Skip to content

Commit d76659e

Browse files
devon-mardevon-mar
authored
Merge branch 'cesanta:main' into mtls
2 parents 5dd7b10 + 78e779a commit d76659e

30 files changed

+530
-1641
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,20 @@ jobs:
2323
language: [ 'go' ]
2424
steps:
2525
- name: Checkout repository
26-
uses: actions/checkout@v2
26+
uses: actions/checkout@v4
2727

2828
# Initializes the CodeQL tools for scanning.
2929
- name: Initialize CodeQL
30-
uses: github/codeql-action/init@v1
30+
uses: github/codeql-action/init@v3
3131
with:
3232
languages: ${{ matrix.language }}
3333

3434
- name: Autobuild
35-
uses: github/codeql-action/autobuild@v1
35+
uses: github/codeql-action/autobuild@v3
3636

3737
#- run: |
3838
# make bootstrap
3939
# make release
4040

4141
- name: Perform CodeQL Analysis
42-
uses: github/codeql-action/analyze@v1
42+
uses: github/codeql-action/analyze@v3

‎.github/workflows/docker.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616

1717
steps:
1818
- name: Install Go
19-
uses: actions/setup-go@v2
19+
uses: actions/setup-go@v5
2020
with:
21-
go-version: "1.19.x"
21+
go-version: "1.24.x"
2222

2323
- name: Checkout code
24-
uses: actions/checkout@v2
24+
uses: actions/checkout@v4
2525

2626
- name: Get Build Data
2727
id: info
@@ -33,7 +33,7 @@ jobs:
3333
3434
- name: Docker meta
3535
id: docker_meta
36-
uses: crazy-max/ghaction-docker-meta@v1
36+
uses: crazy-max/ghaction-docker-meta@v5
3737
with:
3838
images: cesanta/docker_auth
3939
tag-edge: true
@@ -43,28 +43,28 @@ jobs:
4343
{{major}}.{{minor}}
4444
4545
- name: Set up QEMU
46-
uses: docker/setup-qemu-action@v1
46+
uses: docker/setup-qemu-action@v3
4747
with:
4848
platforms: all
4949

5050
- name: Set up Docker Buildx
5151
id: buildx
52-
uses: docker/setup-buildx-action@v1
52+
uses: docker/setup-buildx-action@v3
5353
with:
5454
install: true
5555
version: latest
5656
# TODO: Remove driver-opts once fix is released docker/buildx#386
5757
driver-opts: image=moby/buildkit:master
5858

5959
- name: Login to DockerHub
60-
uses: docker/login-action@v1
60+
uses: docker/login-action@v3
6161
with:
6262
username: ${{ secrets.DOCKER_USERNAME }}
6363
password: ${{ secrets.DOCKER_PASSWORD }}
6464
if: github.event_name == 'push'
6565

6666
- name: Build and Push
67-
uses: docker/build-push-action@v2
67+
uses: docker/build-push-action@v6
6868
with:
6969
context: auth_server
7070
file: auth_server/Dockerfile

‎.github/workflows/go_test.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@ jobs:
44
test:
55
strategy:
66
matrix:
7-
go-version: [1.17.x, 1.18.x, 1.19.x, 1.20.x, 1.21.x]
7+
go-version: [1.23.x,1.24.x]
88
os: [ubuntu-latest]
99
runs-on: ${{ matrix.os }}
1010
steps:
1111
- name: Install Go
12-
uses: actions/setup-go@v2
12+
uses: actions/setup-go@v5
1313
with:
1414
go-version: ${{ matrix.go-version }}
1515
- name: Checkout code
16-
uses: actions/checkout@v2
16+
uses: actions/checkout@v4
1717
- name: Test
1818
run: |
1919
cd auth_server

‎auth_server/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
FROM golang:1.21-alpine3.19 as build
1+
FROM golang:1.24-alpine3.22 AS build
22

33
ARG VERSION
4-
ENV VERSION "${VERSION}"
4+
ENV VERSION="${VERSION}"
55
ARG BUILD_ID
6-
ENV BUILD_ID "${BUILD_ID}"
6+
ENV BUILD_ID="${BUILD_ID}"
77
ARG CGO_EXTRA_CFLAGS
88

99
RUN apk add -U --no-cache ca-certificates make git gcc musl-dev binutils-gold
@@ -12,7 +12,7 @@ COPY . /build
1212
WORKDIR /build
1313
RUN make build
1414

15-
FROM alpine:3.19
15+
FROM alpine:3.22
1616
COPY --from=build /build/auth_server /docker_auth/
1717
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
1818
ENTRYPOINT ["/docker_auth/auth_server"]

‎auth_server/authn/data/gitlab_auth_result.tmpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,11 @@
4343
<body>
4444
<p class="message">
4545
You are successfully authenticated to the Docker Registry.
46-
Use the following username and password to login into the registry:
46+
Log into the registry using one of these commands:
4747
</p>
4848
<hr>
4949
<pre class="command"><span>$ </span>docker login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
50+
<pre class="command"><span>$ </span>podman login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
51+
<pre class="command"><span>$ </span>nerdctl login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
5052
</body>
5153
</html>

‎auth_server/authn/data/oidc_auth_result.tmpl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,11 @@
99
<body>
1010
<p class="message">
1111
You are successfully authenticated for the Docker Registry.
12-
Use the following username and password to login into the registry:
12+
Log into the registry using one of these commands:
1313
</p>
1414
<hr>
1515
<pre class="command"><span>$ </span>docker login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
16+
<pre class="command"><span>$ </span>podman login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
17+
<pre class="command"><span>$ </span>nerdctl login -u {{.Username}} -p {{.Password}} {{if .RegistryUrl}}{{.RegistryUrl}}{{else}}docker.example.com{{end}}</pre>
1618
</body>
1719
</html>

‎auth_server/authn/github_auth.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222
"errors"
2323
"fmt"
2424
"html/template"
25-
"io/ioutil"
25+
"io"
2626
"net/http"
2727
"net/url"
2828
"strings"
@@ -117,7 +117,6 @@ func execGHExperimentalApiRequest(url string, token string) (*http.Response, err
117117
}
118118

119119
// removeSubstringsFromString removes all occurences of stringsToStrip from sourceStr
120-
//
121120
func removeSubstringsFromString(sourceStr string, stringsToStrip []string) string {
122121
theNewString := sourceStr
123122
for _, i := range stringsToStrip {
@@ -129,7 +128,6 @@ func removeSubstringsFromString(sourceStr string, stringsToStrip []string) strin
129128
// parseLinkHeader parses the HTTP headers from the Github API response
130129
//
131130
// https://developer.github.com/v3/guides/traversing-with-pagination/
132-
//
133131
func parseLinkHeader(linkLines []string) (linkHeader, error) {
134132
var lH linkHeader
135133
// URL in link is enclosed in < >
@@ -255,7 +253,7 @@ func (gha *GitHubAuth) doGitHubAuthCreateToken(rw http.ResponseWriter, code stri
255253
http.Error(rw, fmt.Sprintf("Error talking to GitHub auth backend: %s", err), http.StatusServiceUnavailable)
256254
return
257255
}
258-
codeResp, _ := ioutil.ReadAll(resp.Body)
256+
codeResp, _ := io.ReadAll(resp.Body)
259257
resp.Body.Close()
260258
glog.V(2).Infof("Code to token resp: %s", strings.Replace(string(codeResp), "\n", " ", -1))
261259

@@ -317,7 +315,7 @@ func (gha *GitHubAuth) validateAccessToken(token string) (user string, err error
317315
err = fmt.Errorf("could not verify token %s: %s", token, err)
318316
return
319317
}
320-
body, _ := ioutil.ReadAll(resp.Body)
318+
body, _ := io.ReadAll(resp.Body)
321319
resp.Body.Close()
322320

323321
var ti GitHubTokenUser
@@ -386,7 +384,7 @@ func (gha *GitHubAuth) fetchTeams(token string) ([]string, error) {
386384
}
387385

388386
respHeaders := resp.Header
389-
body, _ := ioutil.ReadAll(resp.Body)
387+
body, _ := io.ReadAll(resp.Body)
390388
resp.Body.Close()
391389

392390
err = json.Unmarshal(body, &pagedTeams)

‎auth_server/authn/gitlab_auth.go‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222
"errors"
2323
"fmt"
2424
"html/template"
25-
"io/ioutil"
25+
"io"
2626
"net/http"
2727
"net/url"
2828
"strings"
@@ -103,7 +103,6 @@ type GitlabAuth struct {
103103
tmplResult *template.Template
104104
}
105105

106-
107106
func NewGitlabAuth(c *GitlabAuthConfig) (*GitlabAuth, error) {
108107
var db TokenDB
109108
var err error
@@ -205,7 +204,7 @@ func (glab *GitlabAuth) doGitlabAuthCreateToken(rw http.ResponseWriter, code str
205204
http.Error(rw, fmt.Sprintf("Error talking to GitLab auth backend: %s", err), http.StatusServiceUnavailable)
206205
return
207206
}
208-
codeResp, _ := ioutil.ReadAll(resp.Body)
207+
codeResp, _ := io.ReadAll(resp.Body)
209208
resp.Body.Close()
210209
glog.V(2).Infof("Code to token resp: %s", strings.Replace(string(codeResp), "\n", " ", -1))
211210

@@ -230,7 +229,6 @@ func (glab *GitlabAuth) doGitlabAuthCreateToken(rw http.ResponseWriter, code str
230229

231230
glog.Infof("New GitLab auth token for %s", user)
232231

233-
234232
v := &TokenDBValue{
235233
TokenType: c2t.TokenType,
236234
AccessToken: c2t.AccessToken,
@@ -247,7 +245,7 @@ func (glab *GitlabAuth) doGitlabAuthCreateToken(rw http.ResponseWriter, code str
247245

248246
func (glab *GitlabAuth) validateGitlabAccessToken(token string) (user string, err error) {
249247
glog.Infof("Gitlab API: Fetching user info")
250-
req, err := http.NewRequest("GET", fmt.Sprintf("%s/user", glab.getGitlabApiUri()),nil)
248+
req, err := http.NewRequest("GET", fmt.Sprintf("%s/user", glab.getGitlabApiUri()), nil)
251249

252250
if err != nil {
253251
err = fmt.Errorf("could not create request to get information for token %s: %s", token, err)
@@ -261,7 +259,7 @@ func (glab *GitlabAuth) validateGitlabAccessToken(token string) (user string, er
261259
err = fmt.Errorf("could not verify token %s: %s", token, err)
262260
return
263261
}
264-
body, _ := ioutil.ReadAll(resp.Body)
262+
body, _ := io.ReadAll(resp.Body)
265263
resp.Body.Close()
266264
var ti GitlabTokenUser
267265
err = json.Unmarshal(body, &ti)
@@ -302,7 +300,6 @@ func (glab *GitlabAuth) checkGitlabOrganization(token, user string) (err error)
302300
return fmt.Errorf("Unknown status for membership of organization %s: %s", glab.config.Organization, resp.Status)
303301
}
304302

305-
306303
func (glab *GitlabAuth) validateGitlabServerToken(user string) (*TokenDBValue, error) {
307304
v, err := glab.db.GetValue(user)
308305
if err != nil || v == nil {

‎auth_server/authn/google_auth.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import (
2121
"errors"
2222
"fmt"
2323
"html/template"
24-
"io/ioutil"
24+
"io"
2525
"net/http"
2626
"net/url"
2727
"strings"
@@ -162,7 +162,7 @@ func (ga *GoogleAuth) DoGoogleAuth(rw http.ResponseWriter, req *http.Request) {
162162
ga.doGoogleAuthPage(rw, req)
163163
return
164164
}
165-
gauthRequest, _ := ioutil.ReadAll(req.Body)
165+
gauthRequest, _ := io.ReadAll(req.Body)
166166
glog.V(2).Infof("gauth request: %s", string(gauthRequest))
167167
var gar GoogleAuthRequest
168168
err := json.Unmarshal(gauthRequest, &gar)
@@ -203,7 +203,7 @@ func (ga *GoogleAuth) doGoogleAuthCreateToken(rw http.ResponseWriter, code strin
203203
http.Error(rw, fmt.Sprintf("Error talking to Google auth backend: %s", err), http.StatusServiceUnavailable)
204204
return
205205
}
206-
codeResp, _ := ioutil.ReadAll(resp.Body)
206+
codeResp, _ := io.ReadAll(resp.Body)
207207
resp.Body.Close()
208208
glog.V(2).Infof("Code to token resp: %s", strings.Replace(string(codeResp), "\n", " ", -1))
209209

@@ -262,7 +262,7 @@ func (ga *GoogleAuth) getIDTokenInfo(token string) (*GoogleTokenInfo, error) {
262262
if err != nil {
263263
return nil, fmt.Errorf("could not verify token %s: %s", token, err)
264264
}
265-
body, _ := ioutil.ReadAll(resp.Body)
265+
body, _ := io.ReadAll(resp.Body)
266266
resp.Body.Close()
267267

268268
var ti GoogleTokenInfo
@@ -317,7 +317,7 @@ func (ga *GoogleAuth) refreshAccessToken(refreshToken string) (rtr RefreshTokenR
317317
err = fmt.Errorf("Error talking to Google auth backend: %s", err)
318318
return
319319
}
320-
respStr, _ := ioutil.ReadAll(resp.Body)
320+
respStr, _ := io.ReadAll(resp.Body)
321321
glog.V(2).Infof("Refresh token resp: %s", strings.Replace(string(respStr), "\n", " ", -1))
322322

323323
err = json.Unmarshal(respStr, &rtr)
@@ -334,7 +334,7 @@ func (ga *GoogleAuth) validateAccessToken(toktype, token string) (user string, e
334334
if err != nil {
335335
return
336336
}
337-
respStr, _ := ioutil.ReadAll(resp.Body)
337+
respStr, _ := io.ReadAll(resp.Body)
338338
glog.V(2).Infof("Access token validation rrsponse: %s", strings.Replace(string(respStr), "\n", " ", -1))
339339
var pr ProfileResponse
340340
err = json.Unmarshal(respStr, &pr)

‎auth_server/authn/oidc_auth.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222
"errors"
2323
"fmt"
2424
"html/template"
25-
"io/ioutil"
25+
"io"
2626
"net/http"
2727
"strings"
2828
"time"
@@ -40,29 +40,29 @@ import (
4040
type OIDCAuthConfig struct {
4141
// --- necessary ---
4242
// URL of the authentication provider. Must be able to serve the /.well-known/openid-configuration
43-
Issuer string `yaml:"issuer,omitempty"`
43+
Issuer string `yaml:"issuer,omitempty"`
4444
// URL of the auth server. Has to end with /oidc_auth
45-
RedirectURL string `yaml:"redirect_url,omitempty"`
45+
RedirectURL string `yaml:"redirect_url,omitempty"`
4646
// ID and secret, priovided by the OIDC provider after registration of the auth server
47-
ClientId string `yaml:"client_id,omitempty"`
48-
ClientSecret string `yaml:"client_secret,omitempty"`
49-
ClientSecretFile string `yaml:"client_secret_file,omitempty"`
47+
ClientId string `yaml:"client_id,omitempty"`
48+
ClientSecret string `yaml:"client_secret,omitempty"`
49+
ClientSecretFile string `yaml:"client_secret_file,omitempty"`
5050
// path where the tokendb should be stored within the container
51-
LevelTokenDB *LevelDBStoreConfig `yaml:"level_token_db,omitempty"`
52-
GCSTokenDB *GCSStoreConfig `yaml:"gcs_token_db,omitempty"`
53-
RedisTokenDB *RedisStoreConfig `yaml:"redis_token_db,omitempty"`
51+
LevelTokenDB *LevelDBStoreConfig `yaml:"level_token_db,omitempty"`
52+
GCSTokenDB *GCSStoreConfig `yaml:"gcs_token_db,omitempty"`
53+
RedisTokenDB *RedisStoreConfig `yaml:"redis_token_db,omitempty"`
5454
// --- optional ---
55-
HTTPTimeout time.Duration `yaml:"http_timeout,omitempty"`
55+
HTTPTimeout time.Duration `yaml:"http_timeout,omitempty"`
5656
// the URL of the docker registry. Used to generate a full docker login command after authentication
57-
RegistryURL string `yaml:"registry_url,omitempty"`
57+
RegistryURL string `yaml:"registry_url,omitempty"`
5858
// --- optional ---
5959
// String claim to use for the username
60-
UserClaim string `yaml:"user_claim,omitempty"`
60+
UserClaim string `yaml:"user_claim,omitempty"`
6161
// --- optional ---
6262
// []string to add as labels.
63-
LabelsClaims []string `yaml:"labels_claims,omitempty"`
63+
LabelsClaims []string `yaml:"labels_claims,omitempty"`
6464
// --- optional ---
65-
Scopes []string `yaml:"scopes,omitempty"`
65+
Scopes []string `yaml:"scopes,omitempty"`
6666
}
6767

6868
// OIDCRefreshTokenResponse is sent by OIDC provider in response to the grant_type=refresh_token request.
@@ -274,7 +274,7 @@ func (ga *OIDCAuth) refreshAccessToken(refreshToken string) (rtr OIDCRefreshToke
274274
err = fmt.Errorf("error talking to OIDC auth backend: %s", err)
275275
return
276276
}
277-
respStr, _ := ioutil.ReadAll(resp.Body)
277+
respStr, _ := io.ReadAll(resp.Body)
278278
glog.V(2).Infof("Refresh token resp: %s", strings.Replace(string(respStr), "\n", " ", -1))
279279

280280
err = json.Unmarshal(respStr, &rtr)

0 commit comments

Comments
 (0)