Merge tag 'v2.8.3'

registry 2.8.3

Welcome to the v2.8.3 release of registry!

Welcome to the 2.8.3 release of registry!

The 2.8.3 registry release fixes a few bugs and makes a few dependency updates.
The Go runtime has been bumped to 1.20.8.

See the changelog below for full list of changes.

* Do not close HTTP request body in HTTP handler ([distribution#4068](distribution#4068))
* Set Content-Type header in registry client ReadFrom ([distribution#4053](distribution#4053))
* Do not parse errors as JSON unless Content-Type is set to JSON ([distribution#4054](distribution#4054))
* Enable Go build tags ([distribution#4009](distribution#4009))

* replace deprecated function SplitHostname ([distribution#4032](distribution#4032))

* update to go1.20.8 ([distribution#4056](distribution#4056))

* deprecate digestset package in favor of go-digest/digestset  ([distribution#4064](distribution#4064))
* deprecate reference package, migrate to github.com/distribution/reference ([distribution#4063](distribution#4063))

Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2)

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

* Milos Gajdos
* Sebastiaan van Stijn
* Milos Gajdos
* James Hewitt
* Ben Manuel
* Marcus Pettersen Irgens
* zounengren
<details><summary>30 commits</summary>
<p>

* Add v2.8.3 release notes ([distribution#4088](distribution#4088))
  * [`a4fa6992`](distribution@a4fa699) Add v2.8.3 release notes
* [release/2.8] Do not close HTTP request body in HTTP handler ([distribution#4068](distribution#4068))
  * [`5e6b1b5c`](distribution@5e6b1b5) Do not close HTTP request body in HTTP handler
* [release/2.8] digestset: deprecate package in favor of go-digest/digestset  ([distribution#4064](distribution#4064))
  * [`29b00e8b`](distribution@29b00e8) digestset: deprecate package in favor of go-digest/digestset
  * [`d1ab2430`](distribution@d1ab243) [release/2.8] vendor: github.com/opencontainers/go-digest v1.0.0
* [release/2.8] deprecate reference package, migrate to github.com/distribution/reference ([distribution#4063](distribution#4063))
  * [`3dda0677`](distribution@3dda067) deprecate reference package, migrate to github.com/distribution/reference
* [release/2.8 backport] Set Content-Type header in registry client ReadFrom ([distribution#4053](distribution#4053))
  * [`cb121c3f`](distribution@cb121c3) Set Content-Type header in registry client ReadFrom
* [release/2.8] update to go1.20.8 ([distribution#4056](distribution#4056))
  * [`3c6f7788`](distribution@3c6f778) update to go1.20.8
  * [`31f5cd48`](distribution@31f5cd4) Handle rand deprecations in go 1.20
  * [`29b8ba0b`](distribution@29b8ba0) Update to go 1.20
  * [`3316b198`](distribution@3316b19) Update to golang 1.19.10
  * [`444d053e`](distribution@444d053) update golangci-lint to v1.52
  * [`b800af44`](distribution@b800af4) ignore SA1019: ac.(*accessController).rootCerts.Subjects has been deprecated
  * [`0a98a00d`](distribution@0a98a00) Ignore SA1019: SplitHostname is deprecated.
* [release/2.8 backport] Dont parse errors as JSON unless Content-Type is set to JSON ([distribution#4054](distribution#4054))
  * [`2ec0471b`](distribution@2ec0471) Dont parse errors as JSON unless Content-Type is set to JSON
* [release/2.8 backport] reference: replace deprecated function SplitHostname ([distribution#4032](distribution#4032))
  * [`b57133cc`](distribution@b57133c) referene: fix formatting of "deprecated" comment.
  * [`2c4bf1a6`](distribution@2c4bf1a) replace deprecated function
* [release/2.8 backport] Enable Go build tags ([distribution#4009](distribution#4009))
  * [`110cb753`](distribution@110cb75) Enable build tags in 2.8
  * [`2d62a402`](distribution@2d62a40) s3: add interface assertion
  * [`2548973b`](distribution@2548973) Enable Go build tags
* Pass `BUILDTAGS` argument to `go build` ([distribution#3926](distribution#3926))
  * [`ab7178cc`](distribution@ab7178c) Pass BUILDTAGS argument to go build
</p>
</details>

* **github.com/distribution/reference**    49c28499d219 **_new_**
* **github.com/opencontainers/go-digest**  a6d0ee40d420 -> ea51bea511f7

Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2)

.dockerignore

@@ -0,0 +1 @@
+bin/

.github/workflows/build.yml

@@ -87,7 +87,6 @@ jobs:
           draft: true
           files: |
             bin/*.tar.gz
-            bin/*.zip
             bin/*.sha256
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     env:
-      DOCKER_BUILDTAGS: "include_oss include_gcs"
+      BUILDTAGS: "include_oss,include_gcs"
       CGO_ENABLED: 1
       GO111MODULE: "auto"
       GOPATH: ${{ github.workspace }}
@@ -25,26 +25,26 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.16.*
+        go-version: 1.20.8
 
     - name: Dependencies
       run: |
           sudo apt-get -q update
           sudo -E apt-get -yq --no-install-suggests --no-install-recommends install python2-minimal
-          cd /tmp && go get -u github.com/vbatts/git-validation
+          cd /tmp && go install github.com/vbatts/git-validation@latest
 
     - name: Build
       working-directory: ./src/github.com/docker/distribution
       run: |
         DCO_VERBOSITY=-q script/validate/dco
         GO111MODULE=on script/setup/install-dev-tools
         script/validate/vendor
-        go build -i .
+        go build .
         make check
         make build
         make binaries
         if [ "$GOOS" = "linux" ]; then make coverage ; fi
 
     - uses: codecov/codecov-action@v1
       with:
-        directory: ./src/github.com/docker/distribution
+        directory: ./src/github.com/docker/distribution

.golangci.yml

@@ -1,7 +1,5 @@
 linters:
   enable:
-    - structcheck
-    - varcheck
     - staticcheck
     - unconvert
     - gofmt
@@ -14,7 +12,22 @@ linters:
   disable:
     - errcheck
 
+linters-settings:
+  revive:
+    rules:
+      # TODO(thaJeztah): temporarily disabled the "unused-parameter" check.
+      # It produces many warnings, and some of those may need to be looked at.
+      - name: unused-parameter
+        disabled: true
+
 run:
   deadline: 2m
   skip-dirs:
     - vendor
+
+issues:
+  exclude-rules:
+    # io/ioutil is deprecated, but won't be removed until Go v2. It's safe to ignore for the release/2.8 branch.
+    - text: "SA1019: \"io/ioutil\" has been deprecated since Go 1.16"
+      linters:
+        - staticcheck

.mailmap

@@ -44,6 +44,11 @@ Thomas Berger <loki@lokis-chaos.de> Thomas Berger <tbe@users.noreply.github.com>
 Samuel Karp <skarp@amazon.com> Samuel Karp <samuelkarp@users.noreply.github.com>
 Justin Cormack <justin.cormack@docker.com>
 sayboras <sayboras@yahoo.com>
-CrazyMax <github@crazymax.dev>
 CrazyMax <github@crazymax.dev> <1951866+crazy-max@users.noreply.github.com>
-CrazyMax <github@crazymax.dev> <crazy-max@users.noreply.github.com>
+Hayley Swimelar <hswimelar@gmail.com>
+Jose D. Gomez R <jose.gomez@suse.com>
+Shengjing Zhu <zhsj@debian.org>
+Silvin Lubecki <31478878+silvin-lubecki@users.noreply.github.com>
+James Hewitt <james.hewitt@gmail.com>
+Marcus Pettersen Irgens <m@mrcus.dev>
+Ben Manuel <bmanuel@users.noreply.github.com>

BUILDING.md

@@ -114,4 +114,4 @@ the registry binary generated in the "./bin" directory:
 ### Optional build tags
 
 Optional [build tags](http://golang.org/pkg/go/build/) can be provided using
-the environment variable `DOCKER_BUILDTAGS`.
+the environment variable `BUILDTAGS`.

Dockerfile

@@ -1,49 +1,59 @@
-# syntax=docker/dockerfile:1.3
+# syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.16.15
-ARG GORELEASER_XX_VERSION=1.2.5
+ARG GO_VERSION=1.20.8
+ARG ALPINE_VERSION=3.18
+ARG XX_VERSION=1.2.1
 
-FROM --platform=$BUILDPLATFORM crazymax/goreleaser-xx:${GORELEASER_XX_VERSION} AS goreleaser-xx
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
-COPY --from=goreleaser-xx / /
-RUN apk add --no-cache file git
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
+COPY --from=xx / /
+RUN apk add --no-cache bash coreutils file git
+ENV GO111MODULE=auto
+ENV CGO_ENABLED=0
 WORKDIR /go/src/github.com/docker/distribution
 
+FROM base AS version
+ARG PKG="github.com/docker/distribution"
+RUN --mount=target=. \
+  VERSION=$(git describe --match 'v[0-9]*' --dirty='.m' --always --tags) REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi); \
+  echo "-X ${PKG}/version.Version=${VERSION#v} -X ${PKG}/version.Revision=${REVISION} -X ${PKG}/version.Package=${PKG}" | tee /tmp/.ldflags; \
+  echo -n "${VERSION}" | tee /tmp/.version;
+
 FROM base AS build
-ENV GO111MODULE=auto
-ENV CGO_ENABLED=0
-# GIT_REF is used by goreleaser-xx to handle the proper git ref when available.
-# It will fallback to the working tree info if empty and use "git tag --points-at"
-# or "git describe" to define the version info.
-ARG GIT_REF
 ARG TARGETPLATFORM
-ARG PKG="github.com/distribution/distribution"
-ARG BUILDTAGS="include_oss include_gcs"
-RUN --mount=type=bind,rw \
-  --mount=type=cache,target=/root/.cache/go-build \
-  --mount=target=/go/pkg/mod,type=cache \
-  goreleaser-xx --debug \
-    --name="registry" \
-    --dist="/out" \
-    --main="./cmd/registry" \
-    --flags="-v" \
-    --ldflags="-s -w -X '$PKG/version.Version={{.Version}}' -X '$PKG/version.Revision={{.Commit}}' -X '$PKG/version.Package=$PKG'" \
-    --tags="$BUILDTAGS" \
-    --files="LICENSE" \
-    --files="README.md"
-
-FROM scratch AS artifact
-COPY --from=build /out/*.tar.gz /
-COPY --from=build /out/*.zip /
-COPY --from=build /out/*.sha256 /
+ARG LDFLAGS="-s -w"
+ARG BUILDTAGS="include_oss,include_gcs"
+RUN --mount=type=bind,target=/go/src/github.com/docker/distribution,rw \
+    --mount=type=cache,target=/root/.cache/go-build \
+    --mount=target=/go/pkg/mod,type=cache \
+    --mount=type=bind,source=/tmp/.ldflags,target=/tmp/.ldflags,from=version \
+      set -x ; xx-go build -tags "${BUILDTAGS}" -trimpath -ldflags "$(cat /tmp/.ldflags) ${LDFLAGS}" -o /usr/bin/registry ./cmd/registry \
+      && xx-verify --static /usr/bin/registry
 
 FROM scratch AS binary
-COPY --from=build /usr/local/bin/registry* /
+COPY --from=build /usr/bin/registry /
+
+FROM base AS releaser
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+WORKDIR /work
+RUN --mount=from=binary,target=/build \
+    --mount=type=bind,target=/src \
+    --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
+      VERSION=$(cat /tmp/.version) \
+      && mkdir -p /out \
+      && cp /build/registry /src/README.md /src/LICENSE . \
+      && tar -czvf "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz" * \
+      && sha256sum -z "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz" | awk '{ print $1 }' > "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz.sha256"
+
+FROM scratch AS artifact
+COPY --from=releaser /out /
 
-FROM alpine:3.14
+FROM alpine:${ALPINE_VERSION}
 RUN apk add --no-cache ca-certificates
 COPY cmd/registry/config-dev.yml /etc/docker/registry/config.yml
-COPY --from=build /usr/local/bin/registry /bin/registry
+COPY --from=binary /registry /bin/registry
 VOLUME ["/var/lib/registry"]
 EXPOSE 5000
 ENTRYPOINT ["registry"]

Makefile

@@ -50,7 +50,7 @@ version/version.go:
 
 check: ## run all linters (TODO: enable "unused", "varcheck", "ineffassign", "unconvert", "staticheck", "goimports", "structcheck")
 	@echo "$(WHALE) $@"
-	golangci-lint run
+	@GO111MODULE=off golangci-lint --build-tags "${BUILDTAGS}" run
 
 test: ## run tests, except integration test with test.short
 	@echo "$(WHALE) $@"

blobs.go

@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/docker/distribution/reference"
+	"github.com/distribution/reference"
 	"github.com/opencontainers/go-digest"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )

cmd/registry-api-descriptor-template/main.go

@@ -4,7 +4,7 @@
 // For example, to generate a new API specification, one would execute the
 // following command from the repo root:
 //
-// 	$ registry-api-descriptor-template docs/spec/api.md.tmpl > docs/spec/api.md
+//	$ registry-api-descriptor-template docs/spec/api.md.tmpl > docs/spec/api.md
 //
 // The templates are passed in the api/v2.APIDescriptor object. Please see the
 // package documentation for fields available on that object. The template

configuration/configuration.go

@@ -193,7 +193,8 @@ type Configuration struct {
 		} `yaml:"pool,omitempty"`
 	} `yaml:"redis,omitempty"`
 
-	Health Health `yaml:"health,omitempty"`
+	Health  Health  `yaml:"health,omitempty"`
+	Catalog Catalog `yaml:"catalog,omitempty"`
 
 	Proxy Proxy `yaml:"proxy,omitempty"`
 
@@ -244,6 +245,16 @@ type Configuration struct {
 	} `yaml:"policy,omitempty"`
 }
 
+// Catalog is composed of MaxEntries.
+// Catalog endpoint (/v2/_catalog) configuration, it provides the configuration
+// options to control the maximum number of entries returned by the catalog endpoint.
+type Catalog struct {
+	// Max number of entries returned by the catalog endpoint. Requesting n entries
+	// to the catalog endpoint will return at most MaxEntries entries.
+	// An empty or a negative value will set a default of 1000 maximum entries by default.
+	MaxEntries int `yaml:"maxentries,omitempty"`
+}
+
 // LogHook is composed of hook Level and Type.
 // After hooks configuration, it can execute the next handling automatically,
 // when defined levels of log message emitted.
@@ -584,7 +595,7 @@ type Events struct {
 	IncludeReferences bool `yaml:"includereferences"` // include reference data in manifest events
 }
 
-//Ignore configures mediaTypes and actions of the event, that it won't be propagated
+// Ignore configures mediaTypes and actions of the event, that it won't be propagated
 type Ignore struct {
 	MediaTypes []string `yaml:"mediatypes"` // target media types to ignore
 	Actions    []string `yaml:"actions"`    // ignore action types
@@ -670,6 +681,11 @@ func Parse(rd io.Reader) (*Configuration, error) {
 					if v0_1.Loglevel != Loglevel("") {
 						v0_1.Loglevel = Loglevel("")
 					}
+
+					if v0_1.Catalog.MaxEntries <= 0 {
+						v0_1.Catalog.MaxEntries = 1000
+					}
+
 					if v0_1.Storage.Type() == "" {
 						return nil, errors.New("no storage configuration provided")
 					}

configuration/configuration_test.go

@@ -71,6 +71,9 @@ var configStruct = Configuration{
 			},
 		},
 	},
+	Catalog: Catalog{
+		MaxEntries: 1000,
+	},
 	HTTP: struct {
 		Addr         string        `yaml:"addr,omitempty"`
 		Net          string        `yaml:"net,omitempty"`
@@ -524,6 +527,7 @@ func copyConfig(config Configuration) *Configuration {
 	configCopy.Version = MajorMinorVersion(config.Version.Major(), config.Version.Minor())
 	configCopy.Loglevel = config.Loglevel
 	configCopy.Log = config.Log
+	configCopy.Catalog = config.Catalog
 	configCopy.Log.Fields = make(map[string]interface{}, len(config.Log.Fields))
 	for k, v := range config.Log.Fields {
 		configCopy.Log.Fields[k] = v

context/doc.go

@@ -4,82 +4,82 @@
 //
 // The easiest way to get started is to get the background context:
 //
-// 	ctx := context.Background()
+//	ctx := context.Background()
 //
 // The returned context should be passed around your application and be the
 // root of all other context instances. If the application has a version, this
 // line should be called before anything else:
 //
-// 	ctx := context.WithVersion(context.Background(), version)
+//	ctx := context.WithVersion(context.Background(), version)
 //
 // The above will store the version in the context and will be available to
 // the logger.
 //
-// Logging
+// # Logging
 //
 // The most useful aspect of this package is GetLogger. This function takes
 // any context.Context interface and returns the current logger from the
 // context. Canonical usage looks like this:
 //
-// 	GetLogger(ctx).Infof("something interesting happened")
+//	GetLogger(ctx).Infof("something interesting happened")
 //
 // GetLogger also takes optional key arguments. The keys will be looked up in
 // the context and reported with the logger. The following example would
 // return a logger that prints the version with each log message:
 //
-// 	ctx := context.Context(context.Background(), "version", version)
-// 	GetLogger(ctx, "version").Infof("this log message has a version field")
+//	ctx := context.Context(context.Background(), "version", version)
+//	GetLogger(ctx, "version").Infof("this log message has a version field")
 //
 // The above would print out a log message like this:
 //
-// 	INFO[0000] this log message has a version field        version=v2.0.0-alpha.2.m
+//	INFO[0000] this log message has a version field        version=v2.0.0-alpha.2.m
 //
 // When used with WithLogger, we gain the ability to decorate the context with
 // loggers that have information from disparate parts of the call stack.
 // Following from the version example, we can build a new context with the
 // configured logger such that we always print the version field:
 //
-// 	ctx = WithLogger(ctx, GetLogger(ctx, "version"))
+//	ctx = WithLogger(ctx, GetLogger(ctx, "version"))
 //
 // Since the logger has been pushed to the context, we can now get the version
 // field for free with our log messages. Future calls to GetLogger on the new
 // context will have the version field:
 //
-// 	GetLogger(ctx).Infof("this log message has a version field")
+//	GetLogger(ctx).Infof("this log message has a version field")
 //
 // This becomes more powerful when we start stacking loggers. Let's say we
 // have the version logger from above but also want a request id. Using the
 // context above, in our request scoped function, we place another logger in
 // the context:
 //
-// 	ctx = context.WithValue(ctx, "http.request.id", "unique id") // called when building request context
-// 	ctx = WithLogger(ctx, GetLogger(ctx, "http.request.id"))
+//	ctx = context.WithValue(ctx, "http.request.id", "unique id") // called when building request context
+//	ctx = WithLogger(ctx, GetLogger(ctx, "http.request.id"))
 //
 // When GetLogger is called on the new context, "http.request.id" will be
 // included as a logger field, along with the original "version" field:
 //
-// 	INFO[0000] this log message has a version field        http.request.id=unique id version=v2.0.0-alpha.2.m
+//	INFO[0000] this log message has a version field        http.request.id=unique id version=v2.0.0-alpha.2.m
 //
 // Note that this only affects the new context, the previous context, with the
 // version field, can be used independently. Put another way, the new logger,
 // added to the request context, is unique to that context and can have
 // request scoped variables.
 //
-// HTTP Requests
+// # HTTP Requests
 //
 // This package also contains several methods for working with http requests.
 // The concepts are very similar to those described above. We simply place the
 // request in the context using WithRequest. This makes the request variables
 // available. GetRequestLogger can then be called to get request specific
 // variables in a log line:
 //
-// 	ctx = WithRequest(ctx, req)
-// 	GetRequestLogger(ctx).Infof("request variables")
+//	ctx = WithRequest(ctx, req)
+//	GetRequestLogger(ctx).Infof("request variables")
 //
 // Like above, if we want to include the request data in all log messages in
 // the context, we push the logger to a new context and use that one:
 //
-// 	ctx = WithLogger(ctx, GetRequestLogger(ctx))
+//	ctx = WithLogger(ctx, GetRequestLogger(ctx))
 //
 // The concept is fairly powerful and ensures that calls throughout the stack
 // can be traced in log messages. Using the fields like "http.request.id", one