 G304 filename is limited to provided path directory f, err := os.Open(file) if err != nil { return err diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/release.md new/regclient-0.11.3/release.md --- old/regclient-0.11.2/release.md 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/release.md 2026-04-13 15:53:47.000000000 +0200 @@ -1,36 +1,22 @@ -# Release v0.11.2 +# Release v0.11.3 -Features: - -- Add support for regctl config in XDG and APPDATA. ([PR 1038][pr-1038]) -- Add `ImageWithBlobReaderHook` for callbacks per layer when copying an image. ([PR 1046][pr-1046]) +Security: -Fixes: +- Go 1.26.2 release fixes CVE-2026-32280 ([PR 1072][pr-1072]) +- Go 1.26.2 release fixes CVE-2026-32281 ([PR 1072][pr-1072]) +- Go 1.26.2 release fixes CVE-2026-32283 ([PR 1072][pr-1072]) +- Go 1.26.2 release fixes CVE-2026-32288 ([PR 1072][pr-1072]) +- Go 1.26.2 release fixes CVE-2026-33810 ([PR 1072][pr-1072]) -- Do not sign released images multiple times. ([PR 1027][pr-1027]) -- regctl/action update for path fix. ([PR 1031][pr-1031]) -- Remove default values from regctl config. ([PR 1039][pr-1039]) -- Apply Go modernizations with `go fix` from 1.26.0. ([PR 1053][pr-1053]) -- Adjust test repo names to avoid races. ([PR 1054][pr-1054]) -- Automatically upgrade goimports and gorelease. ([PR 1056][pr-1056]) - -Other Changes: +Features: -- Add `REGCTL_CONFIG` to `regctl` help messages. ([PR 1037][pr-1037]) -- Go upgrade fixes CVE-2025-68121, govulncheck indicates this project is not vulnerable. ([PR 1047][pr-1047]) +- Add support for pushing digest with tags. ([PR 1062][pr-1062]) +- Handle OCI-Tag headers with comma separators. ([PR 1070][pr-1070]) Contributors: - @sudo-bmitch -- @vrajashkr -[pr-1027]: https://github.com/regclient/regclient/pull/1027 -[pr-1031]: https://github.com/regclient/regclient/pull/1031 -[pr-1037]: https://github.com/regclient/regclient/pull/1037 -[pr-1038]: https://github.com/regclient/regclient/pull/1038 -[pr-1039]: https://github.com/regclient/regclient/pull/1039 -[pr-1047]: https://github.com/regclient/regclient/pull/1047 -[pr-1046]: https://github.com/regclient/regclient/pull/1046 -[pr-1053]: https://github.com/regclient/regclient/pull/1053 -[pr-1054]: https://github.com/regclient/regclient/pull/1054 -[pr-1056]: https://github.com/regclient/regclient/pull/1056 +[pr-1062]: https://github.com/regclient/regclient/pull/1062 +[pr-1070]: https://github.com/regclient/regclient/pull/1070 +[pr-1072]: https://github.com/regclient/regclient/pull/1072 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/scheme/reg/manifest.go new/regclient-0.11.3/scheme/reg/manifest.go --- old/regclient-0.11.2/scheme/reg/manifest.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/scheme/reg/manifest.go 2026-04-13 15:53:47.000000000 +0200 @@ -8,7 +8,9 @@ "log/slog" "net/http" "net/url" + "slices" "strconv" + "strings" "github.com/opencontainers/go-digest" @@ -222,7 +224,6 @@ if w := warning.FromContext(ctx); w == nil { ctx = warning.NewContext(ctx, &warning.Warning{Hook: warning.DefaultHook()}) } - // create the request body mj, err := m.MarshalJSON() if err != nil { @@ -231,20 +232,35 @@ slog.String("err", err.Error())) return fmt.Errorf("error marshalling manifest for %s: %w", r.CommonName(), err) } - // limit length if reg.manifestMaxPush > 0 && int64(len(mj)) > reg.manifestMaxPush { return fmt.Errorf("manifest too large, calculated %d, limit %d: %s%.0w", len(mj), reg.manifestMaxPush, r.CommonName(), errs.ErrSizeLimitExceeded) } + // if the ref provides a digest, verify it matches the manifest being pushed + desc := m.GetDescriptor() + if err := desc.Digest.Validate(); err != nil { + return fmt.Errorf("invalid digest for manifest: %s: %w", string(desc.Digest), err) + } + if r.Digest != "" && desc.Digest.String() != r.Digest { + // Digest algorithm may have changed, try recreating the manifest with the provided ref. + // This will fail if the ref digest does not match the manifest. + m, err = manifest.New(manifest.WithRef(r), manifest.WithRaw(mj)) + if err != nil { + return fmt.Errorf("failed to rebuilding manifest with ref \"%s\": %w", r.CommonName(), err) + } + } // build/send request + expectTags := []string{} headers := http.Header{ "Content-Type": []string{manifest.GetMediaType(m)}, } q := url.Values{} if tagOrDigest == r.Tag && m.GetDescriptor().Digest.Algorithm() != digest.Canonical { - // TODO(bmitch): EXPERIMENTAL parameter, registry support and OCI spec change needed - q.Add(paramManifestDigest, m.GetDescriptor().Digest.String()) + // TODO(bmitch): EXPERIMENTAL support for pushing tags with a digest: <https://github.com/opencontainers/distribution-spec/pull/600> + tagOrDigest = m.GetDescriptor().Digest.String() + q.Add("tag", r.Tag) + expectTags = append(expectTags, r.Tag) } req := ®http.Req{ MetaKind: reqmeta.Manifest, @@ -269,6 +285,55 @@ if resp.HTTPResponse().StatusCode != 201 { return fmt.Errorf("failed to put manifest %s: %w", r.CommonName(), reghttp.HTTPError(resp.HTTPResponse().StatusCode)) } + // if Docker-Content-Digest header was returned, verify the digest matches + if dig := resp.HTTPResponse().Header.Get("Docker-Content-Digest"); dig != "" && dig != m.GetDescriptor().Digest.String() { + return fmt.Errorf("failed to put manifest, unexpected digest returned, expected %s, received %s", m.GetDescriptor().Digest.String(), dig) + } + + // if pushing tags by digest fails, fall back to pushing individual tags + respTags := []string{} + for _, hv := range resp.HTTPResponse().Header.Values("OCI-Tag") { + for sv := range strings.SplitSeq(hv, ",") { + respTags = append(respTags, strings.TrimSpace(sv)) + } + } + for _, t := range expectTags { + if slices.Contains(respTags, t) { + continue + } + q := url.Values{} + if m.GetDescriptor().Digest.Algorithm() != digest.Canonical { + // TODO(bmitch): EXPERIMENTAL parameter, registry support and OCI spec change needed: <https://github.com/opencontainers/distribution-spec/pull/543> + q.Add(paramManifestDigest, m.GetDescriptor().Digest.String()) + } + req := ®http.Req{ + MetaKind: reqmeta.Manifest, + Host: r.Registry, + NoMirrors: true, + Method: "PUT", + Repository: r.Repository, + Path: "manifests/" + t, + Query: q, + Headers: headers, + BodyLen: int64(len(mj)), + BodyBytes: mj, + } + resp, err := reg.reghttp.Do(ctx, req) + if err != nil { + return fmt.Errorf("failed to put manifest %s: %w", r.CommonName(), err) + } + err = resp.Close() + if err != nil { + return fmt.Errorf("failed to close request: %w", err) + } + if resp.HTTPResponse().StatusCode != 201 { + return fmt.Errorf("failed to put manifest %s: %w", r.CommonName(), reghttp.HTTPError(resp.HTTPResponse().StatusCode)) + } + // if Docker-Content-Digest header was returned, verify the digest matches + if dig := resp.HTTPResponse().Header.Get("Docker-Content-Digest"); dig != "" && dig != m.GetDescriptor().Digest.String() { + return fmt.Errorf("failed to put manifest, unexpected digest returned, expected %s, received %s", m.GetDescriptor().Digest.String(), dig) + } + } rCache := r.SetDigest(m.GetDescriptor().Digest.String()) reg.cacheMan.Set(rCache, m) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/regclient-0.11.2/scheme/reg/manifest_test.go new/regclient-0.11.3/scheme/reg/manifest_test.go --- old/regclient-0.11.2/scheme/reg/manifest_test.go 2026-02-23 21:27:45.000000000 +0100 +++ new/regclient-0.11.3/scheme/reg/manifest_test.go 2026-04-13 15:53:47.000000000 +0200 @@ -30,6 +30,8 @@ func TestManifest(t *testing.T) { t.Parallel() repoPath := "/proj" + repoPathAlgo := "/proj-dig-algo" + repoPathDigTags := "/proj-dig-tags" getTag256 := "get256" getTag512 := "get512" bigTag := "big" @@ -254,9 +256,48 @@ }, { ReqEntry: reqresp.ReqEntry{ - Name: "Put tag 512", + Name: "Put tag 512 unsupported", Method: "PUT", Path: "/v2" + repoPath + "/manifests/" + putTag512, + Headers: http.Header{ + "Content-Type": []string{mediatype.Docker2Manifest}, + "Content-Length": {fmt.Sprintf("%d", mLen)}, + }, + Body: mBody, + }, + RespEntry: reqresp.RespEntry{ + Status: http.StatusCreated, + Headers: http.Header{ + "Docker-Content-Digest": []string{mDigest256.String()}, + }, + }, + }, + { + ReqEntry: reqresp.ReqEntry{ + Name: "Put tag 512 with unsupported tag param", + Method: "PUT", + Path: "/v2" + repoPathAlgo + "/manifests/" + mDigest512.String(), + Query: map[string][]string{ + "tag": {putTag512}, + }, + Headers: http.Header{ + "Content-Type": []string{mediatype.Docker2Manifest}, + "Content-Length": {fmt.Sprintf("%d", mLen)}, + }, + Body: mBody, + }, + RespEntry: reqresp.RespEntry{ + Status: http.StatusCreated, + Headers: http.Header{ + "Docker-Content-Digest": []string{mDigest512.String()}, + }, + }, + }, + { + ReqEntry: reqresp.ReqEntry{ + Name: "Put tag 512 with algorithm support", + Method: "PUT", + Path: "/v2" + repoPathAlgo + "/manifests/" + putTag512, Query: map[string][]string{ paramManifestDigest: {mDigest512.String()}, }, @@ -275,6 +316,28 @@ }, { ReqEntry: reqresp.ReqEntry{ + Name: "Put tag 512 with digest and tags param", + Method: "PUT", + Path: "/v2" + repoPathDigTags + "/manifests/" + mDigest512.String(), + Query: map[string][]string{ + "tag": {putTag512}, + }, + Headers: http.Header{ + "Content-Type": []string{mediatype.Docker2Manifest}, + "Content-Length": {fmt.Sprintf("%d", mLen)}, + }, + Body: mBody, + }, + RespEntry: reqresp.RespEntry{ + Status: http.StatusCreated, + Headers: http.Header{ + "Docker-Content-Digest": []string{mDigest512.String()}, + "OCI-Tag": []string{putTag512}, + }, + }, + }, + { + ReqEntry: reqresp.ReqEntry{ Name: "Put digest 256", Method: "PUT", Path: "/v2" + repoPath + "/manifests/" + mDigest256.String(), @@ -553,7 +616,7 @@ t.Errorf("failed to put manifest: %v", err) } }) - t.Run("PUT tag 512", func(t *testing.T) { + t.Run("PUT tag 512 unsupported", func(t *testing.T) { putRef, err := ref.New(tsURL.Host + repoPath + ":" + putTag512) if err != nil { t.Fatalf("failed creating ref: %v", err) @@ -567,6 +630,42 @@ t.Fatalf("failed to create manifest: %v", err) } err = reg.ManifestPut(ctx, putRef, mm) + if err == nil { + t.Errorf("did not fail to put sha512 manifest by tag to unsupported registry") + } + }) + t.Run("PUT tag 512 by algorithm", func(t *testing.T) { + putRef, err := ref.New(tsURL.Host + repoPathAlgo + ":" + putTag512) + if err != nil { + t.Fatalf("failed creating ref: %v", err) + } + mm, err := manifest.New(manifest.WithRaw(mBody), manifest.WithDesc(descriptor.Descriptor{ + MediaType: mediatype.Docker2Manifest, + Size: int64(len(mBody)), + Digest: mDigest512, + })) + if err != nil { + t.Fatalf("failed to create manifest: %v", err) + } + err = reg.ManifestPut(ctx, putRef, mm) + if err != nil { + t.Errorf("failed to put manifest: %v", err) + } + }) + t.Run("PUT tag 512 by digest and tag param", func(t *testing.T) { + putRef, err := ref.New(tsURL.Host + repoPathDigTags + ":" + putTag512) + if err != nil { + t.Fatalf("failed creating ref: %v", err) + } + mm, err := manifest.New(manifest.WithRaw(mBody), manifest.WithDesc(descriptor.Descriptor{ + MediaType: mediatype.Docker2Manifest, + Size: int64(len(mBody)), + Digest: mDigest512, + })) + if err != nil { + t.Fatalf("failed to create manifest: %v", err) + } + err = reg.ManifestPut(ctx, putRef, mm) if err != nil { t.Errorf("failed to put manifest: %v", err) } @@ -585,7 +684,7 @@ t.Errorf("failed to put manifest: %v", err) } }) - t.Run("PUT tag 512", func(t *testing.T) { + t.Run("PUT digest 512", func(t *testing.T) { putRef, err := ref.New(tsURL.Host + repoPath + "@" + mDigest512.String()) if err != nil { t.Fatalf("failed creating ref: %v", err) ++++++ regclient.obsinfo ++++++ --- /var/tmp/diff_new_pack.b4iUmA/_old 2026-04-18 21:35:54.732431946 +0200 +++ /var/tmp/diff_new_pack.b4iUmA/_new 2026-04-18 21:35:54.736432109 +0200 @@ -1,5 +1,5 @@ name: regclient -version: 0.11.2 -mtime: 1771878465 -commit: 584b70d53427faad17a860e215ce2cd0cb76059f +version: 0.11.3 +mtime: 1776088427 +commit: 1736a5711c8d6f71b40a279673c0023077709049 ++++++ vendor.tar.gz ++++++ ++++ 2652 lines of diff (skipped)
