de02e1f046
1. Removing distribution/distribution from the Hold Service (biggest change) The hold service previously used distribution's StorageDriver interface for all blob operations. This replaces it with direct AWS SDK v2 calls through ATCR's own pkg/s3.S3Service: - New S3Service methods: Stat(), PutBytes(), Move(), Delete(), WalkBlobs(), ListPrefix() added to pkg/s3/types.go - Pull zone fix: Presigned URLs are now generated against the real S3 endpoint, then the host is swapped to the CDN URL post-signing (previously the CDN URL was set as the endpoint, which broke SigV4 signatures) - All hold subsystems migrated: GC, OCI uploads, XRPC handlers, profile uploads, scan broadcaster, manifest posts — all now use *s3.S3Service instead of storagedriver.StorageDriver - Config simplified: Removed configuration.Storage type and buildStorageConfigFromFields(); replaced with a simple S3Params() method - Mock expanded: MockS3Client gains an in-memory object store + 5 new methods, replacing duplicate mockStorageDriver implementations in tests (~160 lines deleted from each test file) 2. Vulnerability Scan UI in AppView (new feature) Displays scan results from the hold's PDS on the repository page: - New lexicon: io/atcr/hold/scan.json with vulnReportBlob field for storing full Grype reports - Two new HTMX endpoints: /api/scan-result (badge) and /api/vuln-details (modal with CVE table) - New templates: vuln-badge.html (severity count chips) and vuln-details.html (full CVE table with NVD/GHSA links) - Repository page: Lazy-loads scan badges per manifest via HTMX - Tests: ~590 lines of test coverage for both handlers 3. S3 Diagnostic Tool New cmd/s3-test/main.go (418 lines) — tests S3 connectivity with both SDK v1 and v2, including presigned URL generation, pull zone host swapping, and verbose signing debug output. 4. Deployment Tooling - New syncServiceUnit() for comparing/updating systemd units on servers - Update command now syncs config keys (adds missing keys from template) and service units with daemon-reload 5. DB Migration 0011_fix_captain_successor_column.yaml — rebuilds hold_captain_records to add the successor column that was missed in a previous migration. 6. Documentation - APPVIEW-UI-FUTURE.md rewritten as a status-tracked feature inventory - DISTRIBUTION.md renamed to CREDENTIAL_HELPER.md - New REMOVING_DISTRIBUTION.md — 480-line analysis of fully removing distribution from the appview side 7. go.mod aws-sdk-go v1 moved from indirect to direct (needed by cmd/s3-test).
194 lines
9.7 KiB
Modula-2
194 lines
9.7 KiB
Modula-2
module atcr.io
|
|
|
|
go 1.25.7
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go v1.55.8
|
|
github.com/aws/aws-sdk-go-v2 v1.41.1
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.7
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.7
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0
|
|
github.com/bluesky-social/indigo v0.0.0-20260213003059-85cdd0d6871c
|
|
github.com/distribution/distribution/v3 v3.0.0
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/earthboundkid/versioninfo/v2 v2.24.1
|
|
github.com/go-chi/chi/v5 v5.2.5
|
|
github.com/go-chi/render v1.0.3
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/goki/freetype v1.0.5
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
|
|
github.com/ipfs/go-block-format v0.2.3
|
|
github.com/ipfs/go-cid v0.6.0
|
|
github.com/ipfs/go-datastore v0.9.1
|
|
github.com/ipfs/go-ipfs-blockstore v1.3.1
|
|
github.com/ipfs/go-ipld-cbor v0.2.1
|
|
github.com/ipfs/go-ipld-format v0.6.3
|
|
github.com/ipfs/go-libipfs v0.7.0
|
|
github.com/ipld/go-car v0.6.3
|
|
github.com/klauspost/compress v1.18.4
|
|
github.com/microcosm-cc/bluemonday v1.0.27
|
|
github.com/multiformats/go-multihash v0.2.3
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
|
|
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/stripe/stripe-go/v84 v84.3.0
|
|
github.com/tursodatabase/go-libsql v0.0.0-20251219133454-43644db490ff
|
|
github.com/whyrusleeping/cbor-gen v0.3.1
|
|
github.com/yuin/goldmark v1.7.16
|
|
go.opentelemetry.io/otel v1.40.0
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.4
|
|
golang.org/x/crypto v0.48.0
|
|
golang.org/x/image v0.36.0
|
|
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
|
|
gorm.io/gorm v1.31.1
|
|
)
|
|
|
|
require (
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
|
|
github.com/RussellLuo/slidingwindow v0.0.0-20200528002341-535bb99d338b // indirect
|
|
github.com/ajg/form v1.6.1 // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
|
|
github.com/aws/smithy-go v1.24.0 // indirect
|
|
github.com/aymerick/douceur v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bshuster-repo/logrus-logstash-hook v1.1.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.7.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/docker/docker-credential-helpers v0.9.5 // indirect
|
|
github.com/docker/go-events v0.0.0-20250808211157-605354379745 // indirect
|
|
github.com/docker/go-metrics v0.0.1 // indirect
|
|
github.com/fatih/color v1.18.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/gammazero/chanqueue v1.1.2 // indirect
|
|
github.com/gammazero/deque v1.2.1 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/snappy v1.0.0 // indirect
|
|
github.com/google/go-querystring v1.2.0 // indirect
|
|
github.com/gorilla/css v1.0.1 // indirect
|
|
github.com/gorilla/handlers v1.5.2 // indirect
|
|
github.com/gorilla/mux v1.8.1 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.8 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
|
|
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru/arc/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/ipfs/bbloom v0.0.4 // indirect
|
|
github.com/ipfs/boxo v0.36.0 // indirect
|
|
github.com/ipfs/go-cidutil v0.1.1 // indirect
|
|
github.com/ipfs/go-dsqueue v0.2.0 // indirect
|
|
github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect
|
|
github.com/ipfs/go-ipfs-util v0.0.3 // indirect
|
|
github.com/ipfs/go-ipld-legacy v0.2.2 // indirect
|
|
github.com/ipfs/go-log v1.0.5 // indirect
|
|
github.com/ipfs/go-log/v2 v2.9.1 // indirect
|
|
github.com/ipfs/go-metrics-interface v0.3.0 // indirect
|
|
github.com/ipld/go-codec-dagpb v1.7.0 // indirect
|
|
github.com/ipld/go-ipld-prime v0.21.0 // indirect
|
|
github.com/jinzhu/inflection v1.0.0 // indirect
|
|
github.com/jinzhu/now v1.1.5 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/libsql/sqlite-antlr4-parser v0.0.0-20240721121621-c0bdc870f11c // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/minio/sha256-simd v1.0.1 // indirect
|
|
github.com/mr-tron/base58 v1.2.0 // indirect
|
|
github.com/multiformats/go-base32 v0.1.0 // indirect
|
|
github.com/multiformats/go-base36 v0.2.0 // indirect
|
|
github.com/multiformats/go-multibase v0.2.0 // indirect
|
|
github.com/multiformats/go-multicodec v0.10.0 // indirect
|
|
github.com/multiformats/go-varint v0.1.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f // indirect
|
|
github.com/prometheus/client_golang v1.23.2 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.67.5 // indirect
|
|
github.com/prometheus/otlptranslator v1.0.0 // indirect
|
|
github.com/prometheus/procfs v0.19.2 // indirect
|
|
github.com/redis/go-redis/extra/rediscmd/v9 v9.17.3 // indirect
|
|
github.com/redis/go-redis/extra/redisotel/v9 v9.17.3 // indirect
|
|
github.com/redis/go-redis/v9 v9.17.3 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.4 // indirect
|
|
github.com/spaolacci/murmur3 v1.1.0 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
|
|
gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/bridges/prometheus v0.65.0 // indirect
|
|
go.opentelemetry.io/contrib/exporters/autoexport v0.65.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/prometheus v0.62.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/log v0.16.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/log v0.16.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.40.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.1 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.3 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
|
|
golang.org/x/net v0.50.0 // indirect
|
|
golang.org/x/sync v0.19.0 // indirect
|
|
golang.org/x/sys v0.41.0 // indirect
|
|
golang.org/x/text v0.34.0 // indirect
|
|
golang.org/x/time v0.14.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
|
|
google.golang.org/grpc v1.79.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
lukechampine.com/blake3 v1.4.1 // indirect
|
|
)
|