- bump docker/login-action from 3.1.0 to 3.4.0
- bump docker/metadata-action from 5.5.1 to 5.7.0
- bump docker/setup-buildx-action from 3.3.0 to 3.10.0
- bump docker/build-push-action from 5.3.0 to 6.16.0
- bump sigstore/cosign-installer from 3.5.0 to 3.8.2
I believe chainguard no longer supports arm/v7. This was added at a
user's request I think that was running imageproxy on a raspberry pi or
something. I might switch to a different base image that does have
support, though it's annoying to have to do so. In the meantime, users
can always built the image themselves for other platforms.
This requires updating to a more recent version of golangci-lint, which
has some new failures. This removes those failing linters, and I'll
need to come back and look at those problems in a followup change.
I'm not entirely sure why I had this in the first place... probably just
a misunderstanding at the time of what a mux did and when it is helpful.
In this case, it serves no purpose.
I'm honestly not sure which formatter this is using. Probably something
from the markdown LSP server I'm using. Maybe something built in to
neovim or that ships with LazyVim?
When following redirects, ensure that the final URL is not in the
configured DenyHosts list, but do not further enforce presence in the
AllowHosts list.
This was initially added in #237, and the original use case was about
protecting against redirects being used to bypass denied hosts. They
were using URL signatures and deny lists (for localhost, etc), but not
allow lists. So really, checking against the deny list is all that was
needed in that case.
This came up recently for me as I was trying to proxy images on a remote
host that redirects to Amazon S3. Even though the original URL was
signed, the redirect was being denied because s3-us-west-2.amazonaws.com
isn't on of my allowed host. But I don't want to allow all of S3, just
the signed URLs.
This has begun failing with the error:
error generating coverage report: write |1: file already closed
I'm not 100% sure what's causing this, but this test isn't actually
covering very much, and trying to test a main function is often fraught
anyway, so it's not worth the hassle.
This is not a new requirement... I started using 1.17 features at some
point in the past (as indicated in the CI tests). I just missed
declaring that requirement in the go.mod file.
With go1.17, the structure of the go.mod files changes a bit, but this
shouldn't actually have any actual changes in the dependency tree.
apparently cosign doesn't like signing tags :)
WARNING: Image reference ghcr.io/willnorris/imageproxy:main uses a tag,
not a digest, to identify the image to sign.
This can lead you to sign a different image than the intended one.
Please use a digest (example.com/ubuntu@sha256:abc123...) rather than
tag (example.com/ubuntu:latest) for the input to cosign. The ability to
refer to images by tag will be removed in a future release.
