diff --git a/go.mod b/go.mod index a4d65ff95..0ed83de44 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/goccy/go-yaml v1.19.2 github.com/gogo/protobuf v1.3.2 github.com/google/go-cmp v0.7.0 - github.com/google/go-containerregistry v0.22.0 + github.com/google/go-containerregistry v0.22.1 github.com/google/uuid v1.6.0 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4 diff --git a/go.sum b/go.sum index 37ad3db3d..4bc9eb285 100644 --- a/go.sum +++ b/go.sum @@ -233,6 +233,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= +github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= +github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo= github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk= diff --git a/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go b/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go new file mode 100644 index 000000000..a7f5b8a4b --- /dev/null +++ b/vendor/github.com/google/go-containerregistry/internal/ipaddr/ipaddr.go @@ -0,0 +1,82 @@ +// Copyright 2026 Google LLC All Rights Reserved. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package ipaddr + +import ( + "net/netip" + "strconv" + "strings" +) + +// IsPrivateOrLinkLocal reports whether host denotes a loopback, private, +// link-local, or unspecified address. It accepts any IP-literal form the Go +// dialer accepts — canonical dotted-quad IPv4 and IPv6, zone-qualified and +// IPv4-mapped IPv6, and legacy inet_aton encodings (32-bit decimal +// "2130706433", hexadecimal "0x7f000001", partial dotted-quad "127.1", +// zero-padded octets) — so a guard based on it cannot be bypassed by +// spelling an internal address in a non-canonical way. DNS names are not IP +// literals and return false. +func IsPrivateOrLinkLocal(host string) bool { + addr, ok := Parse(host) + if !ok { + return false + } + return addr.IsLoopback() || addr.IsLinkLocalUnicast() || addr.IsLinkLocalMulticast() || + addr.IsPrivate() || addr.IsUnspecified() +} + +// Parse parses an IP literal in any form the Go dialer accepts. +func Parse(host string) (netip.Addr, bool) { + // The dialer ignores IPv6 zone identifiers, so guards must too. + host, _, _ = strings.Cut(host, "%") + if addr, err := netip.ParseAddr(host); err == nil { + // Treat IPv4-mapped IPv6 as the IPv4 address the dialer connects to. + return addr.WithZone("").Unmap(), true + } + return parseLegacyIPv4(host) +} + +// parseLegacyIPv4 implements the inet_aton forms the Go resolver accepts for +// IPv4: one to four dot-separated parts where the final part may fill the +// remaining bytes ("127.1" == 127.0.0.1) and each part may be decimal, +// hexadecimal (0x prefix), or octal (leading 0). +func parseLegacyIPv4(host string) (netip.Addr, bool) { + parts := strings.Split(host, ".") + if len(parts) < 1 || len(parts) > 4 { + return netip.Addr{}, false + } + var b [4]byte + for i, part := range parts[:len(parts)-1] { + // bitsize 8 enforces the single-octet range before any conversion. + v, err := strconv.ParseUint(part, 0, 8) + if err != nil { + return netip.Addr{}, false + } + b[i] = byte(v) + } + // The final part may fill as many bytes as remain, e.g. "127.1" -> 127.0.0.1; + // with four parts it must still be a single octet. The bitsize enforces the + // range before the conversion below. + lastBits := [...]int{32, 24, 16, 8}[len(parts)-1] + last, err := strconv.ParseUint(parts[len(parts)-1], 0, lastBits) + if err != nil { + return netip.Addr{}, false + } + v := uint32(last) + for i := len(parts) - 1; i < 4; i++ { + b[i] = byte(v >> (8 * (3 - i))) + } + return netip.AddrFrom4(b), true +} diff --git a/vendor/github.com/google/go-containerregistry/internal/verify/verify.go b/vendor/github.com/google/go-containerregistry/internal/verify/verify.go index 463f7e4b3..ff48ba871 100644 --- a/vendor/github.com/google/go-containerregistry/internal/verify/verify.go +++ b/vendor/github.com/google/go-containerregistry/internal/verify/verify.go @@ -17,7 +17,6 @@ package verify import ( - "bytes" "encoding/hex" "errors" "fmt" @@ -107,10 +106,16 @@ func Descriptor(d v1.Descriptor) error { return errors.New("error verifying descriptor; Data == nil") } - h, sz, err := v1.SHA256(bytes.NewReader(d.Data)) + hasher, err := v1.Hasher(d.Digest.Algorithm) if err != nil { return err } + hasher.Write(d.Data) + h := v1.Hash{ + Algorithm: d.Digest.Algorithm, + Hex: hex.EncodeToString(hasher.Sum(make([]byte, 0, hasher.Size()))), + } + sz := int64(len(d.Data)) if h != d.Digest { return fmt.Errorf("error verifying Digest; got %q, want %q", h, d.Digest) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go b/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go index 1555efae0..c962235c7 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go +++ b/vendor/github.com/google/go-containerregistry/pkg/authn/authn.go @@ -89,7 +89,9 @@ func (a *AuthConfig) UnmarshalJSON(data []byte) error { // MarshalJSON implements json.Marshaler func (a AuthConfig) MarshalJSON() ([]byte, error) { shadow := (authConfig)(a) - shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password) + if shadow.Username != "" || shadow.Password != "" { + shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password) + } return json.Marshal(shadow) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/digest.go b/vendor/github.com/google/go-containerregistry/pkg/name/digest.go index 5b8eb4ff4..9d6650ee6 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/digest.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/digest.go @@ -17,6 +17,8 @@ package name import ( // nolint: depguard _ "crypto/sha256" // Recommended by go-digest. + // nolint: depguard + _ "crypto/sha512" // Needed for sha512 digests. "encoding" "encoding/json" "strings" @@ -107,13 +109,8 @@ func NewDigest(name string, opts ...Option) (Digest, error) { } base := parts[0] dig := parts[1] - prefix := digest.Canonical.String() + ":" - if !strings.HasPrefix(dig, prefix) { - return Digest{}, newErrBadName("unsupported digest algorithm: %s", dig) - } - hex := strings.TrimPrefix(dig, prefix) - if err := digest.Canonical.Validate(hex); err != nil { - return Digest{}, err + if err := digest.Digest(dig).Validate(); err != nil { + return Digest{}, newErrBadName("%s: %s", err, dig) } tag, err := NewTag(base, opts...) diff --git a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go index 539d0ff31..1ce999a2e 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/name/ref.go +++ b/vendor/github.com/google/go-containerregistry/pkg/name/ref.go @@ -16,6 +16,7 @@ package name import ( "fmt" + "strings" ) // Reference defines the interface that consumers use when they can @@ -39,6 +40,11 @@ type Reference interface { // ParseReference parses the string as a reference, either by tag or digest. // References that include both a tag and digest parse as Digest references. func ParseReference(s string, opts ...Option) (Reference, error) { + // Image references never contain a URL scheme, so tell the user to + // strip it instead of returning a confusing parse error. + if strings.HasPrefix(s, "http://") || strings.HasPrefix(s, "https://") { + return nil, newErrBadName("image reference must not contain a URL scheme (http:// or https://): %s; to connect to a registry over plain HTTP, use name.Insecure", s) + } if t, err := NewTag(s, opts...); err == nil { return t, nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go b/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go index bbb600ed7..4114d5ab2 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/hash.go @@ -16,6 +16,10 @@ package v1 import ( "crypto" + // nolint: depguard + _ "crypto/sha256" // Registered for Hasher. + // nolint: depguard + _ "crypto/sha512" // Registered for Hasher. "encoding" "encoding/hex" "encoding/json" @@ -78,6 +82,8 @@ func Hasher(name string) (hash.Hash, error) { switch name { case "sha256": return crypto.SHA256.New(), nil + case "sha512": + return crypto.SHA512.New(), nil default: return nil, fmt.Errorf("unsupported hash: %q", name) } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go index a6fdaceed..7b4ed0884 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/index.go @@ -56,6 +56,9 @@ func computeDescriptor(ia IndexAddendum) (*v1.Descriptor, error) { if ia.Data != nil { desc.Data = ia.Data } + if ia.ArtifactType != "" { + desc.ArtifactType = ia.ArtifactType + } return desc, nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go index 0125bfc65..00ad8c0d4 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go @@ -24,6 +24,7 @@ import ( "maps" "path" "strings" + "sync" "time" v1 "github.com/google/go-containerregistry/pkg/v1" @@ -485,10 +486,7 @@ func Time(img v1.Image, t time.Time, opts ...tarball.LayerOption) (v1.Image, err addendums := make([]Addendum, max(len(ocf.History), len(layers))) var historyIdx, addendumIdx int for layerIdx := 0; layerIdx < len(layers); addendumIdx, layerIdx = addendumIdx+1, layerIdx+1 { - newLayer, err := layerTime(layers[layerIdx], t, opts...) - if err != nil { - return nil, fmt.Errorf("setting layer times: %w", err) - } + newLayer := layerTime(layers[layerIdx], t, opts...) // try to search for the history entry that corresponds to this layer for ; historyIdx < len(ocf.History); historyIdx++ { @@ -547,7 +545,28 @@ func Time(img v1.Image, t time.Time, opts ...tarball.LayerOption) (v1.Image, err return ConfigFile(newImage, cfg) } -func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Layer, error) { +func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) v1.Layer { + return &timeLayer{inner: layer, t: t, opts: opts} +} + +type timeLayer struct { + inner v1.Layer + t time.Time + opts []tarball.LayerOption + + once sync.Once + material v1.Layer + err error +} + +func (l *timeLayer) materialize() error { + l.once.Do(func() { + l.material, l.err = materializeLayerTime(l.inner, l.t, l.opts...) + }) + return l.err +} + +func materializeLayerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Layer, error) { layerReader, err := layer.Uncompressed() if err != nil { return nil, fmt.Errorf("getting layer: %w", err) @@ -580,7 +599,6 @@ func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Lay } if header.Typeflag == tar.TypeReg { - // TODO(#1168): This should be lazy, and not buffer the entire layer contents. if _, err = io.CopyN(tarWriter, tarReader, header.Size); err != nil { return nil, fmt.Errorf("writing layer file: %w", err) } @@ -601,12 +619,54 @@ func layerTime(layer v1.Layer, t time.Time, opts ...tarball.LayerOption) (v1.Lay opener := func() (io.ReadCloser, error) { return io.NopCloser(bytes.NewReader(b)), nil } - layer, err = tarball.LayerFromOpener(opener, opts...) + newLayer, err := tarball.LayerFromOpener(opener, opts...) if err != nil { return nil, fmt.Errorf("creating layer: %w", err) } - return layer, nil + return newLayer, nil +} + +func (l *timeLayer) Compressed() (io.ReadCloser, error) { + if err := l.materialize(); err != nil { + return nil, err + } + return l.material.Compressed() +} + +func (l *timeLayer) Uncompressed() (io.ReadCloser, error) { + if err := l.materialize(); err != nil { + return nil, err + } + return l.material.Uncompressed() +} + +func (l *timeLayer) Size() (int64, error) { + if err := l.materialize(); err != nil { + return 0, err + } + return l.material.Size() +} + +func (l *timeLayer) DiffID() (v1.Hash, error) { + if err := l.materialize(); err != nil { + return v1.Hash{}, err + } + return l.material.DiffID() +} + +func (l *timeLayer) Digest() (v1.Hash, error) { + if err := l.materialize(); err != nil { + return v1.Hash{}, err + } + return l.material.Digest() +} + +func (l *timeLayer) MediaType() (types.MediaType, error) { + if err := l.materialize(); err != nil { + return "", err + } + return l.material.MediaType() } // Canonical is a helper function to combine Time and configFile diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go index 8f5bd1263..06e909908 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/check.go @@ -50,7 +50,7 @@ func CheckPushPermission(ref name.Reference, kc authn.Keychain, t http.RoundTrip // to avoid a roundtrip for spec-compliant registries. w := writer{ repo: ref.Context(), - client: &http.Client{Transport: tr}, + client: &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, } loc, _, err := w.initiateUpload(context.Background(), "", "", "") if loc != "" { diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go index 4b238d129..26605d979 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/fetcher.go @@ -17,13 +17,14 @@ package remote import ( "bytes" "context" + "encoding/hex" "fmt" "io" - "net" "net/http" "net/url" "strings" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/limit" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/internal/verify" @@ -98,10 +99,8 @@ func checkRedirectSSRF(req *http.Request, via []*http.Request) error { if destHost == origHost { return nil // same-host redirect is always allowed } - if ip := net.ParseIP(destHost); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("SSRF protection: redirect from %q to private/link-local host %q denied", origHost, destHost) - } + if ipaddr.IsPrivateOrLinkLocal(destHost) { + return fmt.Errorf("SSRF protection: redirect from %q to private/link-local host %q denied", origHost, destHost) } return nil } @@ -174,10 +173,26 @@ func (f *fetcher) fetchManifest(ctx context.Context, ref name.Reference, accepta return nil, nil, err } - digest, size, err := v1.SHA256(bytes.NewReader(manifest)) + // Hash with the algorithm of the reference when pulling by digest. + dgst, byDigest := ref.(name.Digest) + algo := "sha256" + if byDigest { + h, err := v1.NewHash(dgst.DigestStr()) + if err != nil { + return nil, nil, err + } + algo = h.Algorithm + } + hasher, err := v1.Hasher(algo) if err != nil { return nil, nil, err } + hasher.Write(manifest) + digest := v1.Hash{ + Algorithm: algo, + Hex: hex.EncodeToString(hasher.Sum(make([]byte, 0, hasher.Size()))), + } + size := int64(len(manifest)) mediaType := types.MediaType(resp.Header.Get("Content-Type")) contentDigest, err := v1.NewHash(resp.Header.Get("Docker-Content-Digest")) @@ -188,7 +203,7 @@ func (f *fetcher) fetchManifest(ctx context.Context, ref name.Reference, accepta } // Validate the digest matches what we asked for, if pulling by digest. - if dgst, ok := ref.(name.Digest); ok { + if byDigest { if digest.String() != dgst.DigestStr() { return nil, nil, fmt.Errorf("manifest digest: %q does not match requested digest: %q for %q", digest, dgst.DigestStr(), ref) } @@ -380,10 +395,8 @@ func validateForeignURL(rawURL string, insecure bool) error { return fmt.Errorf("foreign layer URL scheme %q not allowed; must be https (or http for insecure registries)", u.Scheme) } host := u.Hostname() - if ip := net.ParseIP(host); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("foreign layer URL host %q is a private or link-local address", host) - } + if ipaddr.IsPrivateOrLinkLocal(host) { + return fmt.Errorf("foreign layer URL host %q is a private or link-local address", host) } return nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go index f576ccd30..b98482763 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/transport/bearer.go @@ -25,6 +25,7 @@ import ( "strings" "sync" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/limit" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/pkg/authn" @@ -151,10 +152,8 @@ func validateRealmURL(realm, registryHost string, insecure bool) error { // (169.254.169.254 / fd00:ec2::254). DNS-based SSRF is out of scope // here; callers should apply network-level controls if needed. host := u.Hostname() - if ip := net.ParseIP(host); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return fmt.Errorf("realm host %q is a private or link-local address", host) - } + if ipaddr.IsPrivateOrLinkLocal(host) { + return fmt.Errorf("realm host %q is a private or link-local address", host) } return nil } diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go index 01e9c767b..4064711f4 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/remote/write.go @@ -21,13 +21,13 @@ import ( "errors" "fmt" "io" - "net" "net/http" "net/url" "sort" "strings" "sync" + "github.com/google/go-containerregistry/internal/ipaddr" "github.com/google/go-containerregistry/internal/redact" "github.com/google/go-containerregistry/internal/retry" "github.com/google/go-containerregistry/pkg/authn" @@ -92,7 +92,7 @@ func makeDeleteClient(ctx context.Context, repo name.Repository, o *options) (*h if err != nil { return nil, err } - return &http.Client{Transport: tr}, nil + return &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, nil } func makeWriter(ctx context.Context, repo name.Repository, ls []v1.Layer, o *options) (*writer, error) { @@ -116,7 +116,7 @@ func makeWriter(ctx context.Context, repo name.Repository, ls []v1.Layer, o *opt } return &writer{ repo: repo, - client: &http.Client{Transport: tr}, + client: &http.Client{Transport: tr, CheckRedirect: checkRedirectSSRF}, auth: auth, transport: o.transport, progress: o.progress, @@ -159,7 +159,7 @@ func (w *writer) maybeUpdateScopes(ctx context.Context, ml *MountableLayer) erro if err != nil { return err } - w.client = &http.Client{Transport: wt} + w.client = &http.Client{Transport: wt, CheckRedirect: checkRedirectSSRF} } return nil @@ -193,10 +193,8 @@ func (w *writer) nextLocation(resp *http.Response) (string, error) { // always allowed regardless of whether the registry IP is private. origHost := resp.Request.URL.Hostname() if destHost := resolved.Hostname(); destHost != origHost { - if ip := net.ParseIP(destHost); ip != nil { - if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsPrivate() || ip.IsUnspecified() { - return "", fmt.Errorf("SSRF protection: Location header redirects to private/link-local host %q", destHost) - } + if ipaddr.IsPrivateOrLinkLocal(destHost) { + return "", fmt.Errorf("SSRF protection: Location header redirects to private/link-local host %q", destHost) } } @@ -610,9 +608,10 @@ func (w *writer) commitManifest(ctx context.Context, t Taggable, ref name.Refere return err } var mf struct { - MediaType types.MediaType `json:"mediaType"` - Subject *v1.Descriptor `json:"subject,omitempty"` - ArtifactType string `json:"artifactType,omitempty"` + MediaType types.MediaType `json:"mediaType"` + Subject *v1.Descriptor `json:"subject,omitempty"` + ArtifactType string `json:"artifactType,omitempty"` + Annotations map[string]string `json:"annotations,omitempty"` Config struct { MediaType types.MediaType `json:"mediaType"` } `json:"config"` @@ -655,9 +654,10 @@ func (w *writer) commitManifest(ctx context.Context, t Taggable, ref name.Refere return err } desc := v1.Descriptor{ - MediaType: mf.MediaType, - Digest: h, - Size: size, + MediaType: mf.MediaType, + Digest: h, + Size: size, + Annotations: mf.Annotations, } if mf.ArtifactType != "" { desc.ArtifactType = mf.ArtifactType diff --git a/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go b/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go index c86657d7b..69878980b 100644 --- a/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go +++ b/vendor/github.com/google/go-containerregistry/pkg/v1/types/types.go @@ -29,6 +29,7 @@ const ( OCIRestrictedLayer MediaType = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip" OCIUncompressedLayer MediaType = "application/vnd.oci.image.layer.v1.tar" OCIUncompressedRestrictedLayer MediaType = "application/vnd.oci.image.layer.nondistributable.v1.tar" + OCIEmptyJSON MediaType = "application/vnd.oci.empty.v1+json" DockerManifestSchema1 MediaType = "application/vnd.docker.distribution.manifest.v1+json" DockerManifestSchema1Signed MediaType = "application/vnd.docker.distribution.manifest.v1+prettyjws" diff --git a/vendor/modules.txt b/vendor/modules.txt index 0811f2652..83a080d7e 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -439,11 +439,12 @@ github.com/google/go-cmp/cmp/internal/diff github.com/google/go-cmp/cmp/internal/flags github.com/google/go-cmp/cmp/internal/function github.com/google/go-cmp/cmp/internal/value -# github.com/google/go-containerregistry v0.22.0 +# github.com/google/go-containerregistry v0.22.1 ## explicit; go 1.25.0 github.com/google/go-containerregistry/internal/and github.com/google/go-containerregistry/internal/compression github.com/google/go-containerregistry/internal/gzip +github.com/google/go-containerregistry/internal/ipaddr github.com/google/go-containerregistry/internal/limit github.com/google/go-containerregistry/internal/redact github.com/google/go-containerregistry/internal/retry