diff --git a/hauler b/hauler index 9084f00..4061841 160000 --- a/hauler +++ b/hauler @@ -1 +1 @@ -Subproject commit 9084f004c1a8dd2a17ae9c2471a7d077fb3c6f57ae1d4233ada25f358533d3b2 +Subproject commit 4061841edd9e293f2fdfed224498ee029cd2522a9c48468a008081d8a68682f4 diff --git a/patchinfo.20251201094954024941.93181000773252/_patchinfo b/patchinfo.20251201094954024941.93181000773252/_patchinfo new file mode 100644 index 0000000..e7797d5 --- /dev/null +++ b/patchinfo.20251201094954024941.93181000773252/_patchinfo @@ -0,0 +1,209 @@ + + VUL-0: CVE-2025-58190: hauler: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input + cve#2025-22872 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-22872 + cve#2025-58058 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58058 + cve#2024-45338 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-45338 + VUL-0: CVE-2024-0406: hauler: mholt/archiver: access to restricted files or directories when unpacking specially crafted tar file + VUL-0: CVE-2024-45338: hauler: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content + cve#2025-11579 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-11579 + cve#2024-0406 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-0406 + cve#2025-47911 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-47911 + cve#2025-46569 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-46569 + VUL-0: CVE-2025-46569: hauler: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API + VUL-0: CVE-2025-58058: hauler: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory + VUL-0: CVE-2025-22872: hauler: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction + VUL-0: CVE-2025-47911: hauler: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents + cve#2025-58190 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58190 + VUL-0: CVE-2025-11579: hauler: github.com/nwaples/rardecode: failure to restrict the dictionary size when processing RAR files allows for excessive memory consumpti + dirkmueller + important + security + Security update for hauler + This update for hauler fixes the following issues: + +- Update to version 1.3.1 (bsc#1251516, CVE-2025-47911, + bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190, + bsc#1248937, CVE-2025-58058): + * bump github.com/containerd/containerd (#474) + * another fix to tests for new tests (#472) + * fixed typo in testdata (#471) + * fixed/cleaned new tests (#470) + * trying a new way for hauler testing (#467) + * update for cosign v3 verify (#469) + * added digests view to info (#465) + * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457) + * update oras-go to v1.2.7 for security patches (#464) + * update cosign to v3.0.2+hauler.1 (#463) + * fixed homebrew directory deprecation (#462) + * add registry logout command (#460) + +- Update to version 1.3.0: + * bump the go_modules group across 1 directory with 2 updates (#455) + * upgraded versions/dependencies/deprecations (#454) + * allow loading of docker tarballs (#452) + * bump the go_modules group across 1 directory with 2 updates (#449) + +- update to 1.2.5 (bsc#1246722, CVE-2025-46569): + * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in + the go_modules group across 1 directory (CVE-2025-46569) + * deprecate auth from hauler store copy + * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the + go_modules group across 1 directory + * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 + in the go_modules group across 1 directory + * upgraded go and dependencies versions + +- Update to version 1.2.5: + * upgraded go and dependencies versions (#444) + * Bump github.com/go-viper/mapstructure/v2 (#442) + * bump github.com/cloudflare/circl (#441) + * deprecate auth from hauler store copy (#440) + * Bump github.com/open-policy-agent/opa (#438) + +- update to 1.2.4 (CVE-2025-22872, bsc#1241804): + * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules + group across 1 directory + * minor tests updates + +- Update to version 1.2.3: + * formatting and flag text updates + * add keyless signature verification (#434) + * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430) + * add --only flag to hauler store copy (for images) (#429) + * fix tlog verification error/warning output (#428) + +- Update to version 1.2.2 (bsc#1241184, CVE-2024-0406): + * cleanup new tlog flag typos and add shorthand (#426) + * default public transparency log verification to false to be airgap friendly but allow override (#425) + * bump github.com/golang-jwt/jwt/v4 (#423) + * bump the go_modules group across 1 directory with 2 updates (#422) + * bump github.com/go-jose/go-jose/v3 (#417) + * bump github.com/go-jose/go-jose/v4 (#415) + * clear default manifest name if product flag used with sync (#412) + * updates for v1.2.0 (#408) + * fixed remote code (#407) + * added remote file fetch to load (#406) + * added remote and multiple file fetch to sync (#405) + * updated save flag and related logs (#404) + * updated load flag and related logs [breaking change] (#403) + * updated sync flag and related logs [breaking change] (#402) + * upgraded api update to v1/updated dependencies (#400) + * fixed consts for oci declarations (#398) + * fix for correctly grabbing platform post cosign 2.4 updates (#393) + * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390) + * Bump the go_modules group across 1 directory with 2 updates (#385) + * replace mholt/archiver with mholt/archives (#384) + * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383) + * cleaned up registry and improved logging (#378) + * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377) +- bump net/html dependencies (bsc#1235332, CVE-2024-45338) + +- Update to version 1.1.1: + * fixed cli desc for store env var (#374) + * updated versions for go/k8s/helm (#373) + * updated version flag to internal/flags (#369) + * renamed incorrectly named consts (#371) + * added store env var (#370) + * adding ignore errors and retries for continue on error/fail on error (#368) + * updated/fixed hauler directory (#354) + * standardize consts (#353) + * removed cachedir code (#355) + * removed k3s code (#352) + * updated dependencies for go, helm, and k8s (#351) + * [feature] build with boring crypto where available (#344) + * updated workflow to goreleaser builds (#341) + * added timeout to goreleaser workflow (#340) + * trying new workflow build processes (#337) + * improved workflow performance (#336) + * have extract use proper ref (#335) + * yet another workflow goreleaser fix (#334) + * even more workflow fixes (#333) + * added more fixes to github workflow (#332) + * fixed typo in hauler store save (#331) + * updates to fix build processes (#330) + * added integration tests for non hauler tarballs (#325) + * bump: golang >= 1.23.1 (#328) + * add platform flag to store save (#329) + * Update feature_request.md + * updated/standardize command descriptions (#313) + * use new annotation for 'store save' manifest.json (#324) + * enable docker load for hauler tarballs (#320) + * bump to cosign v2.2.3-carbide.3 for new annotation (#322) + * continue on error when adding images to store (#317) + * Update README.md (#318) + * fixed completion commands (#312) + * github.com/rancherfederal/hauler => hauler.dev/go/hauler (#311) + * pages: enable go install hauler.dev/go/hauler (#310) + * Create CNAME + * pages: initial workflow (#309) + * testing and linting updates (#305) + * feat-273: TLS Flags (#303) + * added list-repos flag (#298) + * fixed hauler login typo (#299) + * updated cobra function for shell completion (#304) + * updated install.sh to remove github api (#293) + * fix image ref keys getting squashed when containing sigs/atts (#291) + * fix missing versin info in release build (#283) + * bump github.com/docker/docker in the go_modules group across 1 directory (#281) + * updated install script (`install.sh`) (#280) + * fix digest images being lost on load of hauls (Signed). (#259) + * feat: add readonly flag (#277) + * fixed makefile for goreleaser v2 changes (#278) + * updated goreleaser versioning defaults (#279) + * update feature_request.md (#274) + * updated old references + * updated actions workflow user + * added dockerhub to github actions workflow + * removed helm chart + * added debug container and workflow + * updated products flag description + * updated chart for release + * fixed workflow errors/warnings + * fixed permissions on testdata + * updated chart versions (will need to update again) + * last bit of fixes to workflow + * updated unit test workflow + * updated goreleaser deprecations + * added helm chart release job + * updated github template names + * updated imports (and go fmt) + * formatted gitignore to match dockerignore + * formatted all code (go fmt) + * updated chart tests for new features + * Adding the timeout flag for fileserver command + * Configure chart commands to use helm clients for OCI and private registry support + * Added some documentation text to sync command + * Bump golang.org/x/net from 0.17.0 to 0.23.0 + * fix for dup digest smashing in cosign + * removed vagrant scripts + * last bit of updates and formatting of chart + * updated hauler testdata + * adding functionality and cleaning up + * added initial helm chart + * removed tag in release workflow + * updated/fixed image ref in release workflow + * updated/fixed platforms in release workflow + * updated/cleaned github actions (#222) + * Make Product Registry configurable (#194) + * updated fileserver directory name (#219) + * fix logging for files + * add extra info for the tempdir override flag + * tempdir override flag for load + * deprecate the cache flag instead of remove + * switch to using bci-golang as builder image + * fix: ensure /tmp for hauler store load + * added the copy back for now + * remove copy at the image sync not needed with cosign update + * removed misleading cache flag + * better logging when adding to store + * update to v2.2.3 of our cosign fork + * add: dockerignore + * add: Dockerfile + * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 + * Bump github.com/docker/docker + * updated and added new logos + * updated github files + + hauler + +