The latest upstream photon:5.0 arm64 image currently has an empty rootfs,
which fails during the multi-arch base build with "/bin/sh: no such file
or directory". Pin the Photon base to a known-good stable digest to keep
the amd64 and arm64 builds reproducible.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
pin qemu binfmt and prevent publish races
- Pin docker/setup-qemu-action to tonistiigi/binfmt:qemu-v9.2.2 for stable arm64 emulation.
- Add per-branch concurrency in build-package workflow to avoid overlapping runs racing on mutable tags/manifests.
- Rename Go setup step label to match the actual configured version.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
- Use stdlib crypto/pbkdf2 instead of golang.org/x/crypto/pbkdf2 for
password/secret hashing (output unchanged; no migration needed).
- Restrict JWT signing to RSA/RSA-PSS and reject other methods in
pkg/token (default RS256 unchanged).
- Remove unused common/utils/email package (no references in codebase).
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
The per-component base images (goharbor/harbor-core-base, harbor-db-base,
harbor-portal-base, ...) were pushed by both BUILD_PACKAGE matrix jobs to the
same unsuffixed tag (e.g. :dev), so whichever architecture finished last
overwrote the other and the published tag ended up single-arch — the same
last-writer-wins problem goharbor/photon:5.0 had before #23334 (#23324).
Apply the same pattern already used for the component images:
- make/photon/Makefile: _build_base keeps building the local unsuffixed tag
(component Dockerfiles build FROM it unchanged) but pushes an arch-suffixed
tag instead: harbor-<name>-base:<tag>-amd64 / -arm64.
- .github/workflows/build-package.yml: each matrix job also saves the list of
goharbor/*-base repos it built; CREATE_MANIFEST combines the two suffixed
tags into the unsuffixed multi-arch manifest with docker buildx imagetools
create, using the base tag scheme (dev on main, the release version on
release-* branches). The base manifest step only runs when BUILD_BASE_IMAGE
decided to rebuild bases, since otherwise no suffixed tags were pushed in
this run.
Consumers that pull harbor-*-base:<tag> (PULL_BASE_FROM_DOCKERHUB=true flows)
now resolve the correct architecture via the manifest list instead of getting
whatever architecture won the race.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22
- Upgrade the Harbor UI (src/portal) from Angular 16 to Angular 19 and subsequently to Angular 21.
- Upgrade VMware Clarity from v17 to v18, and Node.js from v20 to v22 (updated .nvmrc, CI.yml, Makefile, Dockerfile).
- Migrate Angular templates to the new @if/@for control flow syntax.
- Fix UI issues #1 through #35, including robot accounts, layout, dropdown overlay, and input styling.
- Fix unit tests: resolve NG0100 ExpressionChangedAfterItHasBeenCheckedError in policy.component.spec.ts, replace autoDetectChanges(true) with explicit detectChanges cycles, and use TestBed.overrideComponent to stub AddP2pPolicyComponent template.
- Fix Clarity v18 breaking changes: update dark-theme SCSS import, add cds-theme attribute for theming, update ClrDatagridStateInterface import path, add ClrIconModule to app module.
- Stabilize npm installs and resolve CI/CD pipeline hangs.
- Fix swagger-ui crash caused by React 19 createRoot removal:
- swagger-ui 5.28+ resolves a nested react-dom@19 which removed createRoot
from the main react-dom entry point (moved to react-dom/client). The
swagger-ui-es-bundle-core.js still imports createRoot from react-dom,
making it undefined and causing "TypeError: i is not a function" at render.
- app-swagger-ui/webpack.prod.js: alias bare 'swagger-ui' import to
swagger-ui-bundle.js (the standalone UMD build that ships with React 18
already bundled), bypassing the broken external react-dom@19 entirely.
- app-swagger-ui/package.json: add npm overrides to pin react and
react-dom to ^18.3.1 so future npm installs do not re-introduce React 19.
- angular.json: expose swagger-ui.bundle.js and swagger-ui-index.html
from app-swagger-ui/dist as Angular dev-server assets, enabling the
proxy to serve the locally built, fixed bundle during development.
- Convert eslint-plugin-header config from JSON to JS to apply the ESLint 9 schema fix at config-load time, removing the need for patch-package.
- Pin all dependency versions to exact installed versions from the lock file, and remove unused prettier-eslint package.
- Fix flake in P2pProviderService unit test by initializing date with 0 milliseconds to prevent cross-second duration calculation mismatches.
Signed-off-by: Ashish Patel <zoom2ashish@gmail.com>
Co-authored-by: stonezdj <stone.zhang@broadcom.com>
goharbor/photon:5.0 was built and pushed independently by both the amd64 and
arm64 BUILD_PACKAGE matrix jobs to the same tag, so whichever job finished last
overwrote the other and the published tag ended up single-arch ("sometimes
amd64, sometimes arm64", #23324).
Build it once as an amd64+arm64 manifest list in a dedicated BUILD_BASE_IMAGE
job that BUILD_PACKAGE depends on, and exclude goharbor/photon from the
component manifest list in CREATE_MANIFEST (it is published here and stays at
tag 5.0).
The db base image keeps the photon-snapshot repo (the stable Photon source) and
installs both postgresql15-server (old binaries at /usr/pgsql/15/bin, required
by pg_upgrade) and postgresql18-server (runtime), temporarily un-pinning the
snapshot to pull whichever major Photon has deprecated out of the current
snapshot per architecture (pg15 on amd64, pg18 on arm64). common/Dockerfile
keeps photon-snapshot and merges its setup into a single RUN.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
fix: support arm64 valkey build while preserving amd64 package path
- Keep amd64 behavior unchanged with tdnf install of valkey
- Isolate source-build fallback to arm64 only
- Verify source tarball with SHA256
- Move valkey version/checksum definition to root Makefile and pass as build args
Signed-off-by: ranimandepudi <ranichowdary.mandepudi@arm.com>
* refresh goharbor photon:5.0 when create new base image
Signed-off-by: jUDASmILE <judasmile@gmail.com>
* correct date and format in buildbaselog
Signed-off-by: jUDASmILE <judasmile@gmail.com>
---------
Signed-off-by: jUDASmILE <judasmile@gmail.com>
build: support custom PyPI index URL for prepare image builds
Pass PIP_INDEX_URL through the make build chain as a Docker --build-arg,
mirroring the existing NPM_REGISTRY pattern for the portal build.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Remove SYNC_QUOTA from env.jinja template
`SYNC_QUOTA` is not used throughout the whole code.
It looks like the feature using it was removed.
Signed-off-by: Max Fröhlich <maxbruchmann@gmail.com>
Co-authored-by: Wang Yan <wangyan@vmware.com>
According to PR #22198, some inactive adapters have been removed from the default adapter list.
This pull request updates PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE accordingly, since the list of proxy cache adapters should be a subset of the replication adapters.
Signed-off-by: wy65701436 <wangyan@vmware.com>
add BUILD_INSTALLER parameter to optionally build prepare and log container only when we need to build offline_installer
Signed-off-by: my036811 <miner.yang@broadcom.com>
Add the field extra_attrs to the p2p preheat policy for the provider to
define their specified parameters when preheating.
Signed-off-by: chlins <chlins.zhang@gmail.com>
The initdb.sh and the upgrade.sh scripts in the postgres image
were not owned by the postgres user, which made them failing
with permission denied errors.
Signed-off-by: Mate Hajnal <hajnalmt@gmail.com>
Parallel attach LDAP group
Add configure LDAP group attach parallel UI
Change the /c/login timeout from 60 (nginx default) to 900 seconds in nginx.conf
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
