The latest upstream photon:5.0 arm64 image currently has an empty rootfs,
which fails during the multi-arch base build with "/bin/sh: no such file
or directory". Pin the Photon base to a known-good stable digest to keep
the amd64 and arm64 builds reproducible.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
pin qemu binfmt and prevent publish races
- Pin docker/setup-qemu-action to tonistiigi/binfmt:qemu-v9.2.2 for stable arm64 emulation.
- Add per-branch concurrency in build-package workflow to avoid overlapping runs racing on mutable tags/manifests.
- Rename Go setup step label to match the actual configured version.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
- Use stdlib crypto/pbkdf2 instead of golang.org/x/crypto/pbkdf2 for
password/secret hashing (output unchanged; no migration needed).
- Restrict JWT signing to RSA/RSA-PSS and reject other methods in
pkg/token (default RS256 unchanged).
- Remove unused common/utils/email package (no references in codebase).
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
The per-component base images (goharbor/harbor-core-base, harbor-db-base,
harbor-portal-base, ...) were pushed by both BUILD_PACKAGE matrix jobs to the
same unsuffixed tag (e.g. :dev), so whichever architecture finished last
overwrote the other and the published tag ended up single-arch — the same
last-writer-wins problem goharbor/photon:5.0 had before #23334 (#23324).
Apply the same pattern already used for the component images:
- make/photon/Makefile: _build_base keeps building the local unsuffixed tag
(component Dockerfiles build FROM it unchanged) but pushes an arch-suffixed
tag instead: harbor-<name>-base:<tag>-amd64 / -arm64.
- .github/workflows/build-package.yml: each matrix job also saves the list of
goharbor/*-base repos it built; CREATE_MANIFEST combines the two suffixed
tags into the unsuffixed multi-arch manifest with docker buildx imagetools
create, using the base tag scheme (dev on main, the release version on
release-* branches). The base manifest step only runs when BUILD_BASE_IMAGE
decided to rebuild bases, since otherwise no suffixed tags were pushed in
this run.
Consumers that pull harbor-*-base:<tag> (PULL_BASE_FROM_DOCKERHUB=true flows)
now resolve the correct architecture via the manifest list instead of getting
whatever architecture won the race.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22
- Upgrade the Harbor UI (src/portal) from Angular 16 to Angular 19 and subsequently to Angular 21.
- Upgrade VMware Clarity from v17 to v18, and Node.js from v20 to v22 (updated .nvmrc, CI.yml, Makefile, Dockerfile).
- Migrate Angular templates to the new @if/@for control flow syntax.
- Fix UI issues #1 through #35, including robot accounts, layout, dropdown overlay, and input styling.
- Fix unit tests: resolve NG0100 ExpressionChangedAfterItHasBeenCheckedError in policy.component.spec.ts, replace autoDetectChanges(true) with explicit detectChanges cycles, and use TestBed.overrideComponent to stub AddP2pPolicyComponent template.
- Fix Clarity v18 breaking changes: update dark-theme SCSS import, add cds-theme attribute for theming, update ClrDatagridStateInterface import path, add ClrIconModule to app module.
- Stabilize npm installs and resolve CI/CD pipeline hangs.
- Fix swagger-ui crash caused by React 19 createRoot removal:
- swagger-ui 5.28+ resolves a nested react-dom@19 which removed createRoot
from the main react-dom entry point (moved to react-dom/client). The
swagger-ui-es-bundle-core.js still imports createRoot from react-dom,
making it undefined and causing "TypeError: i is not a function" at render.
- app-swagger-ui/webpack.prod.js: alias bare 'swagger-ui' import to
swagger-ui-bundle.js (the standalone UMD build that ships with React 18
already bundled), bypassing the broken external react-dom@19 entirely.
- app-swagger-ui/package.json: add npm overrides to pin react and
react-dom to ^18.3.1 so future npm installs do not re-introduce React 19.
- angular.json: expose swagger-ui.bundle.js and swagger-ui-index.html
from app-swagger-ui/dist as Angular dev-server assets, enabling the
proxy to serve the locally built, fixed bundle during development.
- Convert eslint-plugin-header config from JSON to JS to apply the ESLint 9 schema fix at config-load time, removing the need for patch-package.
- Pin all dependency versions to exact installed versions from the lock file, and remove unused prettier-eslint package.
- Fix flake in P2pProviderService unit test by initializing date with 0 milliseconds to prevent cross-second duration calculation mismatches.
Signed-off-by: Ashish Patel <zoom2ashish@gmail.com>
Co-authored-by: stonezdj <stone.zhang@broadcom.com>
goharbor/photon:5.0 was built and pushed independently by both the amd64 and
arm64 BUILD_PACKAGE matrix jobs to the same tag, so whichever job finished last
overwrote the other and the published tag ended up single-arch ("sometimes
amd64, sometimes arm64", #23324).
Build it once as an amd64+arm64 manifest list in a dedicated BUILD_BASE_IMAGE
job that BUILD_PACKAGE depends on, and exclude goharbor/photon from the
component manifest list in CREATE_MANIFEST (it is published here and stays at
tag 5.0).
The db base image keeps the photon-snapshot repo (the stable Photon source) and
installs both postgresql15-server (old binaries at /usr/pgsql/15/bin, required
by pg_upgrade) and postgresql18-server (runtime), temporarily un-pinning the
snapshot to pull whichever major Photon has deprecated out of the current
snapshot per architecture (pg15 on amd64, pg18 on arm64). common/Dockerfile
keeps photon-snapshot and merges its setup into a single RUN.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
fix: support arm64 valkey build while preserving amd64 package path
- Keep amd64 behavior unchanged with tdnf install of valkey
- Isolate source-build fallback to arm64 only
- Verify source tarball with SHA256
- Move valkey version/checksum definition to root Makefile and pass as build args
Signed-off-by: ranimandepudi <ranichowdary.mandepudi@arm.com>
* refresh goharbor photon:5.0 when create new base image
Signed-off-by: jUDASmILE <judasmile@gmail.com>
* correct date and format in buildbaselog
Signed-off-by: jUDASmILE <judasmile@gmail.com>
---------
Signed-off-by: jUDASmILE <judasmile@gmail.com>
build: support custom PyPI index URL for prepare image builds
Pass PIP_INDEX_URL through the make build chain as a Docker --build-arg,
mirroring the existing NPM_REGISTRY pattern for the portal build.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
we should not put the changes of v2.15.0 into the v2.14.1, create an 180 db scheme for v2.15.0
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
since we introduces a change on sql in the v2.14.1, it should be maintained the same version 171 in main, rather than adding the sql into the 180.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
* add per-endpoint CA certificate support for registry endpoints
fixes#22203
Allowing Harbor to trust self-signed or private CA certificates for individual registry endpoints without modifying the system-level trust store.
1. Database schema changes, API updates with PEM validation.
2. HTTP transport layer modifications across all the registry adapters.
3. UI field to fill in the certificate.
The feature is backward compatible - existing installations using system-level CA trust will continue to work without any changes.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* resolve lint failures
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* add i18n changes
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* resolve review comments
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* make the input as non-required and updates i18n
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* resolve comments
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
---------
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
simplify the sql to set the value of skip_audit_log_database, any evidence of previous usage of db to record the audit, set it to false.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
give the value of skip_audit_log_database bases on the real usage.
1. If audit logs exist in the system (either in audit_log or audit_log_ext tables),
set skip_audit_log_database to false
2. If no audit logs exist but the tables show evidence of previous usage
set skip_audit_log_database to false
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
Remove SYNC_QUOTA from env.jinja template
`SYNC_QUOTA` is not used throughout the whole code.
It looks like the feature using it was removed.
Signed-off-by: Max Fröhlich <maxbruchmann@gmail.com>
Co-authored-by: Wang Yan <wangyan@vmware.com>
feat(replication): add Single Active Replication per policy
* Added single_active_replication field to schema & DB table
* Updated API, controller & handler to enforce single execution per policy
* Added checkbox in UI to enable/disable single_active_replication for a
policy
* Implemented necessary backend & frontend tests
* Prevents parallel runs per policy if single_active_replication is enabled
Signed-off-by: bupd <bupdprasanth@gmail.com>
According to PR #22198, some inactive adapters have been removed from the default adapter list.
This pull request updates PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE accordingly, since the list of proxy cache adapters should be a subset of the replication adapters.
Signed-off-by: wy65701436 <wangyan@vmware.com>
This commit adds the field "status" to the struct of a vulnerability and adds
column "status" to vulnerability record table. It makes sure the statuses
of CVEs returned by trivy scanner are persisted and can be returned via
the vulnerabilities addition API of an artifact.
Signed-off-by: Daniel Jiang <daniel.jiang@broadcom.com>
add BUILD_INSTALLER parameter to optionally build prepare and log container only when we need to build offline_installer
Signed-off-by: my036811 <miner.yang@broadcom.com>
