fix: support arm64 valkey build while preserving amd64 package path
- Keep amd64 behavior unchanged with tdnf install of valkey
- Isolate source-build fallback to arm64 only
- Verify source tarball with SHA256
- Move valkey version/checksum definition to root Makefile and pass as build args
Signed-off-by: ranimandepudi <ranichowdary.mandepudi@arm.com>
Follow-up to #22900.
tokenIssuedAfterProjectCreation only validated info.ProjectName. A
cross-repository blob mount (POST /v2/<repo>/blobs/uploads/?from=<src>)
also requires pull access to the source project, so a token issued
before the source project was deleted and recreated with the same name
would still be accepted. Validate the issued-at time against the
blob-mount source project as well.
Also fail closed when the token has no iat claim: claims.IssuedAt is a
*NumericDate pointer and was dereferenced unconditionally, panicking the
request handler for a token without iat instead of rejecting it.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
fix: bump repository update_time on tag and artifact changes
Fixes#23149.
The "Last Modified Time" column on the repository list only moved
when an image was pushed. Adding or deleting a tag from the UI,
or deleting an artifact, left the timestamp stale.
This wires update_time bumps into:
- Tag create, delete, and retag (both UI and registry push)
- Artifact create and delete
A new repository.Manager.Touch method does the actual update and
invalidates the redis cache. It's skipped on tag-create conflicts
so a duplicate push doesn't falsely advance the timestamp.
The change is repo-only on purpose: artifacts are addressed by
their immutable digest, so an artifact update_time has no use.
Signed-off-by: aloui ikram <ikram@container-registry.com>
Co-authored-by: aloui ikram <ikram@container-registry.com>
Co-authored-by: Chlins Zhang <chlins.zhang@gmail.com>
* refresh goharbor photon:5.0 when create new base image
Signed-off-by: jUDASmILE <judasmile@gmail.com>
* correct date and format in buildbaselog
Signed-off-by: jUDASmILE <judasmile@gmail.com>
---------
Signed-off-by: jUDASmILE <judasmile@gmail.com>
fix UT failures for Go 1.26.3 compatibility
Add //nolint:revive to packages whose names shadow Go stdlib
Fix mock file import ordering (goimports compliance)
Bump golangci-lint from v2.8.0 to v2.9.0 for Go 1.26 support
Update CI step label to reflect Go 1.26
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
* support configurable PIP_INDEX_URL for swagger client build
Pass PIP_INDEX_URL through Makefile (conditional env injection),
APITest-Util.robot (robot variable with public PyPI default), and
Group3-Upgrade/run.sh (-v forwarding to robot).
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
* wait more time for proxy cache ready
refine proxy cache test in migration prepare
Signed-off-by: stonezdj <stonezdj@gmail.com>
---------
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Signed-off-by: stonezdj <stonezdj@gmail.com>
PR #23205 added PIP_INDEX_URL plumbing but did not set a default, so when
the variable is unset the top-level Makefile forwarded an empty value to
the photon sub-make. The sub-make in turn passed `--build-arg pip_index_url=`
to `docker build`, which overrides the Dockerfile.base ARG default with an
empty string and breaks `pip3 install pipenv ... --index-url ` (the option
requires an argument). This caused the BUILD_PACKAGE jobs on main to fail.
Mirror the existing NPM_REGISTRY pattern by providing a default value for
PIP_INDEX_URL in the top-level Makefile.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
Co-authored-by: Orlix <7236111+OrlinVasilev@users.noreply.github.com>
build: support custom PyPI index URL for prepare image builds
Pass PIP_INDEX_URL through the make build chain as a Docker --build-arg,
mirroring the existing NPM_REGISTRY pattern for the portal build.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Add UI option to enable proxy cache referrer API (#22767)
Expose the proxy_referrer_api setting in the portal for proxy-cache
projects (create project and policy configuration), with i18n strings.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
* perf(blob): use batched UNION with LIMIT 1 in FindBlobsShouldUnassociatedWithProject
Replace the single IN (...) query with batches of UNION'd per-blob
SELECT ... LIMIT 1 subqueries. Two improvements:
1. LIMIT 1 per subquery short-circuits as soon as one matching artifact
is found, avoiding full scans for associated blobs — especially
impactful during GC when checking large numbers of blobs.
2. Blobs are processed in batches of 100 to cap the size of each
generated SQL statement and avoid query length / memory issues when
dealing with very large blob sets.
Signed-off-by: paragdudeja <parag1907@gmail.com>
* test(blob): add batching boundary test for FindBlobsShouldUnassociatedWithProject
Verify correctness when blob count exceeds the batch size (100), ensuring
blobs are correctly identified across multiple query batches.
Signed-off-by: paragdudeja <parag1907@gmail.com>
* perf(blob): use VALUES+EXISTS instead of UNION+LIMIT1 in FindBlobsShouldUnassociatedWithProject
Replace the batched UNION+LIMIT1 approach with a single VALUES+EXISTS query.
EXISTS short-circuits on the first match per blob giving the planner high
selectivity to use the index, while VALUES lets all digests be checked in
one round trip with minimal planning overhead.
Benchmarked on production DB (~1.78M artifacts, 1000 blobs):
- UNION+LIMIT1 (10x100 batches): ~1845ms
- UNION+LIMIT1 (1x1000 batch): ~594ms (447ms planning, 147ms execution)
- VALUES+EXISTS (1x1000): ~1293ms (3ms planning, 1290ms execution)
VALUES+EXISTS is simpler, has near-zero planning overhead, and avoids
the repeated planning cost of multiple batched queries.
Signed-off-by: paragdudeja <parag1907@gmail.com>
---------
Signed-off-by: paragdudeja <parag1907@gmail.com>
default to run proxy cache from harbor
add SKIP_PROXY_CACHE setting to skip run proxy cache testcase in github action incase
registry.goharbor.io unstable
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Upgrades github.com/go-jose/go-jose/v4 from v4.1.3 to v4.1.4 to
address CVE-2026-34986 (GHSA-78h2-9frx-2jm8), which allows a crafted
JWE to trigger a panic during decryption.
Signed-off-by: Prasanth Baskar <bupdprasanth@gmail.com>
